# M-94 disk cipher keyspace

If the M-94 had only 10 disks, what would be the keyspace of the resulting cipher and what is the useful keypspace of the 10 disk cipher?

• Hint: in M-94, "the wheels could be assembled on the rod in any order; the ordering used during encoding comprised the key"; where I understand comprised means precisely was, based in part on an earlier version of the wikipedia article. – fgrieu Aug 24 '16 at 20:09
• I caught myself thinking if "useful keyspace" means something specific in this case? – ilkkachu Aug 24 '16 at 20:14

In a disk cipher like the M-94, each key corresponds to a permutation of the cipher disks. Thus, with $n$ disks, there are $n! = 1 \times 2 \times 3 \times \dots \times n$ distinct possible keys.

(It's technically possible for some of these keys to be equivalent, e.g. if two of the disks are identical. But this is extremely unlikely if the letters on each disk are ordered randomly.)

Note that enumerating the keyspace by brute force is not the most efficient way to attack a disk cipher (and thus the size of the keyspace is not a meaningful indicator of the strength of the cipher), regardless of whether the attacker knows the alphabets on the disks or not.

Rather, a typical cryptanalytic approach would exploit either known or guessed plaintext, or simply the fact that consecutive letters in English text are highly correlated, and in particular, that certain words and phrases like "THE" or "AND" occur far more often than one would expect by chance.

For example, if the ciphertext begins with the letters "XYZ", and if we know (or can guess) that the first word of the plaintext might be "THE" and that the first cipher disk might be disk 1, then it's easy enough to locate the letters "X" and "T" on disk 1 and see which other disks have "Y"/"H" and "Z"/"E" at the corresponding positions. If we find two such disks — say, disks 4 and 7 — then we can guess with a pretty good confidence that the first three disks in the key may be 1, 4 and 7, and proceed further from there; if we don't, then one of our guesses must be wrong, and we may e.g. try another disk for the first letter and see if that yields a solution.

(The attack described above assumes that the alphabets on the disks are known. If they're not, a similar attack can still be carried out, based on repeating patterns in the ciphertext where the same word at the same position just happened to be encrypted with the same row, although it will require a lot more ciphertext and effort to succeed. Even so, such an attack is still a lot more efficient than brute force enumeration of all the possible alphabets on each disk.)