Symmetric Cipher Model

A message leaves your device, crosses networks you don't control, and lands somewhere you can't watch. Anyone sitting between the two endpoints can read it unless something scrambles it first, and that something needs to be reversible only by the people who hold the right secret.

Symmetric encryption is a scheme where the same secret key both locks and unlocks the message. Five things have to exist for it to work at all: the plaintext, an encryption algorithm, a secret key, the resulting ciphertext, and a decryption algorithm.

The Five Ingredients

Plaintext: the original readable message, fed into the algorithm as input.
Encryption algorithm: performs substitutions and transformations on the plaintext, using the key to decide exactly how.
Secret key: an independent value chosen from a large keyspace. The algorithm can be public; the key cannot.
Ciphertext: the scrambled output. A strong cipher produces ciphertext that looks statistically random regardless of the plaintext's structure.
Decryption algorithm: essentially the encryption algorithm run in reverse, using the same key, to recover the exact original plaintext.

[!NOTE]
"Symmetric" refers only to the key, not the algorithm. Encryption and decryption can be different procedures; they just both depend on one shared secret.

Select a block below to see what it does, or press play to let it step through on its own.

Two properties decide whether an algorithm is even worth analyzing further: how many keys it's vulnerable to being tried against, and how the data gets processed once a key is chosen.

Type of operations: substitution replaces elements, transposition rearranges them. Every classical cipher in this chapter is one, the other, or a mix of both.
Number of keys used: one key means symmetric, two related keys mean asymmetric. This chapter is entirely symmetric territory.
Way the plaintext is processed: block ciphers work on fixed-size chunks; stream ciphers work one symbol at a time. Classical ciphers are almost all stream-style, working letter by letter.

---

Cryptanalysis and Attacks

Someone intercepts a stream of scrambled text with no key and no context. They still have moves: count letter frequencies, guess likely words, look for repeated patterns. That's cryptanalysis before it has a name.

Cryptanalysis is the study of recovering plaintext or key from ciphertext without prior knowledge of the key, exploiting weaknesses in the algorithm, the key, or the way both were used. The alternative to cryptanalysis is brute-force attack, which tries every possible key until one produces sensible plaintext, no cleverness involved.

What Makes Cryptanalysis Possible

Language redundancy: English text isn't random. 'E' shows up constantly, 'Q' is almost always followed by 'U', certain digraphs and trigraphs recur. Any cipher that preserves this structure leaks it to an attacker.
Known structure: headers, greetings, sign-offs, and formatting conventions in real messages give the attacker predictable starting points.
Small keyspace: the Caesar cipher has exactly 25 usable keys. That's not a keyspace, it's a checklist.

Classes of Attack

Every cryptanalytic attack is defined by what the attacker already has access to before they start. More access means a faster break.

[!TIP]
An algorithm is considered computationally secure, not mathematically unbreakable, when the cost of breaking it exceeds the value of the information or outlives its useful lifetime. Classical ciphers fail this test almost immediately; that's why this whole chapter is a history lesson as much as a security one.

---

Caesar Cipher

Shift every letter in "ATTACK" forward by three positions and it stops being readable to anyone who doesn't know the shift. Shift it back by three and it's readable again. That's the entire cipher.

The Caesar cipher is a substitution cipher where each letter of the plaintext is replaced by a letter a fixed number of positions further down the alphabet, wrapping around from Z back to A.

The Formula

$ E(p) = (p + k) \bmod 26 \qquad D(c) = (c - k) \bmod 26 $

Here $p$ and $c$ are numeric positions (A=0 ... Z=25) and $k$ is the shift, the one secret both sides need to agree on in advance.

Drag the slider or press play to watch the shifted alphabet slide against the fixed reference row underneath it.

A working shift can be coded in a handful of lines.

public static String caesarEncrypt(String plaintext, int shift) {
    StringBuilder result = new StringBuilder();
    for (char ch : plaintext.toUpperCase().toCharArray()) {
        if (Character.isLetter(ch)) {
            int shifted = (ch - 'A' + shift) % 26;
            result.append((char) ('A' + shifted));
        } else {
            result.append(ch);
        }
    }
    return result.toString();
}

Only 25 possible shifts exist, so the entire keyspace fits on one hand of fingers with room to spare.

[!WARNING]
A brute-force attack on Caesar takes at most 25 tries and can be automated in milliseconds. It's the textbook example of why keyspace size matters more than an algorithm's cleverness.

---

Monoalphabetic Cipher

Caesar's weakness isn't the substitution idea, it's the shift. What if instead of shifting the alphabet, you scramble it completely, so there's no arithmetic pattern to search for at all?

