# Levels of strength: The Caesar Cipher

SITREP: I am deciding what form of "Random" Number generation would fit best for a Caesar Cipher that encrypts each letter with a different integer as a shift. This encryption is being handled via C# code I have and will write. I have a few options for this as follows.

(Note: The transmission of the key to the receiver is NOT a concern at this time and when it is a problem I will open a new question, this also includes how to hide which method I use to get the key, as that is a question for another time. Also to note, all random numbers not specified to be generated in a specific measure should be assumed to be generated from the C# code Random.Next(); Thank You.)

OPTIONS:

1. User Entered. This can be up to the length of my message or below it in which case I can either use random numbers or simply repeat the sequence provided by the user (Please advise best option if this is the selected method).
2. Randomly Generated Numbers. I am aware of the use of OTP's but would also like to know how viable shorter keys are.
3. Computer or User Generated Keys. This method entertains many ideas such as a key linked to file size, time stamps, others. Is there another well documented use of encryption that serves well while being covert as to my use of it at the same time that I may look into?

ANSWERS: Please back up claims if they are not openly supported by the community here. If you would like to link to another question or article that may help please feel free to do so. Thank you for your time.

• As mentioned in the current answer, the question is somehow stepping on the wrong ground. Caesar Cipher, and even "stronger" substitution concepts (what you describe is, in fact, closer to Vigenère or one time pad), are not suitable for ANY security purpose. As such, the source of randomness is irrelevant. If you intend to use it just as a proof of concept (to see if you can implement it), then security is irrelevant and you can use the default random generator (usually insecure) to produce your "key". – Sergio A. Figueroa Mar 5 '16 at 14:32
• I apologize for not including the field of my intended audience as I forgot the target of this website are those who are interested in securing large amounts of data from direct attacks. The intention of this project is not necessarily to be strong against those who understand encryption. I should have included in my question that I merely want it to be strong enough that it could not be immediately broken by an online decipherer. Mea Culpa – user31830 Mar 5 '16 at 14:37
• If you insist in using "classical ciphers", you might want to take a look to One Time Pad and understand why it is not used in practical scenarios. If it is complexity what keeps you from using any real symmetric encryption approach, keep in mind that BouncyCastle, one of the most popular cryptographic libraries, is available for C#. It is well documented and you can find samples online. If your purpose is something playful, like a cryptopuzzle, then the use of real randomness isn't really critical. If still curious about PRNGs, StackOverflow recommends the RNGCryptoServiceProvider Class. – Sergio A. Figueroa Mar 5 '16 at 14:56
• This project was more about the journey rather then the destination, and I do realize you did not know this. The Caesar Cipher is nice because I can custom write it from the ground up rather then relying on a class I did not write. If I start doing real security rather than just a project when I'm bored I will be sure to use more secure methods rather than thousand year old ciphers. Thanks for the help! – user31830 Mar 5 '16 at 15:41
• And with such approach, I will encourage you to keep asking as you progress. If you do it here, make sure that you state all the facts that can be relevant: what you know, what you have tried and what you can't solve. That way, the question can get a better answer and the answer can reach more people. – Sergio A. Figueroa Mar 5 '16 at 16:10

To be honest, I think all of them do NOT make much difference, since Caesar Cipher is a weak cipher. You can see Breaking the cipher on Wikipedia. It uses a method called frequency analysis, which ignores key strength.

Also, the three methods you mentioned all have their weaknesses. You should use a secure random generator.

...for a Caesar Cipher that encrypts each letter with a different integer as a shift...

This actually describes a Vigenère Cipher. The classic approach to break this kind of cipher is by

• Determine the key length first
• Break the underlying Caesar Cipher for each letter of the key.

To follow this route a precondition is of course, that the key is much shorter than the actual encrypted text. Why? E.g. if the text has 20 characters while the key has 5, you have for each letter of the key only 4 letters encrypted text, which makes a frequency analysis difficult (but not impossible!).

If the key is as long as the encryted text, then this results in a kind of OTP which (if done right) is not breakable to my knowledge. An attempt to break it would be a direct attack on the key, based on assumptions of how the key is constructed.

Please note: Breaking classic Vigenère is totally independent of having information about the key. In fact, Vigenère can just as easily broken if the key is a common word, or completely random shifts. The only relevant question is the length of the key.

1. User-Entered key, either shorter as the text or of equal (or larger) size: If the key size is much shorter than the text, it's the classic Vigenère and can easily be broken.

If the key is as long as the text one would have to try methods breaking a OTP.

2. Randomly generated key: (Pseudo) random number generators have a period that is much larger than any reasonable text, so the classic attack on Vigenère does not work here. Then again, pseudo random number generators have their own vulnerabilities, so a direct attack on the key might be an option.

Real random numbers would result in a perfect, unbreakable cipher. In reality transmission of the key would be the problem, but as you explicitely say this is not a problem here, this encryption would be perfect.

3. Computer or user generated keys: As above, the question is not so much if the key is generated by the computer or the user, but if the key is long enough to make the classic Vigenère attack impossible.

Bottom line: If you want to make Vigenère unbreakable you have to do 2 things at the same time:

• make the key as long as the encrypted text, and
• create the key in a way that it cannot be guessed