# Is Caesar cipher perfectly secret?

The only time a shift cipher considers to be perfectly secure is when used on a single letter of plaintext and no more. Having that in mind, we can say it is certainly not perfectly secure.

Caesar cipher is perfectly secret only in the special case with the assumption that 26 keys are used in equal probability. Suppose that we have a plaintext of 50 characters long if each key for each character is chosen equiprobably then you end with 26^50 possible keys.

That is my answer, is it correct?

• Yes, you are describing the en.wikipedia.org/wiki/Vigen%C3%A8re_cipher – Nayuki Nov 15 '20 at 14:38
• More specifically, if you use the same shift for every character, it's a Caesar Cipher. if you use a series of shifts (of a shorter length than the message), and repeat after you reach the end, it's a Vigenère Cipher. If you have an infinite series of shifts (or enough that you never reuse an entry (across all messages)), it's a one time pad. – Ray Nov 15 '20 at 15:42
• I was confused what "26 keys" meant. I think you meant "26 possible values for each key character". – Buge Nov 16 '20 at 8:52
• It's worth noting I think with the one time pad that you have 26^50 possible keys, but it is impossible to brute force with any theoretical technology. Without the actual keys, the letters could be anything. 'AIPXKAMZIQNO' could be 'ATTACKATDAWN', but it could just as easily be 'ATTACKATNOON' or 'SURRENDERNOW' – Jason Goemaat Nov 17 '20 at 5:58

Yes, because instead of a Caesar cipher you now have a One-time pad. In particular, it meets the requirements of a key that is random and as long as the message. So as long as the key is kept secret and never used for another message, you have OTP security.

1. What you described it not a Caesar cipher. A Caesar cipher is a cipher where all letters are shifted by the same number of positions. In the question text you are describing a shift cipher. This is the right wording.

2. What you described is an OTP. I agree with Eugene Styer's answer. If the letters for the key are taken from the same set (26 letters), and the generator is uniformly random, then you get an OTP.

And don't agree with kelalaka's answer that the key should be defined on the bits. If you don't respect the number of letters in the set and take 5 bits = 32 key values, then the letters of the original message will be moved not uniformly. $$(P + K) \mod 26$$ will produce not uniform output, because the probability that (P + K) mod 26 = P (or P+1 ... P+5) is twice the probability of P+6 ... P+25. When we consider any letter X in the encrypted message, then the probability that the original letter is one of {X-5, X-4, X-3, X-2, X-1, X} is 2/32, and the probability for other letters is 1/32.

Thus, if you implement it on bits, as kelalaka suggests, it will not be an OTP. If the letters for the key are taken from the same set, i.e. 26 letters (or 26 consecutive numbers), this is exactly what you described, then it will be an OTP.

• My point on the during the transformation. OTP leaks no information but sending an alphabet of size 26 does. Instead one should hide the encoding, too. – kelalaka Nov 14 '20 at 23:00
• @kelalaka: According to the Kerckhoffs's we should assume that the attacker knows well that the original message is a plain text consisting of letters from the 26-letter set. Thus this information is not a leakage. – mentallurg Nov 15 '20 at 1:36