A monoalphabetic substitution cipher replaces each plaintext letter with a fixed, arbitrarily chosen ciphertext letter, using a full one-to-one mapping instead of a numeric shift. The mapping stays constant throughout the message, that's the "mono" in the name.

Why the Bigger Keyspace Doesn't Save It

A random 26-letter mapping has $26! \approx 4 \times 10^{26}$ possible keys, which makes brute force hopeless. Frequency analysis breaks it anyway.

The flaw: every occurrence of plaintext 'E' becomes the same ciphertext letter every time. English 'E' shows up around 12% of the time in ordinary text; whichever ciphertext letter shows up most often is very likely the substitute for 'E'. The rest falls out through educated guessing on common digraphs like 'TH' and 'HE'.

Shuffle the key, type your own 26-letter permutation directly into the key field, or hide it to quiz yourself on the mapping table below.

Aspect	Caesar Cipher	Monoalphabetic Cipher
Key	Single number (0-25)	Full 26-letter permutation
Keyspace	25	~4 × 10²⁶
Broken by	Brute force in seconds	Frequency analysis in minutes
Pattern leaked	Fixed shift	Fixed 1-to-1 letter mapping

---

Playfair Cipher

Frequency analysis works because single letters map to single letters. Break that assumption, encrypt two letters at a time instead of one, and the whole attack stops applying cleanly.

The Playfair cipher encrypts pairs of letters (digraphs) rather than single letters, using a 5×5 grid built from a keyword. It was the first practical digraph substitution cipher and stayed in military use well into the 20th century.

Building the Grid

Write the keyword into the grid first, dropping repeated letters, then fill the remaining cells with the rest of the alphabet in order. I and J share one cell since 25 letters fit a 5×5 grid but 26 don't.

The Three Encryption Rules

Same row: replace each letter with the one immediately to its right, wrapping to the start of the row.
Same column: replace each letter with the one immediately below it, wrapping to the top of the column.
Rectangle: replace each letter with the one in its own row but the other letter's column.

Before applying any rule, split the plaintext into digraphs. A repeated letter inside a pair gets an 'X' inserted between them, and an odd letter left over at the end also gets padded with 'X'.

Type a keyword and a message below to build the grid live and see exactly which rule fired for each digraph. Hide the keyword to test yourself on the grid layout.

[!NOTE]
Playfair still falls to frequency analysis, just at the digraph level instead of the single-letter level. It needs a lot more ciphertext before the statistics become reliable, which is exactly why it stayed useful for so long.

---

Hill Cipher

Playfair breaks single-letter frequency analysis by working on pairs, but it's still just table lookups. Hill cipher replaces the lookup table with actual linear algebra, turning encryption into matrix multiplication over a finite field.

The Hill cipher encrypts blocks of $n$ letters at once by multiplying a plaintext vector by an $n \times n$ key matrix, with all arithmetic done modulo 26.

The Mechanics

$ C = K \cdot P \bmod 26 \qquad P = K^{-1} \cdot C \bmod 26 $

$K$ must be invertible modulo 26, which means $\gcd(\det(K), 26) = 1$. Pick a key matrix without checking this and decryption becomes mathematically impossible, not just inconvenient.

Finding the Inverse

1. Compute $\det(K) \bmod 26$.
2. Compute the modular inverse of that determinant, a number that multiplies back to 1 mod 26.
3. Compute the adjugate matrix (transpose of the cofactor matrix).
4. $K^{-1} = \det(K)^{-1} \cdot \text{adj}(K) \bmod 26$.

Enter your own 2×2 key and a two-letter plaintext block below. The calculator flags keys that have no valid inverse before you waste time on them, and you can hide the key matrix once you've picked one.

[!IMPORTANT]
Hill cipher is linear, and linear systems fall to known-plaintext attacks almost immediately. Give an attacker $n$ plaintext-ciphertext pairs for an $n \times n$ key and they can solve for $K$ directly using linear algebra. Its resistance is purely against frequency analysis, not against a determined attacker with samples.

---

Polyalphabetic Cipher (Vigenère)

Monoalphabetic ciphers all share one fatal habit: the same plaintext letter always becomes the same ciphertext letter. What if the substitution alphabet itself changed as you moved through the message?

A polyalphabetic cipher uses multiple substitution alphabets across a single message, cycling between them according to a repeating keyword. The Vigenère cipher is the classic example, effectively running a different Caesar shift for every letter of the keyword.

