"The Montefeltro Conspiracy" arrives...

A copy of Marcello Simonetta's new book "The Montefeltro Conspiracy" (2008) has just arrived in the post (I first mentioned it here). I must admit to being a bit excited, as he covers a lot of ground I'd had to wade slowly through in the Italian sources when writing my own book - Cicco Simonetta, Francesco Sforza, the death of Galeazzo Maria Sforza, Italian cryptography - as well as the fascinating web of intrigue and treachery threaded through so many of the condottieri and(mainly Florentine) princes which forms the book's focus.

Really, it's the kind of book I aspired to in "The Curse": a historical account of the politics of cryptography (though the cryptography aspect here is fairly light by comparison). And, quite unexpectedly, Marcello cites my book (though admittedly only in the endnote to p.24 - but hey, it's in the bibliography too, every little citation helps).

Even at a glance, it's obvious that his book is well illustrated, with even some nice pictures of the Urbino intarsia I mentioned here only a few days ago. But I'm getting way ahead of myself now: I have to go away and read it ASAP so that I can post a proper review here...

The d'Agapayeff Cipher, continued...

In a recent post, I mentioned the idea that the d'Agapeyeff cipher might involve a diagonal transposition on the 14x14 grid cryptologists suspect it may well have been based upon. To test this out a bit, I wrote a short C++ program (which I've uploaded here) which turns the number pairs into characters (for convenience) and prints out all four diagonal transpositions (forward, reverse, forward boustrophedon, reverse boustrophedon) starting from each of the four corners.

Because the number of doubled and tripled letters is a simple measure of whether a transposition is likely to be plausible or not, I counted those up as well. The next metric to calculate would be the unique letter adjacency count (i.e. how many unique pairs of letters appear for each ordering)... but that's a task for another day.

Interestingly, transpositions starting from the top-left corner (and their reverse-order reflections in the bottom-right corner) have no triple-letters at all, as well as far fewer double-letters (9/10/11 compared to 13/14/15) than transpositions that start from the top-right. Though intriguing, I don't know if this is statistically significant: I haven't determined what the predicted doublet and triplet count would be for a totally randomised transposition, perhaps calculating that too that would be a good idea.

For any passing cryptologers, here is the ASCII version of the d'Agapeyeff cipher (as output by the C++ code) when arranged as a 14x14 grid (in numerical order but without J), followed by the 16 diagonal transpositions with their associated double & triple counts. My guess is that the top left corner reverse diagonal transposition (the second one down, starting "KBDMIDPIK...") is most likely to be the correct transposition, but we shall see (hopefully!) if this is true...

K B M P Q B Q D L D Q I P O
D I I M O N L C L L I I M B
D K N M O Q K I E N K K K S
C E E L C L K P K K D B M R
P I C M K I N L E L O P D P
D P P C M G B N B L L G L D
C K M L D N C M P L C C C Y
I L Q Q O C P O E D P E B T
B B P Q P Q I Q G K D E K F
E N B D I L M O B M D Q L S
E B D O O Q N P I Q L E G I
N N P M N D B G B E B N K R
G C M M G G N M P O K M L N
G O B M N K L D K I P L B R

*** Top left corner ***
Forward order...
KDBDIMCKIPPENMQDIEMOBCPCLONQIKPMCQLDBLMCKLKCLEBQLMIKILDE
NPQDGNPELQNBBQONBLKNIIGNDDPCCNEKKIPGCPOIQPMBLDKMOOMMOLIO
PLOBKBBMNQMQELLPMSMGDNOGDCGDRNGBPBKPCLPKNGIMDECDLMBQDEBY
DPELQKTKOBELFIKNGSPMKILLRBNR
--> number of doubles = 11, number of triples = 0
Reverse order...
KBDMIDPIKCQMNEPBOMEIDQNOLCPCDLQCMPKILCKLKCMLBDLIKIMLQBEQ
LEPNGDQPNEIINKLBNOQBBNPIKKENCCPDDNGOMKDLBMPQIOPCGBKBOLPO
ILOMMOSMPLLEQMQNMBRDGCDGONDGMPLCPKBPBGNDCEDMIGNKYBEDQBML
TKQLEPDFLEBOKSGNKIIKMPRLLNBR
--> number of doubles = 9, number of triples = 0
Simple boustrophedon (forward then reverse)...
KBDDIMPIKCPENMQBOMEIDCPCLONQDLQCMPKIBLMCKLKCLDLIKIMLQBEE
NPQDGNPELQIINKLBNOQBBNGNDDPCCNEKKIPOMKDLBMPQIOPCGOMMOLIO
PLOBKBSMPLLEQMQNMBMGDNOGDCGDRPLCPKBPBGNKNGIMDECDYBEDQBML
DPELQKTFLEBOKIKNGSIKMPLLRNBR
--> number of doubles = 10, number of triples = 0
Reverse boustrophedon (reverse then forward)...
KDBMIDCKIPQMNEPDIEMOBQNOLCPCIKPMCQLDLCKLKCMLBEBQLMIKILDQ
LEPNGDQPNENBBQONBLKNIIPIKKENCCPDDNGGCPOIQPMBLDKMOBKBOLPO
ILOMMOBMNQMQELLPMSRDGCDGONDGMNGBPBKPCLPDCEDMIGNKLMBQDEBY
TKQLEPDKOBELFSGNKIPMKIRLLBNR
--> number of doubles = 9, number of triples = 0

