# How safe is a book cipher? How would you break it?

This might not be a very specific question, but I was wondering this morning. If one were to encode a message by making a string out of an entire book and writing the message by searching for a random occurrence in the "book-string" of each letter in the message and replacing it with the string index of the letter. Additionally you could make sure no number appears twice in the message as there is normally more than one occurrence of each letter in a book. This way no "letter" in the encrypted message would repeat.

How safe is this, assuming you passed on the key safely, and how would you go about breaking it?

• So, is your key the book? – Hilder Vitor Lima Pereira Oct 2 '18 at 7:01
• Yes it is... You would have the same version and everything of vourse... – Ciarán J. Hagen Oct 2 '18 at 7:08
• Could you give an example on how this encryption would look like? – AleksanderRas Oct 2 '18 at 7:18
• For example assume your book-string is "abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyz" – Ciarán J. Hagen Oct 2 '18 at 7:21
• Yes, but if you never reuse a letter from the book, how can you ever reconstruct a message? There are billions of books in the world, with different versions and publifications of each... – Ciarán J. Hagen Oct 2 '18 at 7:29

This isn't very secure. Generally, partial knowledge of the plaintext should not lead to leakage of other parts of the plaintext. In your book cipher it clearly does.

Say we guess the first part of the message. Then we can try and see which books would be correct for the given ciphertext. After the book (the key) is found we can then decrypt the rest of the message.

• You're right... simple guessing could pretty quickly limit the number of possible books! Thanks. – Ciarán J. Hagen Oct 2 '18 at 7:59
• Another weakness is that letters in a book are not independent. If at one point you see 55 as a q, there is a very good chance that a 56 encountered later is a u – John Meacham Oct 4 '18 at 6:54
• True, but this problem can at least be mitigated by choosing a book with a lot of text (compared to the message). Of course, this will also limit the number of books (the key space). – Maarten Bodewes Oct 4 '18 at 12:48
• A interesting point here: if you can figure out part of the message, you can use that to help with the rest of the message if the same ciphertext values have been re-used. To prevent this, you'd make sure you don't use the same occurrence of each letter in the book more than once... but doing that means that you have to reveal more of the book for the same length of message, which makes it easier for them to figure out which book it is. You can partly mitigate that by not using the same book twice, but doing that, the average person might quickly run out of books they have easy access to... – anaximander Oct 15 '18 at 15:06

What you are proposing is just a homophonic substitution cipher and it is highly insecure for modern standards.

It doesn't satisfy common security definitions, such as "security against chosen plaintext attack". It is not semantic secure in the sense that an attacker can easily construct two different messages whose corresponding ciphertexts are guessable.

For instance, the letter Z is not frequently used, so how many times does Z appear in a usual book?

Thus, the message

"When I got there, he was like ZZZZZZZZZZZZZZZZZZZZZZZZZZ sleeping hard"

is much more likely to have repeated digits in its ciphertext than

"When I got there, he was reading an old book about computer science and art."

But even if you stick with weaker security definitions, like just requiring that someone having access to "some" ciphertexts is not able to recover the plaintext, it is still not very secure, because one can use all sort of frequency analysis against it. For instance, which are the most common 3-letter words? Maybe "the", "one", "are"... So we could try to replace them in the ciphertexts and see if it works. If some of them works, then we have already discovered some information about the plaintext and the key...

• While you are technically correct about the known-plaintext attack, the thing with a book cipher is that you're probably not going to find software using it to encrypt things. It's generally a manual process carried out by the person who knows which book is the key, and that person is unlikely to obligingly encrypt a few plaintexts chose by the attacker - and if the attacker has access to that person, then a rubber-hose attack is often far more effective. – anaximander Oct 2 '18 at 13:31
• But we don't need a software to test semantic security. Anyone can pick some book, choose two messages and test it (: I didn't mean that he would be forced to encrypt messages, I just meant that this cipher doesn't satisfy even this weak security property. – Hilder Vitor Lima Pereira Oct 2 '18 at 13:55
• My point was more that there's a difference between a theoretical weakness and a weakness one can use to attack a real-world implementation. Sure, I can sit and encrypt a few messages of my own to demonstrate the effects of a known-plaintext attack, but if I have someone else's book-ciphered message that I've intercepted, knowing that the technique has a known-plaintext vulnerability isn't going to help me work out what this message says. – anaximander Oct 2 '18 at 14:01
• I don't see it as a difference between the theory and the practice. The theory here is saying that if somehow an attacker can inject plaintext to be encrypted (and there are several non-obvious way of doing so), then the cipher is much more likely to be broken. Now, if the user thinks this model of attack doesn't correspond to her/his situation, well, far enough, then she/he can be less exigent with the security properties and stick with weaker ciphers. – Hilder Vitor Lima Pereira Oct 2 '18 at 14:17

If I am to believe the estimate given at http://mentalfloss.com/article/85305/how-many-books-have-ever-been-published , a book makes for a roughly 27-bit key. That does not sound very secure.

• And Google has many of them digitized already, so it's a fair bet that intelligence and other resourceful attackers may also have. – hmakholm left over Monica Oct 2 '18 at 18:08

Personally I consider this to be secure provided it is only used for one short message, getting less sesure each time you use it. Other people have explained why it is not secure when used for many messages.

As a system for a one off "emergency message" it has a lot going for it, as no equipment is needed, and a book that is easy to access can be preagreed. To make it a little more secure add a preagreed offset to the "index"

(It can be thought as a "one time pad" without the risk of someone finding the pad with you, or the issue with having to access the pad.)

• But here the key is very biased, while in one-time pad it is supposed to be indistinguishable from a uniformly random bit string. For instance, if a letter "B" appears at position 113 in the book, what is the chance that 114 will correspond to "A" (or any vowel)? And what is the probability that 114 will correspond to "B"? How many commonly used words have "BA" sequences and how many have "BB" sequences? – Hilder Vitor Lima Pereira Oct 2 '18 at 13:44
• @HilderVitorLimaPereira Given that the person encrypting the message can choose a) which book and b) any occurance of the desired character within that book, that bias can be mitigated, at least partly. If you see 114 and 115 in the ciphertext, and you know what 114 is, you can use frequency analysis to work out likely candidates for 114... but the person doing the encrypting can beat this by making sure they never choose positions that are close together. Even if you know what 114 is, frequency analysis isn't much help in determining what 437 might be. – anaximander Oct 2 '18 at 14:05
• @HilderVitorLimaPereira you need a few messages, or at least one long message to have a real chance using these method, unless the coder is not being sensible, or the message is not worded as directly as possible. (so don't use to send weather report everyday!) – Ian Ringrose Oct 3 '18 at 8:36
• Wow! This thing got a lot more attention than I thought it would 😁 – Ciarán J. Hagen Oct 3 '18 at 15:50
• So basically it's more or less secure if the book is changed from time to timd and I pay attention that the numbers used in encrypted text aren't too close together. (And don't send weather report everyday :D) – Ciarán J. Hagen Oct 3 '18 at 15:52