How the Shift Cycles

$ C_i = (P_i + K_{i \bmod m}) \bmod 26 $

where $m$ is the keyword length. Letter 1 of the plaintext shifts by keyword letter 1, letter 2 shifts by keyword letter 2, and once the keyword runs out it loops back to the start.

Change the keyword or the message below, press play to watch the highlight step through column by column, or hide the keyword to quiz yourself on the shifts.

public static String vigenereEncrypt(String plaintext, String key) {
    StringBuilder result = new StringBuilder();
    plaintext = plaintext.toUpperCase().replaceAll("[^A-Z]", "");
    key = key.toUpperCase();
    for (int i = 0; i < plaintext.length(); i++) {
        int p = plaintext.charAt(i) - 'A';
        int k = key.charAt(i % key.length()) - 'A';
        result.append((char) ('A' + (p + k) % 26));
    }
    return result.toString();
}

How It Finally Gets Broken

A repeating key means a repeating pattern, and repeating patterns are exactly what cryptanalysts look for.

Kasiski examination: scan the ciphertext for repeated sequences of three or more letters, note the distance between repeats, and take the GCD of those distances. That GCD is very likely the keyword length.
Index of Coincidence: once the likely key length $m$ is known, split the ciphertext into $m$ interleaved streams. Each stream was encrypted with a single, fixed shift, so it's just monoalphabetic again, and frequency analysis finishes the job stream by stream.

[!TIP]
A longer, non-repeating keyword closes this gap. Push the keyword length to match the message length exactly and something very different happens, covered next.

---

One-Time Pad

Stretch the Vigenère keyword until it's exactly as long as the message, generate it with true randomness instead of a memorable word, and use it exactly once. Do all three, and something remarkable happens: the cipher becomes provably unbreakable.

The one-time pad (OTP) encrypts a message using a truly random key that is at least as long as the plaintext and is never reused for any other message. It's the only classical cipher with a mathematical proof of perfect secrecy.

Why "Unbreakable" Isn't an Exaggeration

For any given ciphertext, every possible plaintext of the same length is equally likely to be the real one, because there exists some key that maps to it. Without the key, the ciphertext carries zero information about the plaintext. That's Claude Shannon's definition of perfect secrecy, and OTP is the only classical scheme that actually reaches it.

Truly random key: not a password, not a passphrase, not a pseudorandom generator seed. Actual entropy, the same length as the message.
Never reused: reuse turns "one-time" pad into a regular Vigenère cipher with a fixed key, and the whole security proof collapses.
Key distribution problem: the pad has to reach the receiver through some channel just as secure as the one you're trying to protect. That logistics problem is exactly why OTP is impractical for everyday use despite being theoretically perfect.

The key field below is fully editable, type your own random-looking key, generate a fresh one, or hide it entirely. Shortening the message and reusing the same key is exactly the mistake the warning below describes.

Property	Caesar / Mono	Vigenère	One-Time Pad
Key type	Fixed mapping	Repeating keyword	Truly random, message-length
Key reuse	Unlimited	Unlimited	Exactly once
Secrecy level	Weak	Weak	Perfect (mathematically proven)
Primary bottleneck	Small keyspace / frequencies	Repeating pattern	Key distribution & generation

---

Transposition Ciphers

Substitution ciphers swap letters for other letters while leaving their positions alone. Transposition ciphers do the exact opposite: keep every letter intact, but shuffle their locations according to a geometric rule.

A transposition cipher scrambles plaintext by reordering its characters without changing their identities, preserving exact single-letter frequencies while destroying digraph and word structures.

Rail Fence Cipher

Write the message in a zig-zag pattern across a fixed number of rows (rails), then read off each row left-to-right to build the ciphertext.

Adjust the number of rails or the text below to see the fence grid update live.

[!NOTE]
Transposition ciphers are easily spotted: single-letter frequency distribution matches ordinary English text identically, but common bigrams like TH, HE, IN break apart. That frequency match is the signature of transposition.

---

Steganography

Encryption hides the meaning of a message by scrambling it into unreadable noise. Steganography takes a different path: it hides the very existence of the message inside innocent-looking cover media.

Steganography is the practice of concealing a secret message within another non-secret medium (such as an image, audio file, or text) so that an observer does not even suspect a secret exists.

Least Significant Bit (LSB) Embedding

Images are composed of pixels, each stored as RGB values (0-255). Changing the lowest bit (LSB) of a color byte changes its numeric value by at most 1—a change imperceptible to the human eye.

1. Convert secret text into a binary bitstream.
2. Replace the LSB of consecutive pixel color values with secret bits.
3. To extract: read the LSB of each pixel color value in sequence to reconstruct the bitstream and original text.