*** Top right corner ***
Forward order...
OPBIMSQIKRDIKMPLLKBDDDLNDPLYQCEKOGCTBLIKLLCBFQNKPELCEKSP
OQKLBLPELIMMOLNNPDDQGRBIMCIBMEKDEKNKINLKGCOGMLNLRDKEMMNP
QBQBMBDECCDCIOIEKLCIPLOQMPBOPPPMQPLNGPIDKQQIQBMKCLPDODND
IBBONGLBNDMGKEBPMNENMMNCBGOG
--> number of doubles = 14, number of triples = 2
Reverse order...
OBPSMIRKIQPMKIDDDBKLLYLPDNLDTCGOKECQFBCLLKILBSKECLEPKNQI
LEPLBLKQOPRGQDDPNNLOMMNKEDKEMBICMIBRLNLMGOCGKLNIKBMBQBQP
NMMEKDLKEIOICDCCEDPOBPMQOLPICIPGNLPQMPPKMBQIQQKDDNDODPLC
LGNOBBIKGMDNBNMPBEMMNEBCNOGG
--> number of doubles = 15, number of triples = 1
Simple boustrophedon (forward then reverse)...
OBPIMSRKIQDIKMPDDBKLLDLNDPLYTCGOKECQBLIKLLCBFSKECLEPKNQP
OQKLBLPELIRGQDDPNNLOMMBIMCIBMEKDEKNRLNLMGOCGKLNIKDKEMMNP
QBQBMBLKEIOICDCCEDCIPLOQMPBOPIPGNLPQMPPDKQQIQBMKDNDODPLC
IBBONGLKGMDNBEBPMNMMNENCBOGG
--> number of doubles = 13, number of triples = 0
Reverse boustrophedon (reverse then forward)...
OPBSMIQIKRPMKIDLLKBDDYLPDNLDQCEKOGCTFBCLLKILBQNKPELCEKSI
LEPLBLKQOPMMOLNNPDDQGRNKEDKEMBICMIBKINLKGCOGMLNLRBMBQBQP
NMMEKDDECCDCIOIEKLPOBPMQOLPICPPMQPLNGPIKMBQIQQKDCLPDODND
LGNOBBIBNDMGKNMPBEENMMBCNGOG
--> number of doubles = 14, number of triples = 0

*** Bottom right corner ***
Forward order...
RNBRLLIKMPSGNKIFLEBOKTKQLEPDYBEDQBMLDCEDMIGNKPLCPKBPBGNR
DGCDGONDGMSMPLLEQMQNMBBKBOLPOILOMMOOMKDLBMPQIOPCGPIKKENC
CPDDNGIINKLBNOQBBNQLEPNGDQPNEDLIKIMLQBELCKLKCMLBDLQCMPKI
QNOLCPCBOMEIDQMNEPPIKCMIDBDK
--> number of doubles = 11, number of triples = 0
Reverse order...
RBNLLRPMKIIKNGSKOBELFDPELQKTLMBQDEBYKNGIMDECDNGBPBKPCLPM
GDNOGDCGDRBMNQMQELLPMSOMMOLIOPLOBKBGCPOIQPMBLDKMOGNDDPCC
NEKKIPNBBQONBLKNIIENPQDGNPELQEBQLMIKILDBLMCKLKCLIKPMCQLD
CPCLONQDIEMOBPENMQCKIPDIMDBK
--> number of doubles = 9, number of triples = 0
Simple boustrophedon (forward then reverse)...
RBNRLLPMKISGNKIKOBELFTKQLEPDLMBQDEBYDCEDMIGNKNGBPBKPCLPR
DGCDGONDGMBMNQMQELLPMSBKBOLPOILOMMOGCPOIQPMBLDKMOPIKKENC
CPDDNGNBBQONBLKNIIQLEPNGDQPNEEBQLMIKILDLCKLKCMLBIKPMCQLD
QNOLCPCDIEMOBQMNEPCKIPMIDDBK
--> number of doubles = 10, number of triples = 0
Reverse boustrophedon (reverse then forward)...
RNBLLRIKMPIKNGSFLEBOKDPELQKTYBEDQBMLKNGIMDECDPLCPKBPBGNM
GDNOGDCGDRSMPLLEQMQNMBOMMOLIOPLOBKBOMKDLBMPQIOPCGGNDDPCC
NEKKIPIINKLBNOQBBNENPQDGNPELQDLIKIMLQBEBLMCKLKCLDLQCMPKI
CPCLONQBOMEIDPENMQPIKCDIMBDK
--> number of doubles = 9, number of triples = 0

*** Bottom left corner ***
Forward order...
GOGBCNMMNENMPBEKGMDNBLGNOBBIDNDODPLCKMBQIQQKDIPGNLPQMPPP
OBPMQOLPICLKEIOICDCCEDBMBQBQPNMMEKDRLNLMGOCGKLNIKNKEDKEM
BICMIBRGQDDPNNLOMMILEPLBLKQOPSKECLEPKNQFBCLLKILBTCGOKECQ
YLPDNLDDDBKLLPMKIDRKIQSMIBPO
--> number of doubles = 14, number of triples = 2
Reverse order...
GGONCBENMMEBPMNBNDMGKIBBONGLCLPDODNDDKQQIQBMKPPMQPLNGPIC
IPLOQMPBOPDECCDCIOIEKLDKEMMNPQBQBMBKINLKGCOGMLNLRBIMCIBM
EKDEKNMMOLNNPDDQGRPOQKLBLPELIQNKPELCEKSBLIKLLCBFQCEKOGCT
DLNDPLYLLKBDDDIKMPQIKRIMSPBO
--> number of doubles = 15, number of triples = 1
Simple boustrophedon (forward then reverse)...
GGOBCNENMMNMPBEBNDMGKLGNOBBICLPDODNDKMBQIQQKDPPMQPLNGPIP
OBPMQOLPICDECCDCIOIEKLBMBQBQPNMMEKDKINLKGCOGMLNLRNKEDKEM
BICMIBMMOLNNPDDQGRILEPLBLKQOPQNKPELCEKSFBCLLKILBQCEKOGCT
YLPDNLDLLKBDDPMKIDQIKRSMIPBO
--> number of doubles = 13, number of triples = 0
Reverse boustrophedon (reverse then forward)...
GOGNCBMMNEEBPMNKGMDNBIBBONGLDNDODPLCDKQQIQBMKIPGNLPQMPPC
IPLOQMPBOPLKEIOICDCCEDDKEMMNPQBQBMBRLNLMGOCGKLNIKBIMCIBM
EKDEKNRGQDDPNNLOMMPOQKLBLPELISKECLEPKNQBLIKLLCBFTCGOKECQ
DLNDPLYDDBKLLDIKMPRKIQIMSBPO
--> number of doubles = 14, number of triples = 0

The d'Agapeyeff Cipher, revisited...

