# How would anyone ever break even this basic, amateurish cipher/encryption scheme?

This question was prompted by a long Wikipedia session with me reading tons of articles on cryptography, causing far more questions than it answered.

Let's say that I and another person know each other. We plan to do something important and dangerous. We need to send messages back and forth long-distance. We conclude that all purchasable hardware and software is compromised, and therefore devise our own scheme:

1. I pull out the network cable from my computer, randomly generate a huge table numbered like 1, 2, 3, 4, 5... both horizontally and vertically, filled with random alphabetic letters, fitting on a standard A4 paper.
2. I print out two copies of this table.
3. I destroy the computer.
4. I keep one copy myself and give the other copy to the other person, who is sitting with me.
5. I tell him that, in order to send a message to me, or decrypt messages from me, he is to find any letter in the table corresponding to the character he needs to type in English, for example "A", and check which number column and row it exists in. For example, it may be in the 3rd column on the 16th row. That means he is supposed to type "3" followed by a randomly picked letter followed by "16" on the blank paper, followed by another random letter. He is then to continue like this until he has a message such as:

1A56B8L13X8C32E9L210D...

First of all, how would anyone ever be able to tell that the letters are all nonsensical and not used for anything other than separating the numbers? And even if they did, what do the numbers mean? They have no way of knowing this unless they have a copy of our sheet which only exists in two copies in the world and was generated by an offline computer which is now physically destroyed.

And we wouldn't be using the same column+row value each time for each letter, as they are found many times around the table.

And, what if to further complicate everything, we decide to write the messages in reverse? Or to do every other look-up in reverse, so that the columns and rows are swapped every other character? With just a few simple rules like that, it seems like they could never, ever decrypt our messages, even with the most powerful computers in the world.

I probably am making a fool out of myself here, but I seriously don't understand how anyone, no matter how smart, given unlimited time, could ever break this cipher/encryption scheme which I just came up with quickly without having any expertise in the field. I clearly must be missing something.

• I'm not going to repeat all the relevant information in the answers, but if it was a one time use it would be harder to crack, intelligence agencies have supposedly used a similar approach with number stations - en.m.wikipedia.org/wiki/Numbers_station – wireghoul Feb 17 '20 at 5:49
• I would recommend David Khan's book Codebreakers, it discusses many historical schemes such as this one, and how they were broken. It's also a good read (if you're into this sort of thing)😉 – Geir Emblemsvag Feb 17 '20 at 7:42

First of all, how would anyone ever be able to tell that the letters are all nonsensical and not used for anything other than separating the numbers?

It requires an intuitive leap. The cryptographer, reviewing the data for patterns, will note that there are certain numeric tuples that repeat regardless of the alphabetic character. Once they break the frequency counts out to consider the numeric tuples separately from the characters, it becomes intuitively obvious that the characters are filler.

Additionally, if the coder is 'randomly' selecting the character to insert, it won't be random. You'd need a computer to pick characters with anything regarding true randomness, and you already destroyed your computer in step 3.

And even if they did, what do the numbers mean?

Again, frequency counts. How often does each numeric tuple repeat? Make a graph. What language is most likely being encoded? English? Okay, then assume the most common tuple is an 't'. Second most common is an 'o'. Decrypt as if those are true and see if any textual patterns arise. Not getting patterns? Shake them up and try 'o' first and 't' second, is that any better? Repeat the process until the cleartext shakes out.

They have no way of knowing this unless they have a copy of our sheet which only exists in two copies in the world and was generated by an offline computer which is now physically destroyed.

No, it can be inferred from the cipher text. Your system is essentially a monoalphabetic cipher, one of the easiest to crack.

And, what if to further complicate everything, we decide to write the messages in reverse? Or to do every other look-up in reverse, so that the columns and rows are swapped every other character? With just a few simple rules like that, it seems like they could never, ever decrypt our messages, even with the most powerful computers in the world.

You're still describing a substitution cipher, which are demonstrably fallible. You might try to read about the career of Elizebeth Friedman, who broke codes like that used by organized crime and the Germans in the 30s and 40s.

I probably am making a fool out of myself here, but I seriously don't understand how anyone, no matter how smart, given unlimited time, could ever break this cipher/encryption scheme which I just came up with quickly without having any expertise in the field.

That is such a common problem we have a rule describing it; Schneier's Law:

"Anyone, from the most clueless amateur to the best cryptographer, can create an algorithm that he himself can't break."

I clearly must be missing something.

Yes, you are. It's at least good that you realize that. Your cipher is vulnerable in a lot of different ways. Here's a few:

I pull out the network cable from my computer, randomly generate

Your computer could have had its RNG compromised while it was still online, so even if it stays offline forever, the attacker still knows its random state.

how would anyone ever be able to tell that the letters are all nonsensical and not used for anything other than separating the numbers?

You've reinvented nulls. Those are common in cryptography and aren't that difficult to defeat.

To break this cipher with a ciphertext-only attack, an attacker would just have to wait until you've sent a few pages with it, then do frequency analysis on each set of 3 numbers.

And we wouldn't be using the same column+row value each time for each letter, as they are found many times around the table.

Doesn't matter. Frequency analysis still works; it just takes a little bit more text.

And, what if to further complicate everything, we decide to write the messages in reverse? Or to do every other look-up in reverse, so that the columns and rows are swapped every other character? With just a few simple rules like that, it seems like they could never, ever decrypt our messages, even with the most powerful computers in the world.

This is wrong for similar reasons.

Further, it would be even easier to break with a known-plaintext or chosen-plaintext attack, and it instantly trivially collapses with a chosen-ciphertext attack, all of which good ciphers are resistant to. (I'm intentionally not providing details about this. You're not even close to being qualified to design ciphers as long as how you'd break this cipher with these isn't immediately obvious to you.)

• This is essentially how the Enigma machine, used during World War II, was cracked, by Alan Turing. – mti2935 Feb 17 '20 at 2:22

First of all, how would anyone ever be able to tell that the letters are all nonsensical and not used for anything other than separating the numbers?

You are starting with the assumption that the algorithms itself and not only the key will be secret. If you communicate only with a single person this might work for some time. But since just adding irrelevant noise to the data is not a new thing someone will likely just try to treat these characters as some kind of noise.

And we wouldn't be using the same column+row value each time for each letter, as they are found many times around the table.

Still, you are reusing the same translation table for several messages and the more you send the more translations will repeat. This opens it up for statistical analysis, i.e. some characters are more common than others. Additionally one could try to match letter-combinations or full words on the text since some combinations and words are more likely than others too etc. In today's times with fast computers this is not that hard and quite fast.

... we decide to write the messages in reverse? Or to do every other look-up in reverse, so that the columns and rows are swapped every other character?

You are again assuming that the enemy is dumber than you and will not have these kind of ideas and try it.

I clearly must be missing something.

This is also called Dunning-Kruger Effect. It is pretty common that one overestimates one's own knowledge when starting with a new topic like cryptography. And this leads to the assumption that if one cannot find a security problem oneself that there will be none. But once you learn much more about it you will understand why it is not recommended for most to design their own crypto. It is not uncommon even for experts to fail in this area.