Some ciphers are talked about at “Is there a secure cryptosystem that can be performed mentally?”, but (at the time of writing) I don't see an answer.

Are they strong enough, or are non-computer ciphers more or less just a toy and one should abandon using them for practical purposes?

  • $\begingroup$ So basically you want to know how strong RC4 or Solitaire is? $\endgroup$
    – rath
    Commented May 4, 2013 at 22:24
  • $\begingroup$ None of them are both strong enough and practical enough to be reasonable to carry out in real life. The strong ones aren't really practical; the practical ones aren't very strong. $\endgroup$
    – D.W.
    Commented May 5, 2013 at 3:13
  • 1
    $\begingroup$ The only serious cypher you can do with pen and paper is One Time Pad - en.wikipedia.org/wiki/One-time_pad $\endgroup$ Commented May 5, 2013 at 3:57
  • 2
    $\begingroup$ I wonder how long it would take to do AES-256 with pen and paper? :-) $\endgroup$ Commented May 5, 2013 at 12:41
  • 1
    $\begingroup$ I think that the suggestion to use RC4-52 in this answer can be made reasonably secure, and practicable with a deck of card by a trained operator. Devil is in the details, in particular the key and nounce/salt setup. I add that much less than 52 symbols should be used for plain and ciphertext, and keystream outside that range should be discarded (I conjecture it strengthen the keystream generator significantly). $\endgroup$
    – fgrieu
    Commented May 6, 2013 at 10:54

3 Answers 3


"Strong enough" is a broad term. Some things that you need to keep in mind are entropy size and cryptanalysis. "Strong ciphers" are ciphers that have shown to have enough entropy to withstand practical attacks over time from public scrutiny.

With that said, the Solitaire cipher has a keyspace of roughly 238 bits. By comparison, many SSL keys on the internet are 128 bit AES. Distributed.net is currently working on cracking a 72 bit key, via brute force, at a pace of about 300 billion keys per second, and they have well over 100 years before the keyspace is fully exhausted.

So, for the Solitaire cipher to not be taken seriously, it needs to show practical weaknesses outside of brute force searching. So far, the only weakness that has been demonstrated is that the output has a bias of 22.5:1 rather than 26:1 pure random output would have. This isn't severe enough to mount a practical attack.

As such, until other attacks are made known, to Solitaire cipher is a "strong" hand cipher, that doesn't have NSA influence, can be used without incriminating tools and is easy to learn and remember.


You can implement a linear feedback shift register using nothing but a series of coins. Define 1 to be heads, 0 for tails. Line them up in to a series 128 coins in length. Then follow the algorithm exactly as you would on a computer.

From this basic generator, you can construct a self-shrunk generator. Self-shrinking generators have somewhat suspect security. You'd probably be fine for a pencil and paper scheme because you can't generate enough ciphertext to run many of the attacks.

The problems are that it is very laborious to encrypt even a small message. Worse, a mistake anywhere in the process will probably completely destroy the security of the scheme.

I have to agree with @D.W. here. This is probably among the better suggestions for a pencil and paper cipher and yet it still poor.

Secure cryptography just requires too much (tedious!) work to be reliably done by hand.


One Time Pad. It has some serious drawbacks of practicality, but most of these are only really drawbacks in a modern digital world. If your use case is short handwritten messages between two people, the drawbacks are likely not a concern.

It's also unbreakable if done correctly, and straightforward to implement with pen and paper.

  • $\begingroup$ Alright, I suppose we can include an OTP, but then you'd have to also write down the major drawback of the cipher. Just saying "short messages" is understating the issue if you ask me. I mean, for a very strong (almost impossible to remember) key of 128 bits you can get about 18 characters in ASCII or 25 characters for a 32-character sized alphabet. So basically you need a codebook. $\endgroup$
    – Maarten Bodewes
    Commented Jan 17, 2023 at 0:58
  • 1
    $\begingroup$ @MaartenBodewes There is a pen & paper tag for this question. So writing down is within scope. As it has been for the last 100 years that people have used OTPs :-) $\endgroup$
    – Paul Uszak
    Commented Jan 17, 2023 at 3:44
  • $\begingroup$ touché, I guess I assumed more or less that the algorithm was pen and paper rather than the key. $\endgroup$
    – Maarten Bodewes
    Commented Jan 17, 2023 at 8:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.