Ciphertext‐Autokey (CTAK)

A Ciphertext-Autokey cipher is a polyalphabetic substitution cipher where the key which determines the alphabet used at each position while encrypting a message is given by some previous ciphertext output. This method tends to smooth out the frequency distribution without any periodicity, which is helpful for making ciphers more difficult to solve with methods like frequency analysis.

The main parameter which determines different appearances of this kind of cipher is the introductory key. How the introductory key is used may vary, but the main reason for it is that the encryption depends on previous ciphertext output, so the first letters of the message require a predetermined primer key of length 1 or longer. After this initial key, the autokey mechanism can start using the ciphertext output from the beginning of the message, which causes a delay, where the ciphertext symbol used for the key is the letter $n$ positions back, for a primer key of length $n$. Alternatively, after the initial key, the encryption can use only the previous ciphertext symbol as the key, effectively ignoring the first few letters of the message entirely.

As an alternative to using an introductory key, the message could also be "keyless" and use an initial state instead, though this is essentially the same as using a one-character introductory key, just a different interpretation of the mechanism as being state-based rather than key-based.

Classically, with 26-letter PT and CT alphabets, and alphabets for each letter key being rotations of the base alphabet (which itself could be permuted in some way, such as a keyed alphabet), this can be considered a variation of a Vigenere cipher (as in "Vigenere ciphertext-autokey"). This is an example of a classical cipher which is capable of producing isomorphs, though it is chainable without conflicts.

As an extension of this, instead of rotations of an alphabet, you could use a set of permuted alphabets with no special relation between them, and this is valid as a polyalphabetic cipher, however it does not produce causal isomorphs.

More generally, you are not limited to a ciphertext alphabet of 26, so to make a ciphertext-autokey cipher with more than 26 CT symbols, the most common strategy is to still use rotated CT alphabets, and consider the state/key as a running sum of PT values mod the CT alphabet size. Note that the PT values could be 0-25 or 1-26, but they could also be any values less than the CT alphabet size, as long as they are all distinct. A running sum is not the only way to do this, as there are also running products that can work, though it depends on the alphabet sizes. (In fact, all ciphertext-autokey methods which consistently produce isomorphs are equivalent to instances of group ciphertext-autokey ciphers with the underlying group being cyclic.)

With respect to the eyes, this method seems promising because not only does it produce isomorphs and an even distribution over 83 CT symbols, it's easy to select the PT values such that doubles are impossible (just don't select 0). However, this still doesn't produce chaining conflicts and we would have been able to use alphabet chaining to solve it if it was the correct method, so unfortunately, this isn't a good enough fit for the eyes. However, it is a step in the right direction!

Precise definition of the method:

A CTAK cipher consists of the following information:

• The plaintext alphabet $P$
• The ciphertext alphabet $C$, which requires $|P| \leq |C|$
• A modulus $m$ given by the length of the CT alphabet, $m = |C|$
• The plaintext mapping $p$, an injective function which assigns a unique value mod $m$ to each plaintext letter, $p: P \to Z/mZ$
• The ciphertext mapping $c$, a bijective function which assigns each value mod $m$ to a ciphertext symbol, $c: Z/mZ \to C$ (optional if you're using numbers mod $m$ directly as the CT output)
• An initial state (optional, usually just 0)

The encipherment updates the state cumulatively. If the current state is $g_i$, and the current PT letter is $a_i$, then the state update to get the next state $g_{i+1}$ acting by addition mod $m$ is:

$g_{i+1} = (g_i + p(a_i)) \mod m$

And the CT output is:

$c_i = c( (g_i + p(a_i)) \mod m )$

Another way to think of this which might be more intuitive for visualization is that you have a disk with $m$ equally spaced ciphertext symbols, initially pointing at one of them for the initial state, and at each step, you rotate the disk by a specific amount corresponding to the current plaintext letter to be encrypted, and output the ciphertext letter that the disk is pointing at. These cumulative rotations are what cause the cipher to be polyalphabetic; any given plaintext letter will encrypt to a different output depending on the current state of the disk. Additionally, if the disk moves in the same pattern from the same plaintext word being repeated, it will repeat CT symbols which are in the same relative positions to each other, resulting in an isomorph.

The amounts that each plaintext letter rotates are pretty open-ended, as long as each one rotates by a unique amount. You could use a keyed alphabet and rotate by 0, 1, 2... for each letter depending on its index in that alphabet, for example, but you are not limited to needing to use every rotation amount, if the plaintext alphabet is smaller than the ciphertext alphabet. For example, you can easily avoid doubles by just not having any plaintext letter rotate by 0. You can also skip rotation amounts, like rotating by 1, 3, 5, 7... if you wanted, as long as you don't reuse any values mod $m$.

However, this kind of cipher is vulnerable to classical alphabet chaining.