Chris Spackman's NeoCities Page

Breaking Transposition Ciphers

Transposition ciphers work differently from substitution ciphers. Instead of replacing letters with other letters, they rearrange the letters of the original message into a new order. The letters themselves are unchanged — they are just moved to different positions. This means the frequency distribution of a transposition ciphertext looks exactly like normal English, because it is normal English, just scrambled.

This page covers two common transposition ciphers: the rail fence cipher and the columnar transposition cipher. Both can be broken without knowing the key, using the techniques described below.

Recognizing Transposition

How do you tell a transposition cipher apart from a substitution cipher? The key is the Index of Coincidence (IC). If the IC of your ciphertext is close to 0.067 (the English value) and the letter frequencies match standard English — but the text itself is unreadable gibberish — then you are almost certainly looking at a transposition cipher, not a substitution cipher.

With a monoalphabetic substitution cipher, the IC is also near 0.067, but the individual letter frequencies are shifted: the most common letter in the ciphertext is not E itself, but whatever letter E was replaced by. With transposition, the most common letter in the ciphertext is E, because the letters were never changed — only moved. If you count the letters and find that E really is the most common, T is second, A is third, and so on, then the cipher preserves English frequencies perfectly. That is the hallmark of transposition.

Breaking Rail Fence Ciphers

The rail fence cipher writes the plaintext in a zigzag pattern across a number of “rails” (rows), then reads off each rail in sequence. The key is simply the number of rails used.

Because the key space is tiny — typically just 2 to 10 rails — brute force is the easiest attack. We try every possible rail count, decrypt the ciphertext with each one, and score the result using digraph frequency analysis. English text has characteristic two-letter pairs (TH, HE, IN, ER, AN) that appear far more often than random pairs. The decryption that produces the most English-like digraphs is almost certainly the correct one.

Breaking Columnar Transposition

The columnar transposition cipher writes plaintext into a grid row by row, then reads the columns in an order determined by the keyword. Breaking it requires two steps: first, figure out how many columns were used; second, figure out the correct column order.

Determining the column count: If you know or can guess the number of columns (perhaps from the message length or context), enter it directly. Otherwise, try several values and see which one yields the best results.

Rearranging columns: Once the ciphertext is arranged into columns, you need to find the right ordering. Click a column to select it, then click another column to swap them. After each swap, the tool recalculates the digraph score and shows the current reading. You can also use Auto-Solve to try all possible orderings (for small column counts) or use a greedy heuristic (for larger ones).

Things to Try

• Load the rail fence sample and click Brute Force. Which rail count has the highest digraph score? Read the decrypted text — does it make sense?
• Load the columnar sample and click Arrange Columns. Try swapping columns manually. Watch how the digraph score changes. Can you find the right order before using Auto-Solve?
• Go to the rail fence page, encrypt your own message with 4 rails, and bring the ciphertext back here. Can the brute-force attack find it?
• Try the columnar transposition with different column counts. What happens when you guess the wrong number of columns? Why does the digraph score stay low?
• Encrypt a message with the columnar transposition page using a long keyword (8+ letters). Does Auto-Solve still work? At what key length does it start to struggle?
• Compare the ciphertext frequencies to English using the frequency analysis page. Notice how the distribution matches English perfectly — that is how you know it is transposition.