I know, I did blog about this only three days ago: but science moves ever onwards, OK?

A nice email arrived from Robert Matthews, the author of an excellent page on the d'Agapeyeff Cipher: he mentioned that he had received an email in February 2006 from John Willemse in Holland, who had suggested a novel kind of transposition cipher based around a spiral:-

I'm in no way a cipher expert, but I am a very curious person and I was wondering if the positioning of the 14x14 digram table could have anything to do with a spiral. The reason I suspect this, is that a spiraling positioning of numbers have the property that each upperleft corner of such a spiral (when starting with zero in the center) is a perfect square number. I'll try to illustrate my point:

16 15 14 13 12
17 .4 .3 .2 11 ..
18 .5 .0 .1 10 ..
19 .6 .7 .8 .9 26
20 21 22 23 24 25

Starting from zero, and counting up, anti-clockwise, you will encounter a perfect square of each even number in the topleft corner. 196 is also such a number.

The '04' digram almost in the center could be a break point. If you 'break' after the zero and shift the 4 to the right, creating a new set of digrams, you end up with a set of digrams before the zero and a set after the zero. The set after the zero should probably be reversed, either the whole set or the individual digrams, to create a similar set as the first one (the digrams starting with higher digits and ending with lower digits).

You might then be able to construct a spiral like positioning, with the zero in the center or the zero obmitted. The first set might then be 'twisted' around it clockwise, and the second set anti-clockwise, possibly interweaving each other.

These are just some wild ideas, and I'm in no way capable of constructing and verifying such a table myself, but maybe it's something to investigate?

Willemse's idea is certainly interesting: but let's look again at the (derived) 14x14 layout. To recap: one of the reasons for suspecting that transposition is involved is that there are two sets of horizontal tripled letters (75 75 75 and 63 63 63), while one of the reasons for suspecting that it's not a 'matrix transpose' diagonal flip is that there are two sets of vertical tripled letters (81 81 81 and 82 82 82). That is, unless the plaintext sadistically contains a phrase like "SEPIA AARDVARK" (a phrase which, I'm delighted to note, Google believes currently appears nowhere else on the Internet).

75 62 82 85 91 62 91 64 81 64 91 74 85 84
64 74 74 82 84 83 81 63 81 81 74 74 82 62
64 75 83 82 84 91 75 74 65 83 75 75 75 93
63 65 65 81 63 81 75 85 75 75 64 62 82 92
85 74 63 82 75 74 83 81 65 81 84 85 64 85
64 85 85 63 82 72 62 83 62 81 81 72 81 64
63 75 82 81 64 83 63 82 85 81 63 63 63 04
74 81 91 91 84 63 85 84 65 64 85 65 62 94
62 62 85 91 85 91 74 91 72 75 64 65 75 71
65 83 62 64 74 81 82 84 62 82 64 91 81 93
65 62 64 84 84 91 83 85 74 91 81 65 72 74
83 83 85 82 83 64 62 72 62 65 62 83 75 92
72 63 82 82 72 72 83 82 85 84 75 82 81 83
72 84 62 82 83 75 81 64 75 74 85 81 62 92

From this, it seems that, yes, you could construct a large number of spiral transpositions without tripled letter sequences. Yet I'm not completely convinced by the idea that the 04 token is a good indicator for the centre of a spiral: from the substitution cipher angle, I'd be quite happy to tag that as a likely 'X' or 'Y' in the plaintext instead.

However, I would point out that if you examine the various diagonal transpositions of the 14x14 (i.e. reading through the 14x14 one diagonal line at a time), there is (unless I'm somehow mistaken) apparently only a single tripled letter in two of them, and that only over a line-break:-

75 62 82 85 91 62 91 64 81 64 91 74 85 84
64 74 74 82 84 83 81 63 81 81 74 74 82 62
64 75 83 82 84 91 75 74 65 83 75 75 75 93
63 65 65 81 63 81 75 85 75 75 64 62 82 92
85 74 63 82 75 74 83 81 65 81 84 85 64 85
64 85 85 63 82 72 62 83 62 81 81 72 81 64
63 75 82 81 64 83 63 82 85 81 63 63 63 04
74 81 91 91 84 63 85 84 65 64 85 65 62 94
62 62 85 91 85 91 74 91 72 75 64 65 75 71
65 83 62 64 74 81 82 84 62 82 64 91 81 93
65 62 64 84 84 91 83 85 74 91 81 65 72 74
83 83 85 82 83 64 62 72 62 65 62 83 75 92
72 63 82 82 72 72 83 82 85 84 75 82 81 83
72 84 62 82 83 75 81 64 75 74 85 81 62 92

All in all, Willemse's idea of a spiral transposition does seem intriguing: but perhaps a little more psychologically ornate than d'Agapeyeff would have considered necessary as an exercise for the reader. If I were actively looking for a solution to this cipher (which I'm not), I would instead start with the four basic diagonal transpositions of the 14x14, and see if they led anywhere interesting... you never know! :-)

"The E. A. Poe Cryptographic Challenge"...

