How secure would this code be against cryptanalysis?

Question

Simple version:

Create software that takes a database of the dictionary, alphabet, and phrases. Randomly generate a database of random strings of letters/numbers/symbols of varying length. Randomly assign different strings to different words/letters/phrases.

Frequency analysis should already be hard because you're operating at a higher level than letters. But to make it more difficult, randomly assign multiple strings to the same word.

Throw in a good assortment of null strings for good measure. Certain strings would indicate that X number of strings following it are to be discarded, or various strings could indicate to disregard everything in between, thus adding gibberish to the mix.

Sophisticated version:

Create multiple versions where the same strings are assigned to different words/letters/phrases across each version. Have strings that signal that the following strings are to be interpreted with a certain version. A single version could be used for a whole message, or it could be changed throughout the message.

For example, in one version, f&1nl8(a#v4 could mean car.
In another version it could mean mountain.

Suppose v19g31dfs meant use version 13.
Then f&1nl8(a#v4 v19g31dfs [...] f&1nl8(a#v4 would appear to repeat the same word.

Assume that the software is secure, and the only means of attack is direct cryptanalysis on intercepted messages.

Question:

How secure would this code be against cryptanalysis?

Answer 1

What you have is a type of substitution cipher, at the level of words rather than letters. Using multiple ciphertexts to correspond with the same plaintext atoms is called homophonic substitution. Homophonic substitution does make frequency analysis on atoms more difficult, but by no means impossible. You merely need more ciphertext to analyze.

Frequency analysis can also be performed on digrams (i.e. pairs of words) or longer sequences. For example, a word that usually precedes a noun has a high probability of being a or the.

Compared with an alphabetic substitution cipher, yours requires a huge key: the key needs to describe all possible substitutions, so it must contain one or more entry per word. Rather than apply complex rules based on such a large key, you'd do better to generate a random key of the same length and use it as a one-time pad. That one-time pad would be good for a plaintext that's as long as your dictionary, whereas frequency attacks would begin in practice long before your dictionary was exhausted.

Adding instructions such as “skip” or “rotate key” in the stream doesn't fundamentally improve things, It does make frequency analysis a lot more difficult if you use them correctly, but not impossible the way modern cryptography does (every byte has exactly the same chance of having any given value, to someone who doesn't know the key). You need to describe the rules in the key, making it even larger.

Answer 2

At first glimpse, your idea reads like you're blowing up a substitution cypher from "byte-level" to "word/sentence level". Also, I detect an initial but important security problem: you are weakening the crypto using your "blowup" strategy.

Example: encoding "attack at dawn" using your crypto I would end up in 2 substitutions, while even a simple XOR-based crypto would mix up all 14 characters.

MSG:    attack at dawn
YOU:    green leaf          (where "green" means "attack" and "leaf" means "at dawn")
XOR:    A_%2G6&§sxH%&d      

As you can see: in this case your crypto idea provides only 2/14 of the security compared to a simple XOR approach, which already gives ample indication that it will be pretty easy to analyze and break.

In the end, your idea is probably a good example to show why it's never a good idea to create your own crypto (that is, unless you know what you are doing).

EDIT

Based on the comments OP posted at @Gilles' and my answer, I would like to advise OP to start learning cryptography from scratch, before diving into useless discussions that lead to nowhere. Personally, I am convinced that it simply doesn't make sense to dive into crypto-analytics as long as OP is missing basic knowledge in the field of cryptography...

A good starting point would be the "Handbook of Applied Cryptography" by Ronald L. Rivest.