Consider an affine cipher.

The cryptanalyst observed the following plaintext/ciphertext pairs $(p,c)$: $(8,15)$ and $(5,16)$.

  1. Recover the key $(a,b)$ used in the encryption system above.
  2. What is the ciphertext corresponding to the plaintext $p=3$?

For #1, I came to this result:

$$\begin{aligned} 8 \cdot a + b &\equiv 15, \\ 5 \cdot a + b &\equiv 16 \\ \implies a &\equiv 17, \\ b &\equiv 9. \end{aligned} \pmod{26} $$

For #2, congruence gave me:

$$\begin{aligned} 3a &\equiv -1, \\ \text{which is}\quad 3a &\equiv 25, \\ \implies 3^{-1} &\equiv 27, \end{aligned} \pmod{26} $$

not $17$. Am I doing something wrong?

  • $\begingroup$ The only answer I can come up with: Leaving the -1, You get - (3^-1) which gives - 9. Then -9 mod 26 is 17!! Is that it? $\endgroup$
    – Mikeez
    Oct 6, 2017 at 19:26

2 Answers 2


After $3a=-1 \pmod{26}$ note that mod $26$ we have $-1 = 25=51=3\cdot 17$, so $a=17$.

Alternatively, note that $3\cdot9=27=1$ so we can multiply both sides by $3^{-1}=9$ and $-9=17\pmod{26}$.

And then $5\cdot17 +b = 9$, and $5\cdot 17=85=7$ and so $b=9$.

Now substitute $p=3$ in the encryption formula $c=17p+9$ for the final question.


It appears that you already know that, if the plaintext character is $p$, then the corresponding ciphertext character will be $(pa + b) \bmod 26$.

You've correctly inserted the given plaintext/ciphertext pairs into this formula to obtain the linear congruences $8a+b \equiv 15$ and $5a+b \equiv 16$, and solved them modulo $26$ to obtain the coefficients $a \equiv 17$ and $b \equiv 9$.

All you need to do now is apply the same formula given above to $p=3$, i.e. to calculate $(3a + b) \bmod 26 = (3\times17+9) \bmod 26$. This will give you the ciphertext corresponding to the plaintext $3$.

(If you were instead given the ciphertext value $3$ and told to decrypt it, then you'd have to solve the linear congruence $17p+9 \equiv 3$ modulo $26$, which would involve calculating the modular inverse of the multiplicative factor $17$ modulo $26$. But since you're only told to encrypt a plaintext value, you don't need to calculate any inverses.)


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.