While looking at Elonka's list of unsolved cipher mysteries while composing my post on the d'Agapeyeff cipher, my eye was drawn to the list of solved cipher mysteries she appended to it, and in particular to "The E. A. Poe Cryptographic Challenge".

Edgar Allan Poe often used codes and ciphers in his stories, most famously in "The Gold-Bug" (which incidentally inspired a very young William Friedman to take up an interest in cryptography). He also asked readers of one popular magazine to send him their ciphers to crack: which he (allegedly) managed to do for the hundred such that arrived.

However, in 1839 Poe published two tricky cryptograms allegedly by "Mr. W. B. Tyler" (probably a Poe pseudonym) which nobody at the time was able to break. These were rediscovered in 1985 by Professor Louis Renza, who then tried to raise their profile: before too long (in 1992), Professor Terence Whalen managed to solve the first one, which turned out to be nothing more complex than a simple monoalphabetic cipher.

The second (still-unbroken) cipher attracted the attention of Professor Shawn Rosenheim, who not only described it in his book The Cryptographic Imagination: Secret Writing from Edgar Poe to the Internet (Johns Hopkins, 1997), but also put up a $2500 prize to attract solvers' attention, with the help of Jim Moore of bokler.com who built a website to promote it.

And then, after Rosenheim and Moore had fielded hundreds of fruitless emails and responses, a software engineer from Toronto called Gil Broza finally cracked the second cipher in October 2000: his decryption is detailed here.

For followers of the Voynich Manuscript, this makes for fairly depressing reading: neither of the "W. B. Tyler" ciphers were, even by the standard of Milanese ciphers circa 1465, particularly tricky, yet Broza had to work really quite hard to solve the second one. He worked out his own transcription, wrote his own software... and then still basically had to break into it by hand, a process made even more difficult by the presence of errors in the ciphertext (which were probably introduced in the typesetting). And people wonder why modern supercomputers can't unravel the secrets of Voynichese - a cipher that is ten times harder than the second Poe Cipher.

The real mystery about Poe is actually the manner of his death: but that's an intriguing story for another day... :-)

The d'Agapeyeff Cipher...

Back in 1939, Alexander d'Agapeyeff wrote a tidy little book called "Codes and Ciphers" on cryptography history: though you can now buy it print-on-demand, cheap copies of the original book often come up on the various second-hand book aggregators (such as bookfinder.com), which is where I got my copy of the "Revised and reset" 1949 edition.

What is now generally understood is that d'Agapeyeff wasn't really a cryptographer per se: he had previously written a similar book on cartography for the same publisher, and so thought to tackle cryptography.

On the very last page of the text (p.144), d'Agapeyeff dropped in a little cipher challenge, saying "Here is a cryptogram upon which the reader is invited to test his skill."

75628 28591 62916 48164 91748 58464 74748 28483 81638 18174
74826 26475 83828 49175 74658 37575 75936 36565 81638 17585
75756 46282 92857 46382 75748 38165 81848 56485 64858 56382
72628 36281 81728 16463 75828 16483 63828 58163 63630 47481
91918 46385 84656 48565 62946 26285 91859 17491 72756 46575
71658 36264 74818 28462 82649 18193 65626 48484 91838 57491
81657 27483 83858 28364 62726 26562 83759 27263 82827 27283
82858 47582 81837 28462 82837 58164 75748 58162 92000

This modest little cryptogram, now known as "the d'Agapayeff Cipher", has somehow remained unbroken for 70 years, and is often to be found alongside the Voynich Manuscript on lists of cipher enigmas.

The first thing to note is that adjacent columns are formed alternately from 67890 and 12345 characters respectively: which is a huge hint that what we are looking at is (in part, at least) a grid cipher, where each pair of numbers gives a position in a grid. If so, then we can throw away the "patristrocat" spaces between the blocks of numbers and rearrange them as pairs.

75 62 82 85 91 62 91 64 81 64 91 74 85 84 64 74 74 82 84 83 81 63 81 81 74
74 82 62 64 75 83 82 84 91 75 74 65 83 75 75 75 93 63 65 65 81 63 81 75 85
75 75 64 62 82 92 85 74 63 82 75 74 83 81 65 81 84 85 64 85 64 85 85 63 82
72 62 83 62 81 81 72 81 64 63 75 82 81 64 83 63 82 85 81 63 63 63 04 74 81
91 91 84 63 85 84 65 64 85 65 62 94 62 62 85 91 85 91 74 91 72 75 64 65 75
71 65 83 62 64 74 81 82 84 62 82 64 91 81 93 65 62 64 84 84 91 83 85 74 91
81 65 72 74 83 83 85 82 83 64 62 72 62 65 62 83 75 92 72 63 82 82 72 72 83
82 85 84 75 82 81 83 72 84 62 82 83 75 81 64 75 74 85 81 62 92 00 0[0]

The first hint that the order of these might have been scrambled ('transposed') comes from the two sets of tripled letters: 75 75 75 and 63 63 63. Five centuries ago, even Cicco Simonetta and his Milanese cipher clerks knew that tripled letters are very rare (the only one in Latin is "uvula", 'little egg'). The second hint that this is a transposition cipher is the total number of characters (apart from the "00" filler at the end): 14x14. If we discard the filler & rearrange the grid we get:-

75 62 82 85 91 62 91 64 81 64 91 74 85 84
64 74 74 82 84 83 81 63 81 81 74 74 82 62
64 75 83 82 84 91 75 74 65 83 75 75 75 93
63 65 65 81 63 81 75 85 75 75 64 62 82 92
85 74 63 82 75 74 83 81 65 81 84 85 64 85
64 85 85 63 82 72 62 83 62 81 81 72 81 64
63 75 82 81 64 83 63 82 85 81 63 63 63 04
74 81 91 91 84 63 85 84 65 64 85 65 62 94
62 62 85 91 85 91 74 91 72 75 64 65 75 71
65 83 62 64 74 81 82 84 62 82 64 91 81 93
65 62 64 84 84 91 83 85 74 91 81 65 72 74
83 83 85 82 83 64 62 72 62 65 62 83 75 92
72 63 82 82 72 72 83 82 85 84 75 82 81 83
72 84 62 82 83 75 81 64 75 74 85 81 62 92

This is very probably the starting point for the real cryptography (though the presence of tripled characters in the columns implies that it probably isn't a simple "matrix-like" diagonal transposition. Essentially, it seems that we now have to solve a 14x14 transposition cipher and a 5x5 substitution cipher simultaneously, over a relatively small cryptogram - an immense number of combinations to explore.

