“F1.7 and D2: autokey on one free alphabet, every lag K4 fits (ciphertext and plaintext autokey, three forms), each decided by an alphabet climb against copies climbed one at a time”
F1.7 (D2's last re-cost, issue #77). 0149 decided autokey on one unknown alphabet exactly and left the lags K4 fits (103 cells over ciphertext/plaintext autokey and three forms) blocked by cost at F1.5's design-2 decider (about an hour per cell). Under autokey the key is the text itself, so the alphabet alone (plus, for plaintext autokey, one primer letter per chain the known letters do not reach) fixes the reading: a climb over the alphabet is much cheaper than design 2's alphabet-and-key tempering. Here that climb is written (compiled), its power measured on plants drawn from K4's own fitting cells, and every one of K4's cells decided against copies climbed one at a time, in the same run.
In an autokey cipheran autokey cipher A cipher that uses the message itself, or the scrambled text itself, as the secret word, each letter enciphered with the letter a fixed distance before it.the messagethe message The 97 letters of English that Jim Sanborn wrote and enciphered. (or the ciphertextthe carved letters The 97 letters cut into the copper at the CIA, shown at the top of every experiment page.) becomes its own key after a short starter. With a scrambled alphabet nobody knows, about a hundred settings agree with the 24 known lettersthe known letters Sanborn has confirmed that positions 22 to 34 of the message read EASTNORTHEAST and positions 64 to 74 read BERLINCLOCK.. For each we search for the scrambled alphabet that makes K4 read most like English, and do the same on scrambled copiesa shuffled control The same experiment run on the carved letters shuffled into a random order. of K4 that agree with the known letters equally well. The real answer should read better than all its copies.
Words in the margin are defined on the glossary page.
1.1
The method at work
The carved letters go in at the top; the reading comes out at the bottom.
the idea
F1.7: an autokey cipher (the message or the ciphertext becomes the key) on a scrambled alphabet; 130 cells agree with the 24 known letters once plaintext autokey's chains are written out in full.
the check
Each cell: one search on K4, then fitting scrambled copies one at a time; ten shuffles of K4 put through the same test give the null.
the bound
K4 beats all 12 copies in 7 cells, inside the stand-ins (p 0.64); three cells 0149 called fit are dead. Planted messages found only 8 of 24 and 4 of 24: a weak test, run at its power.
2
Experiment lineage
What this experiment was built on, from the lineage page: 6 experiments before it, back to the root of its line. Its number is in bold.
keptreverted, in its family's colour×error or timeoutreverted under today's rulesbuilt on a parent in the same familybuilt on a parent in another family
3
Best candidate against the known letters
This experiment produced no candidate: the search ruled everything out before a full text was built. Its product is the bounded negative under Result and bounds below.
4
Walkthrough, by hand
Redo the method on a few letters with pencil and paper.
Pick a cell: plaintext autokey, Beaufort form, lag 33, with an unknown scrambled alphabet.
In that system each plain letter becomes the key 33 places later, so once the alphabet is fixed, a chain of places 33 apart is fixed by its first letter.
Chains holding a known letter are fixed by it; the others get a free starting letter.
Search alphabets (and free starts) for the most English-looking reading that keeps all 24 known letters.
Shuffle K4 until a shuffle also fits the cell, and search it the same way; repeat up to 12 times, stopping when a shuffle reads as well as K4.
Count the cells where K4 beat all 12; chance gives about one in 13.
the worksheet: the first steps by hand, on squared paper
5
Worked example, generated
The same steps run by the code on the real letters.
F1.7: autokey on one unknown alphabet.
ciphertext autokey, lag L: key letter at place i = carved letter at place i - L
so x(plain_i) = x(carved_i) - x(carved_{i-L}) on the unknown alphabet x: the alphabet alone fixes places L+1..97
plaintext autokey, lag L: key letter = plain letter L places back; a chain i, i+L, i+2L ... is fixed by x and its first letter
per cell: climb x for the most English reading; climb scrambled copies that fit the same cell; K4 must beat them all.
6
Hypothesis, for a cryptanalyst
Family, key space, the constraint under test, and the clues it reads.
C11a (NSA 1992: 'plain-text auto-key'; NSA 2007: plaintext and ciphertext autokey tried without cribs), C27(c) (any alphabet), C1(b). Model as 0149: x a bijection letters -> Z26; forms V x(c) = x(p) + x(k), B x(c) = x(k) - x(p), R x(c) = x(p) - x(k); k_i = c_{i-L} (ciphertext autokey) or p_{i-L} (plaintext autokey), primer free. Ciphertext autokey: the reading at places L+1..97 is fixed by x alone, the first L letters by single-use primer letters (open: not scored). Plaintext autokey: a chain i, i+L, i+2L... is fixed by x and its first letter; a chain holding a known place has that letter forced (back-propagated), the others are free and climbed. The full chain condition is enforced (0149's equations used only adjacent known pairs), so a cell 0149 called fit may turn out dead here (three are), and cells 0149 skipped for want of adjacent known pairs get checks (30 fit); both are reported. Copies: shuffles of the text that 0149's exact decider fits in the same cell.
