Levels of strength: The Caesar Cipher

Question

SITREP: I am deciding what form of "Random" Number generation would fit best for a Caesar Cipher that encrypts each letter with a different integer as a shift. This encryption is being handled via C# code I have and will write. I have a few options for this as follows.

(Note: The transmission of the key to the receiver is NOT a concern at this time and when it is a problem I will open a new question, this also includes how to hide which method I use to get the key, as that is a question for another time. Also to note, all random numbers not specified to be generated in a specific measure should be assumed to be generated from the C# code Random.Next(); Thank You.)

OPTIONS:

1. User Entered. This can be up to the length of my message or below it in which case I can either use random numbers or simply repeat the sequence provided by the user (Please advise best option if this is the selected method).
2. Randomly Generated Numbers. I am aware of the use of OTP's but would also like to know how viable shorter keys are.
3. Computer or User Generated Keys. This method entertains many ideas such as a key linked to file size, time stamps, others. Is there another well documented use of encryption that serves well while being covert as to my use of it at the same time that I may look into?

ANSWERS: Please back up claims if they are not openly supported by the community here. If you would like to link to another question or article that may help please feel free to do so. Thank you for your time.

Answer 1

To be honest, I think all of them do NOT make much difference, since Caesar Cipher is a weak cipher. You can see Breaking the cipher on Wikipedia. It uses a method called frequency analysis, which ignores key strength.

Also, the three methods you mentioned all have their weaknesses. You should use a secure random generator.

Answer 2

Hmm, first about your type of encryption:

...for a Caesar Cipher that encrypts each letter with a different integer as a shift...

This actually describes a Vigenère Cipher. The classic approach to break this kind of cipher is by

• Determine the key length first
• Break the underlying Caesar Cipher for each letter of the key.

To follow this route a precondition is of course, that the key is much shorter than the actual encrypted text. Why? E.g. if the text has 20 characters while the key has 5, you have for each letter of the key only 4 letters encrypted text, which makes a frequency analysis difficult (but not impossible!).

If the key is as long as the encryted text, then this results in a kind of OTP which (if done right) is not breakable to my knowledge. An attempt to break it would be a direct attack on the key, based on assumptions of how the key is constructed.

Please note: Breaking classic Vigenère is totally independent of having information about the key. In fact, Vigenère can just as easily broken if the key is a common word, or completely random shifts. The only relevant question is the length of the key.

Now to your options:

1. User-Entered key, either shorter as the text or of equal (or larger) size: If the key size is much shorter than the text, it's the classic Vigenère and can easily be broken.

   If the key is as long as the text one would have to try methods breaking a OTP.

2. Randomly generated key: (Pseudo) random number generators have a period that is much larger than any reasonable text, so the classic attack on Vigenère does not work here. Then again, pseudo random number generators have their own vulnerabilities, so a direct attack on the key might be an option.

   Real random numbers would result in a perfect, unbreakable cipher. In reality transmission of the key would be the problem, but as you explicitely say this is not a problem here, this encryption would be perfect.

3. Computer or user generated keys: As above, the question is not so much if the key is generated by the computer or the user, but if the key is long enough to make the classic Vigenère attack impossible.

Bottom line: If you want to make Vigenère unbreakable you have to do 2 things at the same time:

• make the key as long as the encrypted text, and
• create the key in a way that it cannot be guessed