However, we know that d'Agapeyeff wasn't a full-on cryptographer, so we should really explore the psychological angle before going crazy with an 800-year-long brute-force search. For a start, if you lay out the frequencies for the 5x5 letter grid (with 12345 on top, 67890 on the left), a pattern immediately appears:-

** .1 .2 .3 .4 .5
6. _0 17 12 16 11
7. _1 _9 _0 14 17
8. 20 17 15 11 17
9. 12 _3 _2 _1 _0
0. _0 _0 _0 _1 _0

Here, the 61 (top-left) frequency is 0, the 73 frequency is 0, and the final nine frequencies are 3, 2, 1, 0; 0, 0, 0, 1, 0. I think this points to a 5x5 mapping generated by a keyphrase, such as "Alexander d'Agapeyeff is cool" (for example). To make a keyphrase into a 5x5 alphabet, turn all Js into Is (say), remove all duplicate letters (and so it becomes ALEXNDRGPYFISCO), and then pad to the end with any unused characters in the alphabet in sequence (BHKMQTUVWZ)

* 1 2 3 4 5
6 A L E X N
7 D R G P Y
8 F I S C O
9 B H K M Q
0 T U V W Z

For a long-ish (but language-like) keyphrase, rare characters would tend to get moved to the end of the block: which is what we appear to see in the frequency counts above, suggesting that the final few letters are (for example) W X Y Z or W X Z.

Yet 61 and 73 have frequency counts of zero, which points to their being really rare letters (like Q or Z). However, if you read the frequency counts as strings, 61 62 63 = 0 17 12, while 73 74 75 = 0 14 17: which perhaps points to the first letter of the keyphrase (i.e. 61) being a rare consonant, and the second pair being Q U followed by a vowel. Might 73 74 75 76 77 be QUIET or QUITE?

I don't (of course) know: but I do strongly suspect that it might be possible for a cunning cryptographer to crack d'Agapeyeff's keyphrase quite independently of his transposition cipher. It can't be that hard, can it? ;-p

----------
Update: a follow-up post is here...

The Golden Dawn Cipher Manuscripts...

Joseph Campbell wrote extensively about the "Hero's Journey", his condensation of mythology into the single ur-story (often referred to as the "monomyth")beneath it all. In recent decades, Campbell's work was popularized by Chris Vogler in his book "The Writer's Journey", that distilled the original 17 stages to a 12-stage / 3-act writing template. All of which makes the recent Hollywood writer's strike seem to me potentially anachronistic: in 10 years time, the [Auto-Plot] button will probably have put them all out of a job anyway.

Incidentally, if you're familiar with the "Patterns" literature (where recurring patterns of behaviour are given names in order that people can recognize them and manage their causes, rather than simply fire-fighting their consequences), you should be very comfortable with the monomyth: it's basically a pattern template for mythological behaviours.

The first of Campbell's stages is the "Call To Adventure": someone (a Herald) or something (a Macguffin, say) challenges the Hero (and, behind the scenes, often the Anti-Hero too) to take temporary leave of his Ordinary World (DullWorld) to enter the Special World of the Macguffin (DangerWorld). Stage Two is where the Hero says: errrm, thanks... but no thanks, I'm actually quite happy here sweeping the floors [A.K.A. "Refusal of the Call"], while Stage Three is where the unseen writing Gods swoosh the Hero up like the miserable piece of snot he is and propel him onwards to his adventure in DangerWorld, whether he likes it or not [A.K.A. "Supernatural Aid"]. Because, let's face it, only a nutter would place themselves in danger for no reason.

In the case of the Voynich Manuscript, most people are happy to enjoy the frisson of danger that comes with the Refusal of the Call: a cipher manuscript is all too obviously a Macguffin, a siren call to a mad textual adventure that you simply wouldn't wish on anyone (let alone yourself). Anyone (such as myself) who has spent any significant time in the VMs' World Of Research Agony will readily verify that this is basically the case.

But I find it fascinating that the founding mythology of the 19th century Hermetic Order of the Golden Dawn was built around claimed cipher manuscripts. These had been owned by masonic scholar Kenneth Mackenzie, then found in a cupboard by Rev. A.F.A. Woodford in 1885, and then deciphered by William Wynn Westcott - the plaintext was in English, but had apparently been encrypted using a 15th century Trithemian-style cipher. Westcott then supposedly wrote to someone called Fraulein Anna Sprengel (whose contact details had helpfully been enciphered, though I can see no sign of them in the 56 released folios), who made him and his two collaborators "Exempt Adepts": and gave them a charter to work the five initiatory grades described in the cipher manuscripts.

Are the cipher manuscripts in any way genuine? Though the paper used for the 60 folios of the cipher was watermarked 1809, the association it mentions between the Tarot trumps and the Tree of Life was first proposed by Eliphas Levi only in 1855. And, for me, the simple act of using 45-year-old paper (never mind the constantly changing story surrounding the object, and the continued inability to find Anna Sprengel) makes me suspect that deception (or, at the very least, some kind of misleading myth-making) was intended right from the start.

