# What is the limit of plaintext required to break the Vigenère encryption?

A theoretical question about the Vigenère cipher:

1. Without any knowledge about the key (not even it's length) can we tell how much known or chosen plaintext is needed for the adversary to completely recover the key?
2. What about if we know the key length? (I assume that we'll need plaintext with the same length of the key).

For chosen plaintext and a classic Vigenère cipher, you need only as many characters of plaintext as the length of the key to completely recover the key. It's a trivial reversal. (If the cipher uses 26 scrambled alphabets, it will take more.) if you don't know the length of the key, you will spot the repeating sequence after the second repeat.

For an unknown ciphertext, that's when it gets interesting. You need enough repeats of the keylength to measure the index of coincidence. The Friedman test provides a way to estimate the amount of ciphertext.

• You mention "you will spot the repeating sequence after the second repeat." While true, how can the attacker be certain that the key doesn't contain repetitions followed by a deviation from the repeated pattern? – mdittmer Jun 8 '19 at 21:18
• @mdittmer , let’s say the key was ABCABCABX. Assuming average distributions, you would see two very strong correlations and one would be weaker, but you’d clearly accept it was a length 3 key of ABC. The reveal would come when you decrypt, and every 9th character would be wrong. However, that’s plenty of correct context to figure out the right key. – John Deters Jun 9 '19 at 14:45
• That's true. I guess what I'm trying to point out is that not knowing the length of the key poses a problem for the attacker. If, instead, the key is ABC{repeated 10 times}{100 characters selected uniformly at random}, the attacker may be confident after processing a ciphertext of length 30, but will be unpleasantly surprised when faced with the task of decrypting a 130-character ciphertext. (Obviously, I've chosen a particularly diabolical example.) – mdittmer Jun 10 '19 at 15:14
• @mdittmer , that’s what the index of coincidence is supposed to reveal. Check out this paper for more info: nku.edu/~christensen/1402%20Friedman%20test%202.pdf – John Deters Jun 10 '19 at 18:16
• Thanks for the link. It provides a solid explanation of how to use index of coincidence.I'm not sure the method solves the problem I have in mind, though. The problem arises from the fact that any, say, 30-letter ciphertext where K=ABC{repeated 10 times}{100 characters selected uniformly at random} is identical to a 30-letter ciphertext where K=ABC{repeated 10 times}. – mdittmer Jun 16 '19 at 23:37

First of all I think your two questions can be reduced to one. If you don't know the key length, then you can simply brute force over the different key lengths.

For breaking the Vigenere cipher the proportion cipher_text_length/key_length is the most important number as it determines how many characters of the clear text have been encrypted with the same letter of the key.

But in my opinion there are also other points to be taken into account. For example, it depends on the language of the clear text. Why? Because to determine if a chosen key is the correct one, you need to judge how far the clear text differs from a randomly chosen sequence of letters (or the other way around: how near the clear text comes to the specified language).

For example let's have a look at the English and the German language: In both languages the most frequent letter is "E". The probability of a letter being an "E" is ~17.4% for German and ~12.7% for English. For random text the probability for the letter "E" is 1/26 = ~3.8%. Now lets take the most frequent bigrams of both languages: "ER" in German has a probability of ~3.9% while "TH" in English has a probability of ~2.7%. This leads me to the assumption that German text differs more significantly from a purely random sequence of letters than English. So in case the key is rather long in relation to the given cipher text, it will be easier to break a German Vigenere cipher than an English one.

I once wrote a tool which is breaking Vigenere ciphers. The keys are scored by calculating the fitness of the resulting clear text. The fitness is a measure how probable it is that the text is German or English (depending on the chosen language). My observation is that German texts score slightly higher than English texts, which is no surprise having made the observation above.

So let's have a look at the proportion cipher_text_length/key_length.

The tool I wrote can break the most Vigenere ciphers correctly if the proportion is in the range of ~6 (i.e. the cipher text is around 6 times longer than the key).

Even if the proportion is reduced to 4, lots of Vigenere ciphers can be broken, but in some cases one or another letter of the determined key is wrong (but with human interaction the key can be recovered completely without problems).

So let's take the following cipher (English clear text):

VVRQI EREOY LDPTT MWNFL ECKAV MZPWE EHRZK UHXHI KCISC BGBZH LHEPK DSERK AEESJ KOLIF
ZJKHB SXSZK SALUA ZPGVX EOKIX OZEIQ VHBHF HWFJI MITSP XHCZS JTYWH VTRSW KVMSG QTKSY
WYMOF XQPSH IGSOH GMVXC ITPKW YZXAH JVRSK ZWGXT RMTXW AGFDV IQGTK SVXEM OMFWN OFOR


The cipher text is around four times longer than the key. The solver at http://www.guballa.de/pages/geocaching/vigenere-solver.php provides almost the correct key, only one letter is determined incorrectly. This cipher was given as a challenge, refer to http://s13.zetaboards.com/Crypto/topic/6733475/1/.

Not all Vigenere ciphers can be cracked with this accuracy, but in rather exceptional cases even shorter ciphers can be cracked.

Let's take the following Vigenere cipher (German clear text):

ypfznuwwafvtgpqqzt


Here the key length is 5, thus the proportion clear_text_len/key_len is 3.6. Still, the key is determined correctly. You can even shorten the cipher text by cutting off the last 5 characters, reducing the proportion down to 2.6 and even here the correct key is determined. But as I said this is a rather exceptional case.

Why is this case exceptional? Because the fitness function applied is using stochastic methods, and the clear text has very significant characteristics which are recognized by the algorithm.

My first statement was "it depends", and so for some special cases even better results might be achieved. E.g. http://www.sichere.it/vigenere_tool.php shows an interesting approach where extremely short Vigenere ciphers can be broken, but all words of the clear text as well as the key must be found in the dictionary.