Communication Theory of Secrecy Systems - Network Research Lab

trial yields log 23 bits of information; thus, when there is no “diophantine
log 227 trouble”, or 3 trials are sufficient.
log 23 This method of solution is feasible only if the key space can be divided
into a small number of subsets, with a simple method of determining the
subset to which the correct key belongs. One does not need to assume a complete
key in order to apply a consistency test and determine if the assumption
is justified—an assumption on a part of the key (or as to whether the key is
in some large section of the key space) can be tested. In other words it is
possible to solve for the key bit by bit.
The possibility of this method of analysis is the crucial weakness of most
ciphering systems. For example, in simple substitution, an assumption on a
single letter can be checked against its frequency, variety of contact, doubles
or reversals, etc. In determining a single letter the key space is reduced by 1.4
decimal digits from the original 26. The same effect is seen in all the elementary
types of ciphers. In the Vigenère, the assumption of two or three letters
of the key is easily checked by deciphering at other points with this fragment
and nothing whether clear emerges. The compound Vigenère is much better
from this point of view, if we assume a fairly large number of component periods,
producing a repetition rate larger than will be intercepted. In this case
as many key letters are used in enciphering each letter as there are periods.
Although this is only a fraction of the entire key, at least a fair number of
letters must be assumed before a consistency check can be applied.
Our first conclusion then, regarding practical small key cipher design, is
that a considerable amount of key should be used in enciphering each small
element of the message.
23 STATISTICAL METHODS
It is possible to solve many kinds of ciphers by statistical analysis. Consider
again simple substitution. The first thing a cryptanalyst does with an intercepted
cryptogram is to make a frequency count. If the cryptogram contains,
say, 200 letters it is safe to assume that few, if any, of the letters are out of
their frequency groups, this being a division into 4 sets of well defined frequency
limits. The logarithm of the number of keys within this limitation
may be calculated as
log 2!9!9!6! = 14.28
and the simple frequency count thus reduces the key uncertainty by 12 decimal
digits, a tremendous gain.
In general, a statistical attack proceeds as follows: A certain statistic is
measured on the intercepted cryptogram E. This statistic is such that for all
reasonable message M it assumes about the same value, SK, the value depending
only on the particular key K that was used. The value thus obtained
707