7
Prediction
Written before the run; the result decides it.
Low power, measured: ciphertext-autokey plants found at most 1 in 4 (the desk climbs never reached a plant's own score there); plaintext-autokey plants about 1 in 3 overall, better at short lags where the checks pin the alphabet. Some of 0149's 103 cells die under the full chain equations. K4's rate of cells above all 12 copies inside the ten stand-ins' spread. Zero candidates.
8
Method
Cells: every (kind, form, lag) where K4 fits the exact decider, now with plaintext autokey's chains in full (consecutive known places of one chain linked through the carved letters between them; 0149 used only pairs L apart), solved by 0149's exact solver.
Per cell (one job, own seed): climb K4 once; then draw shuffles of K4 that fit the same cell, climb each, stop at the first at or above K4; at most 12, escalated to 100 where K4 beats all 12.
Climb: plaintext autokey at lags up to 12, check-keeping tempering from the exact witness with repair swaps (0139's move); every other cell, tempering with a fixed penalty per known letter out of place, recording only states with all 24 in place. Ciphertext autokey readings are scored on places L+1 to 97 (the first L come from single-use primer letters).
Plants: per kind 12 clean and 12 Sanborn-style messages enciphered on cells drawn from K4's, through the same decision without escalation; power per kind and per climb.
Ten shuffles of K4 stand in for K4 (seed 2561): each decides its own fitting cells through the same procedure without escalation. Verdict: K4's rate of cells above all 12 copies ranked among the stand-ins' rates (0254, 0255: the null is a spread over texts, not Binomial(n, 1/13)); the top readings listed.
9
Result and bounds
The harness's record: candidates, gates, loss, and the negative result this experiment leaves behind.
0candidates returned
0passed every gate
0/24known letters, best
–lowest loss
nonechampion before
F1.7: 130 cells; K4 valid readings 130; above all 12 copies in 7 (fair test 10.0); among 10 stand-ins 6 at or above K4's rate (p 0.64), above all 100 in 0; plant power ct/clean 6/12, ct/sanborn 2/12, ct_tempering 8/24, pt/clean 1/12, pt/sanborn 3/12, pt_tempering 4/24. No candidate returned (ciphertext-autokey readings have open primer letters; per-cell copies do not account for the cells searched).
What was searched, as the harness recorded it.
item
F1.7 (D2's last re-cost; the cells decided in the same run)
decider used
plaintext autokey at lags 1-12: check-keeping parallel tempering (16 replicas x 300 rounds x 1000 moves, T 0.1->0.002; every replica starts from the exact solver's witness of the full chain equations; a swap that breaks a check is repaired by a second swap that restores every check, as 0139, or dropped); every other cell: parallel tempering with a fixed penalty 0.6 per known place out of place (16 replicas x 300 rounds x 1000 moves, T 0.15->0.003), only states with every known place right recorded
desk tests
2026-10-29, before the run: the draft's annealing ('sa', penalty 0.04 ramped) never reached a state with all 24 in place at plaintext lags 6-12 and left the true alphabet when started on it; the full-chain witness and the check-keeping moves read 2 of 3 plants at lag 6 exactly; on ciphertext autokey (lags 34-70) no variant (sa, keep, tempering at penalties 0.2/0.6/2.0, up to 5x longer) reached the true reading's score (plants -4.2, climbs -5.5 to -6.3): low power is expected there and is measured here
modal cost estimate
11 texts (K4 and 10 stand-ins) x about 100 cells x about 4 climbs, plus 48 plants: 'keep' cells (plaintext autokey to lag 12) about 4 min per climb, others about 3 s: about 35 core-hours, about $2 of Modal credit (about $11.9 left after the margin)
decider draft
compiled annealing over the alphabet (and free plaintext-autokey chain starts): 20 restarts x 500000 moves, T 0.15->0.003, penalty per known letter out of place 0.04 raised 50-fold through each run; only states with every known letter in place count; ciphertext autokey scored on places L+1..97 (the first L letters come from single-use primer letters and are open)
copies
shuffles 0149's exact decider fits in the same cell, climbed one at a time; stop at the first at or above K4, at most 12, escalated to 100 for K4
0149 wrote plaintext-autokey equations only for known places exactly L apart, and skipped cells with none; the full chain equations link consecutive known places of a chain through the carved letters between them, so cells 0149 never decided get checks (and fit), and three cells it called fit are dead
per kind
ct
cells
43
no valid reading
0
above all 12
4
pt
cells
87
no valid reading
0
above all 12
3
k4 cells with a valid reading
130
k4 above all 12
7
expected 12
10
binomial p 12
0.88
k4 above all 100
0
expected 100
1.29
binomial note
the binomial p assumes cells are independent draws at 1/13; 0254-0255 showed each text has its own rate, so the verdict is K4's rank among the stand-ins