THE CIPHER CODEX
An interactive compendium of classical cryptography puzzles. Study the art of concealment — and the science of revelation.
SUBSTITUTION CIPHERS
Each letter or symbol is replaced by another according to a fixed rule or key.
Julius Caesar's cipher shifts each letter of the alphabet by a fixed number of positions. ROT13 (shift 13) is its most famous modern variant — applying it twice returns the original text.
A full alphabet substitution where every letter maps to a unique other letter. Cryptoquotes use famous quotations as the plaintext — your task is to decode the encrypted message.
An ancient Hebrew cipher: the alphabet is reversed. A maps to Z, B to Y, C to X, and so on. Applying it twice recovers the original — it is its own inverse key.
Each letter is represented by the shape of the grid section that surrounds it. Letters in the second grid add a dot to distinguish them from the first set. Used by Freemasons and in treasure hunt puzzles.
Francis Bacon's method assigns each letter a 5-bit binary code using only A and B. Often used for steganography — hiding a secret message inside an innocuous text by using two different typefaces.
Encrypts pairs of letters (digraphs) using a 5×5 grid built from a keyword. I and J share a cell. Three rules govern encryption: same row → shift right; same column → shift down; otherwise → swap corners of the rectangle formed.
TRANSPOSITION CIPHERS
Letters remain the same — only their positions are rearranged.
Letters are written in a zigzag across a number of "rails," then read off row by row. With 2 rails, odd-position letters go on rail 1, even-position letters on rail 2.
The message is written in rows into a grid. Columns are then read out in the alphabetical order of the keyword letters. Padding characters fill incomplete rows.
SPECIALIZED ENCODINGS
Non-alphabetic systems for encoding information.
Samuel Morse's telegraph encoding uses combinations of short (dot ·) and long (dash —) signals. International Morse Code was standardized in 1865 and is still used in aviation and amateur radio.
Every character in ASCII has a 7-bit (or 8-bit) binary representation. 'A' is 65 decimal = 01000001 binary. The entire internet runs on this encoding.
SOLVING TECHNIQUES
Methods for breaking unknown ciphers through statistical analysis.
In English, letters appear with predictable frequency. By comparing the frequency distribution of ciphertext letters to known English frequencies, you can map the most likely substitutions. E, T, A, O, I, N, S, H, R are the most common.
Pattern recognition is the codebreaker's first weapon. Single-letter words must be A or I. Three-letter words ending in E are likely THE. Double letters narrow possibilities dramatically.
CRYPTOGRAPHIC ATTACKS
Methods adversaries use to break, bypass, or undermine cryptographic systems.
Systematically tries every possible key, password, or passphrase until the correct one is found. Guaranteed to succeed — time is the only limit. A 4-digit PIN has 10,000 combinations; a 128-bit key has 340 undecillion.
Rather than trying every combination, a dictionary attack uses a precompiled wordlist of common passwords, dictionary words, and known breached credentials. Rockyou.txt alone contains 14 million entries.
The attacker secretly relays and potentially alters communications between two parties who believe they are talking directly. Common vectors: ARP poisoning on LANs, rogue Wi-Fi hotspots, SSL stripping.
Exploits information leaked from the physical implementation rather than the algorithm itself — execution timing, power draw, electromagnetic emissions, or even acoustic vibrations from CPU fans can reveal key bits.
The attacker possesses one or more plaintext/ciphertext pairs encrypted with the same unknown key. By comparing the two, they can deduce the key. This broke Enigma — the Allies knew common phrases like "KEINE BESONDEREN EREIGNISSE" (nothing to report).
Named after the birthday paradox: in a group of 23 people, there's a 50% chance two share a birthday. Similarly, a hash function with N possible outputs only needs ~√N attempts to find two inputs with the same output (collision). MD5's 128-bit space requires only ~2^64 attempts.
Forces a system to abandon a secure protocol in favor of an older, vulnerable one. POODLE (2014) forced TLS connections to fall back to SSL 3.0. FREAK forced 512-bit "export grade" RSA. The attacker then exploits the weaker protocol.
A valid authenticated transmission is captured and retransmitted to fool the receiver. Even if encrypted, the attacker doesn't need to decrypt — they simply replay the valid token. Classic attack against Kerberos without timestamps.
Shor's algorithm (1994) can factor large integers in polynomial time on a quantum computer, breaking RSA and ECC. Grover's algorithm provides a quadratic speedup for symmetric key search, halving effective key strength.