Doubtless many of the hundreds of initiates who felt compelled by the unseen Gods to accept this Call to Adventure heartily enjoyed their foray into the Golden Dawn's DangerWorld. But regardless, the Cipher Manuscript at the heart of the constructed myth seems to have been nothing more than a Macguffin: Refusal of the Call is often exactly the right place to stop.

Beale Papers: solved (or not)?

Here's a claimed solution to the Beale Papers (but press Cancel on the login popup, and if browsing there under Windows, I wouldn't advise installing the ActiveX control that pops up) which I didn't know about until very recently. I thought I'd mention it here because, as any fule kno, the Beale Papers are one of the few encrypted historical mysteries to parallel the Voynich Manuscript to any significant degree.

To be precise, the Beale Papers comprise not one long ciphertext (putting the VMs' thorny Currier A-B language continuum issue to one side) but three short codetexts, all allegedly dating from 1819-1821: part 2 was publicly announced in 1885 already solved (for its codebook, the encoder used a slightly mangled/miscopied version of the Declaration of Independence)... but the directions to the buried treasure were in the undecoded part 1, while the shorter (and also undecoded) part 3 listed the people involved. Of course, only someone who has broken the two remaining codes would know if all of this is true or not. :-)

So, it's basically a kind of Wild West bandit take on a pirate treasure map (which to me sounds like an Alias Smith and Jones script, oh well) but made obscure with some kind of dictionary code: all of which is reassuringly familiar if you've just read PopCo. Confusingly, some people argue that the Beale Papers are a fake (possibly by the promoter of the 1885 pamphlet, or even by Edgar Allen Poe, etc), claiming justification from statistical aspects of the cryptography and/or on claimed anachronisms in the language, etc: but a definitive answer either way has yet to be found.

For what it's worth... my opinion is that, as with the VMs, cries of hoax are more Chicken Licken than anything approaching an ironic postmodernist reading. Really, it does look and feel basically how a home-cooked Victorian code-text ought to, with an emphasis towards lowish numbers (up to 350) plus a sprinkling of higher numbers (possibly for rare or awkward letters): Jim Gillogly's observation (in October 1980 Cryptologia) of an alphabet-like pattern in part 1 (if you apply part 2's codebook) seems to me more like a clue than a reason to reject the whole object as a hoax. As an aside, a few years ago I heard (off-Net) whispers of one particular cryptographic solution that had yet to be made public: but Louis Kruh in Cryptologia reported several such plausible-looking solutions as far back as 1982, so what can you say?

However, all of this is an entirely different claim to the "Beale Solved" code solution linked above, which was (re)constructed by Beale treasure hunter Daniel Cole (who died in 2001). Even though the dig that was carried out as a result of Cole's decryption revealed an empty chamber (the website claims), the cryptographic details (ie, of how the codetext links with the plaintext) have yet to be released... which is a tad fishy.

A quick check of the first page of Cole's version of part 3 reveals that he didn't read it as a simple cipher or codebook, because repeated code-numbers only rarely get decoded as the same letter (for example, the five instances of '96' get decoded as "s / e / r / h / n"). Yet this seems somewhat odd: if there was some kind of strange offsetting going on, the distribution of code-numbers would not need to so closely resemble the kind of distribution you see in code book ciphers.

But once you confess to having taken a single step down the whole "it's actually a strange cipher pretending to be a codebook code" route, nobody will believe a word you say, right?

The Book of Soyga, revisited...

It's a nice historical detective story, one kicked off by John Dee, Frances Yates' favourite Elizabethan 'magus' (though I personally suspect Dee's 'magic' was probably less 'magickal' than it might appear), when he claimed to have told an angel that his "great and long desyre hath byn to be hable to read those tables of Soyga". Dee lost his precious copy of the "Book of Soyga" (but then managed to find it again): when subsequently Elias Ashmole owned it, he noted that its incipit (starting words) was "Aldaraia sive Soyga vocor...".

However, since Ashmole's day it was thought to have joined the serried, densely-stacked ranks of long-disappeared books and manuscripts, in the "blue-tinted gloom" of some mythical, subterranean library not unlike the "Cemetery of Lost Books" in Carlos Ruiz Zafon's novel "The Shadow of the Wind" (2004)...

Fast-forward 400 years to 1994, and what do you know? Just like rush hour buses, two copies of the "Book of Soyga" turn up at once, both found by Deborah Harkness. Rather than searching for "Soyga", she searched for its "Aldaraia..." incipit: which is, of course, what you were supposed to do (in the bad old days before the Internet).

It is a strange, transitional document, neither properly medieval (the text has few references to authority) nor properly Renaissance. There are some mysterious books referenced, such as the Liber Sipal and the Liber Munob: readers of my book "The Curse of the Voynich" may recognize these as simple back-to-front anagrams (Sipal = Lapis [stone], Munob = Bonum [Good], Retap Retson = Pater Noster [our Father]). In fact, Soyga itself is Agyos [saint] backwards.

But what was the secret hidden behind the 36 mysterious "tables of Soyga" that had vexed John Dee so? 36x36 square grids filled with oddly patterned letters, they look like some kind of unknown cryptographic structure. Might they hold a big secret, or might they (like many of Trithemius' concealed texts) just be nonsense, a succession of quick brown foxes endlessly jumping over lazy dogs?

