So a vigenere cipher's main weakness is that you can use frequency analysis on each alternated alphabet, and thus crack the cipher with relative ease... But that implies that you know what the frequency of the plaintext is.

So what if you hybridized vigenere cipher with some other algorithm that obscured the frequency? At first glance, this doesn't seem like a remotely weak system.


You could obscure the frequency using a block-cipher or stream-cipher or use a code-book substitution, then maybe use Vigenere Cipher on it, but if you really want your scheme to be secure, then your underlying substitution must be secure enough. In that case using secure block or steam encryption itself is enough. The second level Vigenere encryption is just a burden, and also a possible backdoor (might lead to lazy people reusing keys, leading to vulnerabilities).

Besides, frequency analysis is its major weakness, but not its only weakness.

Pretending your underlying substitution is weak:

Consider Kasiski examination: If you use a code-book substitution for randomisation (not ideal) or a block-cipher in ECB-mode (which you mustn't) then use a Vigenere key as big as the block, then it is easily vulnerable to this attack. It is still vulnerable if you use a key of a different length. The next step is to break the substitution.

Now consider Key Elimination: Just XOR two consecutive blocks of Vigenere key size, the you get the XOR of the two blocks of plaintext. Now you could break it by finding patterns to guess two possible plaintexts from the first level substitution. It is actually easy if you use something weak.

Pretending your underlying substitution is secure:

If you use a stream cipher, then it is the same as combining the Vigenere key with the pseudorandom keystream, which is not only useless, but could lead to pattern finding as the repetition of the Vigenere key pattern in the PRNG keystream.

Otherwise, just stick to something secure. It would be better, more secure and efficient if you use a stream-cipher with PRNGs like AES-CTR, which is blazing fast and secure.

When could you actually make it secure:

  1. Use the Vigenere Cipher only, but as One-Time-Pad.
  2. Use Vigenere Cipher for a Key Whitening process, where you will have to re-substitute with some block algorithm.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.