Relative security of a Vigenère cipher

Question

Within a closed computer network, I am ciphering some plaintext data as an added security measure. This is below several other layers of protection. For various technical reasons, I am restricted to plain-text, UTF-8 data. To that end, I have been using a Vigenère cipher with pre-shared key database. The keys range from 30 to 100 characters, and are not dictionary words.

My question is regarding the Vigenère cipher: It is my understanding that the security of this cipher is directly related to the length and security of the keys. Long and tightly secured keys bring this cipher on par with many more complex techniques. Is that true, or is this a "kiddie" cipher that could be cracked while you sleep?

Edit It may bear mentioning, the text that is being ciphered is JSON encoded data arrays, which is human readable but not "natural language" -- it contains many symbols interspersed with the actual data.

EDIT 2 Plaintext length varies unpredictably, from 100 characters to 5,000 plus. The data is being transported via SSL, so this is, as I mentioned, intended as yet another added layer, not the whole and sum of security used.

Answer 1

The real security of Vigenère is difficult to quantify. A million character plaintext with a 10 character password is easy to break. But a 10 character plaintext with a 10 character randomly chosen password is essentially a one-time-pad and theoretically unbreakable.

Given the data you've told us (plaintext: 100 to 5000 characters; password: 30 to 100 characters), it would seem that Vigenère adds very little. A 5000 character plaintext with 30 character password yields $5000/30\approx 167$ characters per plaintext alphabet. That is easily breakable using statistical methods. Other configurations given the numbers you've specified might be slightly harder (especially if the password were completely random).

That said, if you are already using SSL and adding Vigenère "as yet another added layer" of security, the increase in security by using Vigenère is 0 at worst and negligible at best. An attacker who can break SSL will have no problems breaking Vigenère.

Answer 2

The Vigenère cipher has many weaknesses, but perhaps the most obvious ones are:

• An attacker, who knows (or can guess) as many consecutive characters of any plaintext message as there are in the key, can trivially recover the key and thus decrypt all messages. (In fact, the characters need not even be consecutive, they just need to cover the entire key, or at least most of it.)

• For most natural messages, it's fairly easy to guess the key length, for example by looking at correlations between characters $n$ positions apart.

• An attacker who knows (or can guess) the key length can divide the ciphertext into blocks of this length and decrypt one block with the other as the key to obtain a linear combination of the two messages. This will often have enough structure to allow the original blocks to be (at least partially) reconstructed, which in turn allows recovery of the key. (Also, if there are multiple messages encrypted with the same key, or if the key itself is not completely random, other similar attacks may be possible even without guessing the key length.)

In short, I would strongly recommend not using the Vigenère cipher for any purpose, except perhaps for puzzles that are meant to be broken. At the very least, use a stream cipher like RC4, which is simple enough to implement off the top of your head. Also, if you need to encrypt multiple files, include a unique initialization vector with each (or derive one from some unique value, like the name of the file) and hash it together with your master key.

(Using a stream cipher in such a way that they output remains valid Unicode text is a somewhat non-trivial exercise in format-preserving encryption, but it should be no harder than doing the same with a Vigenère cipher. Personally, I'd suggest encrypting the input as a binary octet stream and then Base64-encoding it into printable ASCII as the simplest secure method.)

Answer 3

Eek! The Vigenere cipher is completely and totally insecure. You should never use it. Instead, use a modern authenticated encryption scheme.

If you are protecting data in transit, I recommend using TLS (or SSL). If you are protecting data in storage, I recommend encrypting it with GPG (or PGP). This is the simplest, easiest way to get well-vetted cryptography that is unlikely to have a catastrophic flaw.

Answer 4

Besides others (e.g. random key, key used only once) it depends on the proportion of cipher text length and key length how difficult it is to break the cipher. There are tools around that can break the cipher if cipher_text_length/key_length is 4 or greater (e.g. http://www.guballa.de/pages/geocaching/vigenere-solver.php). In some exceptional cases the proportion may be even 3. Thus the Vigenere cipher is rather insecure. But as already said by others: If the key length is equal to the cipher text length then the cipher is absolutely secure if the key is chosen completely randomly and is only used once. This will turn the cipher into a one time pad. Drawback: one time pads are difficult and ineffective to manage.

Answer 5

The only way for this cipher to be secure these days is to use a truly random running key that is the same size or larger then the plaintext. Then to never ever use that same key again. This makes the cipher a One-Time Pad which is the one cipher that is truly unbreakable. But key generation, management, and storage would be extremely difficult.

Answer 6

Using Vigenere as an added security measure is like adding an a4 plain printing paper on your head during a rainy day. It might soak some water, but you will get wet in the end. Use a well made umbrella (Or a modern well tested encryption method).

So yes, it could be cracked (and relatively easily) while you are asleep. Other than historical and hedonistic purposes, using this cipher is not recommended what so ever (Even if it is being used to be added as an additional layer).