How to attack a classical cipher using known partial plaintext?

Question

I have a ciphertext generated by a classical cipher. I do not know what was cipher used to generate it. I do however have the beginning of the plaintext.

• What are the cryptanalysis approaches for classical ciphers?
• How do you suggest trying to recover the plaintext in this instance?
• How can I leverage the known plaintext to attack the cipher?

I have this ciphertext:

NUVRRIEZWBRVRFFAPUUKFVRYNQBCINHZKNETUVDVUMRTEANPAFIELBPOANIXLCMEZQETKDKVWBMNCTRVUMRFNTFDGWRUMCSCTHSGKDULRFCNABNCGSNMMGRFNTLOWQRBETZRMUBQYURFRFASANGPEQRFFAFCZACAZCTUBTHKUNEZHPPWSGPNABHZKZQNREANLCHUCZDLMLPUNTMNETDAUINQADUNSUMGETETHFBNMNNONTFBBPOQEMZPETEQUIDTHKNABKDZWBDBRZUSRASUMNIRARETETHFBZKRHPNQFAKRICMGETMULCTCULSLGBIVWBDBIEMUFCUVNUGPINFBQTMPNUMSRNNANTNANCMNNTFUMUKRILRFFAPUUKFVRYNTCMETNUVFWDABBRFNRIEFRFNTHGPUHPNKCILEGBUTWUSCPQSLMNIBWQINFBQTFAVRLCKRHKLZNFAZLSNTBDBEASTD

It begins with the partial plaintext:

it turns out that

Answer 1

I do not have a solution, but I pursued the cipher long enough to establish it wasn't one of the easy classical ciphers. This approach should get you started.

The first thing you want to do is convert the text into numbers as many classic ciphers are mathematically-based (or at least easy represented mathematically). Using $A=0$, $B=1$, $\ldots$, the ciphertext is:

{13,20,21,17,17,8,4,25,22,1,17,21,17,5,5,0,15,20,20,10,5,21,17,24,13,16,1,2,8,13,7,
 25,10,13,4,19,20,21,3,21,20,12,17,19,4,0,13,15,0,5,8,4,11,1,15,14,0,13,8,23,11,2,
 12,4,25,16,4,19,10,3,10,21,22,1,12,13,2,19,17,21,20,12,17,5,13,19,5,3,6,22,17,20,
 12,2,18,2,19,7,18,6,10,3,20,11,17,5,2,13,0,1,13,2,6,18,13,12,12,6,17,5,13,19,11,14,
 22,16,17,1,4,19,25,17,12,20,1,16,24,20,17,5,17,5,0,18,0,13,6,15,4,16,17,5,5,0,5,2,
 25,0,2,0,25,2,19,20,1,19,7,10,20,13,4,25,7,15,15,22,18,6,15,13,0,1,7,25,10,25,16,
 13,17,4,0,13,11,2,7,20,2,25,3,11,12,11,15,20,13,19,12,13,4,19,3,0,20,8,13,16,0,3,
 20,13,18,20,12,6,4,19,4,19,7,5,1,13,12,13,13,14,13,19,5,1,1,15,14,16,4,12,25,15,4,
 19,4,16,20,8,3,19,7,10,13,0,1,10,3,25,22,1,3,1,17,25,20,18,17,0,18,20,12,13,8,17,
 0,17,4,19,4,19,7,5,1,25,10,17,7,15,13,16,5,0,10,17,8,2,12,6,4,19,12,20,11,2,19,2,
 20,11,18,11,6,1,8,21,22,1,3,1,8,4,12,20,5,2,20,21,13,20,6,15,8,13,5,1,16,19,12,15,
 13,20,12,18,17,13,13,0,13,19,13,0,13,2,12,13,13,19,5,20,12,20,10,17,8,11,17,5,5,0,
 15,20,20,10,5,21,17,24,13,19,2,12,4,19,13,20,21,5,22,3,0,1,1,17,5,13,17,8,4,5,17,5,
 13,19,7,6,15,20,7,15,13,10,2,8,11,4,6,1,20,19,22,20,18,2,15,16,18,11,12,13,8,1,22,
 16,8,13,5,1,16,19,5,0,21,17,11,2,10,17,7,10,11,25,13,5,0,25,11,18,13,19,1,3,1,4,0,
 18,19,3}

The plaintext (assuming spaces are eliminated, you can rerun the process with spaces included as an additional character) is:

{8,19,19,20,17,13,18,14,20,19,19,7,0,19}

If $p_i$ be the $i^\mathrm{th}$ plaintext character (an integer between 0 and 25) and likewise $c_i$. Many classic ciphers map plaintext characters to ciphertext characters one-to-one. In other words, the value of $c_i$ depends only on $p_i$ and some key character $k_i$. First consider an encryption scheme like: $c_i=p_i + k_i \mod 26$. Since we know $p_i$ for the first few values, we can compute what $k_i$ would be:

{5,1,2,23,0,21,12,11,2,8,24,14,17,12}

Putting this into a chart, where the first row is the plaintext, the second row is the key, and the third row is the ciphertext, we can start an analysis.