• oyoyoyoyoyoyoyoyoyoyoyoyoyoyoyoyoyoy
  rkfaqtyoyoyoyoyoyoyoyoyoyoyoyoyoyoyo
  rxxqnkoyoyoyoyoyoyoyoyoyoyoyoyoyoyoy
  azzsxbqtyoyoyoyoyoyoyoyoyoyoyoyoyoyo
  sheimasddtguoyoyoyoyoyoyoyoyoyoyoyoy
  eyuaoiismspkfaqtyoyoyoyoyoyoyoyoyoyo
  enlxflfudzrxxqnkoyoyoyoyoyoyoyoyoyoy
  sxcahqczfbtfzsxbqtyoyoyoyoyoyoyoyoyo
  azepxhheurgmyknqnkoyoyoyoyoyoyoyoyoy
  rlbriyzycuyddpotxbqtyoyoyoyoyoyoyoyo
  ryrezabirhdiszeknqnkoyoyoyoyoyoyoyoy
  ogzgfceztqalpntsxhssyoyoyoyoyoyoyoyo
  opnxxsnodxqhuekknykkoyoyoyoyoyoyoyoy
  rcqsfueesfsqrqgqrossyoyoyoyoyoyoyoyo
  roauxmdkkxkhyhmpzqphdtgtguoyoyoyoyoy
  aqxmudiamubkoqifbszktdmspkfaqtyoyoyo
  sazoesrmlrnaqnzhgabmsmlpeahfsddtguoy
  ....................................
  (etc)

Jim Reeds, one of the great historical code-breakers of modern times, stepped forward unto the breach to see what he could make of these strange tables: he transcribed them, ran a few tests, and (thank heavens) worked out the three-stage algorithm with which they were generated.

Stage 1: fill in the 36-high left-hand column (which I've highlighted in blue above) with a six-letter codeword (such as 'orrase' for table #5, 'Leo') followed by its reverse anagram ('esarro'), and then repeat them both two more times

Stage 2: fill each of the 35 remaining elements in the top line in turn with ((W + f(W)) modulo 23), where W = the element to the West, ie the preceding element. The basic letter numbering is straightforward (a = 1, b = 2, c = 3, ... u = 20, x = 21, y = 22, and z = 23), but the funny f(W) function is a bit arbitrary and strange:-

• x f(x) x f(x) x f(x) x f(x)
  a...2, g...6, n..14, t...8
  b...2, h...5, o...8, u..15
  c...3, i..14, p..13, x..15
  d...5, k..15, q..20, y..15
  e..14, l..20, r..11, z...2
  f...2, m..22, s...8

Stage 3: fill each row in turn with ((N + f(W)) modulo 23), where N = the element to the North, ie the element above the current element.

For example, if you try Stage 2 out on 'o', (W + f(W)) modulo 23 = (14 + 8) modulo 23 = 22 = 'y', while (22 + 15) modulo 23 = 14 = 'o', which is why you get all the "yoyo"s in the table above.

And there (bar the inevitable miscalculations of something so darn fiddly, as well as all the inevitable scribal copying mistakes) you have it: the information in the Soyga tables is no more than the repeated left-hand column keyword, plus a rather wonky algorithm.

You can read Jim Reeds paper here: a full version (with diagrams) appeared in the pricy (but interesting) book John Dee: Interdisciplinary essays in English Renaissance Thought (2006). The End.

Except... where exactly did that funny f(x) table come from? Was that just, errrm, magicked out of the air? Jim Reeds never comments, never remarks, never speculates: effectively, he just says 'here it is, this is how it is'. But perhaps this f(x) sequence is in itself some kind of monoalphabetic or offseting cipher to hide the originator's name: Jim is bound to have thought of this, so let's look at it ourselves:-

• 1.2.3.4..5.6.7.8..9.10.11.12.13.14.15.16.17.18.19.20.21.22.23
  2.2.3.5.14.2.6.5.14.15.20.22.14..8.13.20.11..8..8.15.15.15..2

If we discount the "2 2" at the start and the "8 8 15 15 15 2" at the end as probable padding, we can see that "14" appears three times, and "5 14" twice. Hmm: might "14" be a vowel?

• 2 3 5 14 2 6 5 14 15 20 22 14 8 13 20 11 8
• a b d n a e d n o t x n g m t k g
• b c e o b f e o p u y o h n u l h
• c d f p c g f p q x z p i o x m i
• d e g q d h g q r y a q k p y n k
• e f h r e i h r s z b r l q z o l
• f g i s f k i s t a c s m r a p m
• g h k t g l k t u b d t n s b q n
• h i l u h m l u x c e u o t c r o
• i k m x i n m x y d f x p u d s p
• k l n y k o n y z e g y q x e t q
• l m o z l p o z a f h z r y f u r
• m n p a m q p a b g i a s z g x s
• n o q b n r q b c h k b t a h y t
• o p r c o s r c d i l c u b i z u
• p q s d p t s d e k m d x c k a x
• q r t e q u t e f l n e y d l b y
• r s u f r x u f g m o f z e m c z
• s t x g s y x g h n p g a f n d a
• t u y h t z y h i o q h b g o e b
• u x z i u a z i k p r i c h p f c
• x y a k x b a k l q s k d i q g d
• y z b l y c b l m r t l e k r h e
• z a c m z d c m n s u m f l s i f
  

Nope, sorry: the only word-like entities here are "tondean", "catsik", and "zikprich", none of which look particularly promising. This looks like a dead end... unless you happen to know better? ;-)

A final note. Jim remarks that one of the manuscripts has apparently been proofread, with "f[letter]" marks (ie fa, fb, fc, etc); and surmises that the "f" stands for "falso" (meaning false), with the second letter the suggested correction. What is interesting (and may not have been noted before) is that in the Voynich Manuscript, there's a piece of marginalia that follows this same pattern. On f2v, just above the second paragraph (which starts "kchor...") there's a "fa" note in a darker ink. Was this a proof-reading mark by the original author (it's in a different ink, so this is perhaps unlikely): or possibly a comment by a later code-breaker that the word / paragraph somehow seems "falso" or inconsistent? "kchor" appears quite a few times (20 or so), so both attempted explanations seem a bit odd. Something to think about, anyway...

Dots for vowels, revisited...

