Experiment 2

“Ciphertext autokey is decided by the cribs at every lag and convention”

New root. Replaces keyword search with a decidable test the cribs settle outright.

revertedstatus
a new rootparents
0 stime, all phases
0candidates
0/24known letters
unclocked
1

The experiment method

What the method does with the 24 known letters.

In an autokey cipheran autokey cipher A cipher that uses the message itself, or the scrambled text itself, as the secret word, each letter enciphered with the letter a fixed distance before it. the secret wordthe secret word The word or string a cipher needs besides the method. only covers the first few letters. After that, the scrambled message itself becomes the key: to hide the twentieth letter you use the scrambled letter a fixed distance backthe lag In an autokey cipher, how far back the key letter sits from the letter being enciphered.. Because we know the scrambled textthe carved letters The 97 letters cut into the copper at the CIA, shown at the top of every experiment page. and we know 24 letters of the real message, we can check every possible distance back. If one works, most of the messagethe message The 97 letters of English that Jim Sanborn wrote and enciphered. falls out with no secret word at all. If none works, this whole kind of cipher is off the tablethe table The right-hand half of the sculpture, 26 rows of the alphabet each shifted one place further, starting from the word KRYPTOS. for good.

Words in the margin are defined on the glossary page.

1.1

The method at work

The carved letters go in at the top; the reading comes out at the bottom.

OBKRUOXOGHULBSOLIFBBWEASTNORTHEASTOTWTQSJQSSEKZZWATJKLUDIAWINFBBERLINCLOCKWGDKZXTJCDIGKUHUAUEKCARIN: THE COPPER, ALL 97 LETTERS, THE 24 KNOWN PLACES IN ACCENTkey: the carved letter 7 places backOBKRUOXOGHULBSOLIFBBWFLRVQQPRNGKSSOTWTQSJQSSEKZZWATJKLUDIAWINFBNYPVTTMZFPKWGDKZXTJCDIGKUHUwhat the known letter would carve, with that keyJXUJRGXJOFPKXWMXSBOLDAFVplace 64: B with key I carves W; the copper has N24 of 24 miss at lag 7OUT: NO READING; NO LAG SURVIVES, SO THE READING STAYS EMPTYEASTNORTHEASTBERLINCLOCK
the key row

In a ciphertext autokey, each letter is enciphered with the carved letter a fixed distance before it. Drawn here for distance 7: the key row is the copper shifted 7 places right.

the check row

Each known letter plus its key must give the carved letter. At distance 7, on the sculpture's table, 24 of 24 fail. One failure is enough to kill a distance.

the bound

The experiment ran every distance from 1 to 96 under all 24 ways of using the table: 2,304 pairs, 0 survivors. The family is closed.

2

Best candidate against the known letters

This experiment produced no candidate: the search ruled everything out before a full text was built. Its product is the bounded negative in section 7.

3

Walkthrough, by hand

Redo the method on a few letters with pencil and paper.

  1. Write the ciphertext in a row and number it 1 to 97.
  2. Pick a distance, say 7.
  3. Go to position 64, where the plaintext is B. Look seven back: position 57 is D.
  4. Under the sculpture's alphabet KRYPTOSABCDEFGHIJLMNQUVWXZ, B is at 8 and D is at 10; add them, 18, and read the 18th letter, M.
  5. The carved letter at 64 is N, not M, so distance 7 under this convention is wrong.
  6. Repeat for every crib position, every distance, and every way of indexing the alphabets. One surviving distance would decrypt the rest by itself.
the worksheet: the first steps by hand, on squared paper
THE LEDGER FOR LAG 7, SCULPTURE'S ALPHABET, LETTERS ADDED: DOES THE KNOWN LETTER CARVE THE COPPER?placeknownkey (7 back)known + keycarved22EOJF23ALXL24SIUR25TFJV26NBRQ27OBGQ28RWXP29TFJR30HLON31ERFG32AVPK33SQKS34TQXSplaceknownkey (7 back)known + keycarved64BIWN65EAMY66RWXP67LISV68INBT69NFOT70CBLM71LNDZ72OYAF73CPFP74KVVK24 crosses of 24: distance 7 is deadunder this way of using the table.The same sheet, redrawn for eachdistance from 1 to 96 and each of the 24ways of using the table, is the wholeexperiment.
4

Worked example, generated

The same steps run by the code on the real letters.

ciphertext autokey, lag 7, all alphabets KRYPTOS, Vigenere
alphabet: KRYPTOSABCDEFGHIJLMNQUVWXZ

pos  plain  key=c[pos-7]  idx(p)+idx(k)  predicted  carved
 64    B      I              8+15        W        N  x
 65    E      A             11+7         M        Y  x
 66    R      W              1+23        X        P  x
 67    L      I             17+15        S        V  x
 68    I      N             15+19        B        T  x
 69    N      F             19+12        O        T  x
5

Hypothesis, for a cryptanalyst

Family, key space, the constraint under test, and the clues it reads.

K4 is a ciphertext-autokey cipher: after a primer of length L, each key letter is the ciphertext letter L positions earlier, so c[i] = f(p[i], c[i-L]). The NSA tested this against the interval-7 property in 2007 without cribs (knowledge/05-attacks.md). With 24 known plaintext letters the test is exact: at every crib position i > L both p[i] and c[i-L] are known, so the convention either reproduces c[i] or it does not. We test all 24 conventions in kryptos.alphabets (plain, cipher and key alphabet each standard or KRYPTOS; Vigenere, Beaufort, variant Beaufort) at every lag 1 to 96. A convention and lag that fits all checkable cribs decrypts positions L+1 to 97 with no key at all. Clue register: C4(d) is not touched; this tests the NSA's own first hypothesis. Bounds: complete for this family under these conventions.

6

Prediction

Written before the run; the result decides it.

No convention and lag reproduces all checkable cribs; zero candidates pass the crib gate. The family is excluded, not merely unexplored.

7

Method

For each convention and each lag L in 1..96: for every crib position i with i > L, compute f(p[i], c[i-L]) and compare with c[i]. Record the number of checks and mismatches. For any (convention, L) with zero mismatches, decrypt positions L+1..97 from the ciphertext, fill positions 1..L with the crib letters where known and A elsewhere, and submit as a candidate with key_bits = 4.7*L for the primer.

8

Result and bounds

The harness's record: candidates, gates, loss, and the negative result this experiment leaves behind.

0candidates returned
0passed every gate
0/24known letters, best
–lowest loss
nonechampion before

A survivor must also reproduce the cribs inside the primer region, which the gate checks.

What was searched, as the harness recorded it.

family
ciphertext autokey
conventions
24
lags
1-96
pairs tested
2,304
survivors
0
decidability
exact at every crib position i > lag

How this experiment sits among the others is on the lineage page; its family's open hypotheses are on the families page.

Rendered from the record on 2026-10-18 12:26 UTC; updated after every experiment.
view on GitHub