$\begin{array}{llllllllllllll} 8 & 19 & 19 & 20 & 17 & 13 & 18 & 14 & 20 & 19 & 19 & 7 & 0 & 19 \\ 5 & 1 & 2 & 23 & 0 & 21 & 12 & 11 & 2 & 8 & 24 & 14 & 17 & 12 \\ 13 & 20 & 21 & 17 & 17 & 8 & 4 & 25 & 22 & 1 & 17 & 21 & 17 & 5 \end{array}$

The key is not the same value, ruling out a Ceaser cipher. The key as characters is not English (FBCXAVMLCIYORM), it does not appear to repeat, and applying the same key to the next block of ciphertext decrypts to garbage (AZNXUPTKPQPCKQ). For these reasons, it is unlikely a Vigenere cipher. The same $p_i$ is not always mapped to the same $c_i$ value (for example, 19 is mapped to 20, 21, 1, 17, 5), so it is not a simple substitution cipher. Finally, if you sort the plaintext values and ciphertext values, they are not similar sets of integers so it is unlikely a permutation cipher.

I also did a frequency analysis of the ciphertext:

It tells us two things: it resembles English text and there is no j. If you are familiar with the classical ciphers, there is one in particular that conflates i and j: the Playfair cipher.

This should be enough to get you started.

Answer 2

As the other poster rightly pointed out, it's a Playfair cipher. Even without the known plaintext, the program "playn" here will give the right text in less than a second. (you can compile it yourself, and it uses the bigram statistics of English)

I ran it, and the result was the following:

IT XT UR NS OU TX TH AT OR IG AM IX IS AB RI LX 
LI AN TW AY TO UN DE RS TA ND GE OM ET RY HE SA 
YS AN DI FY OU ST AR TX TO TH IN KA BO UT PA PE 
RF OL DI NG TH ER EA RE LO TS OF TH IN GS YO UC 
AN XN OT DO WI TH TH EM ET HO DS TH AT HA VE BE 
XE NT AU GH TI NS CH OX OL SR EA LX LY SI NC ET 
HE GR EX EK SF OR IN ST AN CE TR IS EC TI ON OF 
AN AN GL EU ST US IN GA CO MP AS XS AN DS TR AI 
GH TE DG EY OU CA NX NO TC ON ST RU CT AN AN GL 
EW HI CH IS AT HI RD OF AN OT HE RA NG LE BU TY 
OU CA ND OT HA TW IT HO RI GA MI SO IT SQ UI TE 
IN TE RE ST IN GT OT HI NK TH AT OR IG AM IX IN 
AP AN IT MA YB EA CU LT UR AL TH IN GF OR CH IL 
DR EN BU TN OW PE OP LE ST UD YO RI GA MI AT XT 
HE HI GH ES TL EV EL IN AC AD EM IA 
score: 11.557203
keysquare: XYZVWRINTUCDEABHKLFGPQSMO

The plaintext contains an added X between each two consecutive identical letters. These were added before encryption (to avoid any digraphs consisting of identical letters), and should be removed after decryption. (A variant would add these Xes only when the identical letters would otherwise fall on the same digraph.)

So the square (one of the equivalent ones, at least) looks like

TURIN
ABCDE
FGHKL
MOPQS
VWXYZ

So it's based on a short keyword that has TURIN as the unique letters in order. This square would have been relatively easy to find from the plain text, if you would have known or guessed the fact that X is used between all pairs of identical letters; A strong hint for Playfair is that when you write out the correspondences for the known plaintext (with extra Xs):

 IT XT UR NS OU TX TH AT
 NU VR RI EZ WB RV RF FA

we have that XT corresponds to VR, TX to RV: a classic symptom of Playfair encipherment. Also nice is the fact that RF (plain TH) is the most frequent bigram. In general, bigram statistics would have revealed (a type of) Playfair in this way (no double letters, non-flat frequencies).

Answer 3

There are diagnostic programs that will tell you the cipher type from a statistical analysis. For example: http://bionsgadgets.appspot.com/gadget_forms/refscore.html tells you immediately that this cipher is a Playfair.