One very early cipher involved replacing the vowels with dots. In his "Codes and Ciphers" (1939/1949) p.15, Alexander d'Agapeyeff asserts that this was a "Benedictine tradition", in that the Benedictine order of monks (of which Trithemius was later an Abbot) had long used it as a cipher. The first direct mention we have of it was in a ninth century Benedictine "Treatise of Diplomacy", where it worked like this:-

• i = .
• a = :
• e = :.
• o = ::
• u = ::.

"R:.:lly", you might well say, "wh:t : l:::d ::f b::ll::cks" (and you'd be r.ght, ::f c::::.rs:.). But for all its uselessness, this was a very long-lived idea: David Kahn's "The Codebreakers" (1967) [the 1164-page version, of course!] mentions the earlier St Boniface taking a dots-for-vowels system from England over to Germany in the eighth century (p.89), a "faint political cryptography" in Venice circa 1226, where the vowels in a few documents were replaced by "dots or crosses" (p.106), as well as vowels being enciphered in 1363 by the Archbishop of Naples, Pietro di Grazie (p.106).

However, perhaps the best story on the dots-for-vowels cipher comes from Lynn Thorndike, in his "History of Magic & Experimental Science" Volume III, pp.24-26. In 1320, a Milanese cleric called Bartholomew Canholati told the papal court at Avignon that Matteo Visconti's underlings had asked him to suffumigate a silver human statuette engraved with "Jacobus Papa Johannes" (the name of the Pope), as well as the sigil for Saturn and "the name of the spirit Amaymom" (he refused). He was then asked for some zuccum de napello (aconite), the most common poison in the Middle Ages (he refused). He was then asked to decipher some "'experiments for love and hate, and discovering thefts and the like', which were written without vowels which had been replaced by points" (he again refused). The pope thought it unwise to rely on a single witness, and sent Bartholomew back to Milan; the Viscontis claimed it was all a misunderstanding (though they tortured the cleric for a while, just to be sure); all in all, nobody comes out of the whole farrago smelling of roses.

(Incidentally, the only citation I could find on this was from 1972, when William R. Jones wrote an article on "Political Uses of Sorcery in Medieval Europe" in The Historian: clearly, this has well and truly fallen out of historical fashion.)

All of which I perhaps should have included in Chapter 12 of "The Curse of the Voynich", where I predicted that various "c / cc / ccc / cccc" patterns in Voynichese are used to cipher the plaintext vowels. After all, this would be little more than a steganographically-obscured version of the same dots-for-vowels cipher that had been in use for more than half a millennium.

As another aside, I once mentioned Amaymon as one of the four possible compass spirits on the Voynich manuscript f57v (on p.124 of my book) magic circle: on p.169 of Richard Kieckhefer's "Magic in the Middle Ages", he mentions Cecco d'Ascoli as having used N = Paymon, E = Oriens, S = Egim, and W = Amaymen (which is often written Amaymon). May not be relevant, but I thought I'd mention it, especially seeing as there's the talk on magic circles at Treadwell's next month (which I'm still looking forward to).

Finally, here's a picture of Voynichese text with some annotations of how I think it is divided up into tokens. My predictions: vowels are red, verbose pairs (which encipher a single token) are green, numbers are blue, characters or marks which are unexpected or improvised (such as the arch over the '4o' pair at bottom left, which I guess denotes a contraction between two adjacent pairs) are purple. Make of it all what you will!

Pigpen cipher gravestone...

Here's a nice piece of historical cryptography I hope you'll appreciate: a piece of "pigpen ciphertext" engraved on a 1792 New York gravestone, on Flickr. There's another (not quite so good) image of the same thing most of the way down on this page on forgotten New York sights. But before you click anywhere, try and decode it for yourself from the transcription I've put above!

Hint: the single-dot box appears four times, and is (just as you'd expect) a vowel. :-)

If you want to know more, the article mentioned on the page was from the Meyer Berger column on page 24 of the New York Times, January 2nd 1957, and is in the paper's online archive: they charge non-subscribers $3.95 for a PDF, if you happen to be reaaaaaaally interested. But maybe this is a sensible place to stop...

Nazi ciphers and Voynich novels...

Two big news stories today, both of them far more amazing than fiction...

Firstly, a story about a Nazi cipher, allegedly by Martin Bormann detailing the location of a cache of gold and diamonds hidden in 1945. Dutch journalist Karl Hammer has written a book called De tranen van de wolf (The Tears of the Wolf), published by Elmar, which is basically a dossier of his notes. Much copied in the blogs, but here's the source page (with pictures of the so-called "runic" cipher hidden in the rests in a piece of sheet music, as well as a series of numerals at the bottom which is doubtless discussed in the book). 224 pages, 17.50 euros here.

And secondly, a fascinating Wall Street Journal story about a cache of microfilms of early copies of the Qur'an being unearthed. For decades it was thought that they had been destroyed in the bombing of the Bavarian Academy of Science (which was housed in a former Jesuit college in Munich) in 1944, but the truth turns out to be much more subtle and complex.

It's one of those strange things: if a novelist had used either of these two stories for their plots, he/she would probably be ridiculed for over-egging their cake, for going too far. I mean, Nazis treasure and a cipher hidden in music, or Nazis and the lost origins of Islam, really?

Incidentally, I've mentioned how my stomach turns when I see the word "Jesuit" pop up in Voynich-themed novels, and - as a historical literary commentary on the penny dreadful Jesuit cliche - that's perfectly OK. But as with every rule of thumb, there is bound to be an exception, and perhaps Enrique Joven's book is that: now that I found a better description of it, I can see that the Jesuit connection he appropriates is probably based on real history (I'm guessing the movement around Europe of the various Jesuit trunks containing the VMs), and so for a surprising change his Jesuit plot connection there actually makes good sense.

But this is really not to endorse every other Jesuit/VMs so-called plot "twist" out there: repeat after me, "it almost certainly predates the Jesuit Order, which was founded in 1534"... *sigh*