Suppose someone had published a several hundred page (sensitive) book, but had randomized all of the letters in an order known only to them (e.g. with a vector of random numbers of the same length as the book's characters).

This initially strikes me as relatively riskier than something of comparable simplicity (like a one time pad) since the letters are all in the clear. But, I can't quite see how an attacker would benefit much from that information. Are there known attacks on this sort of thing to learn things about the text? What could be learned? Could one maybe at least tease out an idea of what the book was about? At what message lengths (if not all) could it be a big problem?

Hopefully this doesn't qualify as asking the community for "peer review of a cryptographic scheme"!


1 Answer 1


What you are describing is called a transposition cipher.

First of all, it would be easy to detect which method you are using since the frequency distribution of your cipher text will be the same as the language of the plain text.

I think the biggest problem with using only transposition as opposed to a combination of both substitution and transposition is that you do not need to manipulate the whole message in order to find the key (i.e the order in which you shuffled it) finding how one word was shuffled reveals how the whole plain text was shuffled.

Another weakness is that even if you do not have the correct key, being close to it already reveals a lot of information.

A way to break this cipher would be to take a small chunk of cipher text and shuffle it around until you find some anagram to a known word, then solve the anagram.

Edit :

After rereading the question, if you were to shuffle your text randomly as you said in your example it is similar to using a one time pad for the exception that the key to the pad would be draw from a different distribution since you probably will not have equal amounts of each letter of the alphabet in your book.

Let $m$ be the book and $c$ be the shuffled book you can derive a key $k$ such that $|k| = |m|$ and $m\oplus k = c$.

$k = m\oplus c$.

  • $\begingroup$ Isn't the distribution of letters in the cipher text the same as that of the plain text regardless of the method used? So, would it really give away the method? I was imagining a scenario where each letter of plaintext simply received a 0-1 random number and they were sorted by those values - but I'll keep reading on transposition ciphers in the meantime! $\endgroup$
    – dcc310
    Jul 8, 2016 at 5:09
  • 1
    $\begingroup$ The goal of a good block cipher would be to make the cipher text look at random as possible so that no statistical attack could be applied to the cipher text in order to either retrieve they key nor the plaintext. As for the way you taught of shuffling around the letters, there is still an underlying permutation that you create (although indirectly). $\endgroup$
    – Yuon
    Jul 8, 2016 at 5:17
  • 3
    $\begingroup$ The goal of a cipher is that no information about the plaintext (with the exception of its length) can be obtained from the ciphertext, including for repeated use of the the same key. A substitution cipher does not meet this goal, even restricted to a single message, since the distribution of letters counts as information (it has practical implications: think of a message known to be in English and making frequent references to one of BEIJING or ZHANGZHOU; from the frequency of letters, one can guess which). Also, substitution ciphers are breakable with a few known plaintext messages. $\endgroup$
    – fgrieu
    Jul 8, 2016 at 6:20
  • $\begingroup$ how would "finding how one word was shuffled reveals how the whole plain text was shuffled", if the vector was the same length as the message? For something with a pattern, i can see that helping, but for a pad? not so much... $\endgroup$
    – dandavis
    Jul 9, 2016 at 10:03
  • $\begingroup$ @dandavis you are right, recognizing the pattern is only useful for a block cipher type of encryption. However I argue that simply shuffling in a random order is equivalent to use a one time pad : imagine the binary representation of plain text and cipher text, you can retrieve a key which is the size of the plain text in which xoring it with the plain text will result in the cipher text $\endgroup$
    – Yuon
    Jul 9, 2016 at 11:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.