The ADFGVX cipher

The ADFGVX cipher was the German Army's field cipher in the last months of the First World War. A Polybius square first turned a message into pairs of the six letters A, D, F, G, V and X, and a columnar transposition then scrambled the pairs. Two different kinds of scrambling, one after the other, made it the hardest hand cipher of its day. The French cryptanalyst Georges Painvin broke it in June 1918 by working through the transposition.

Try it

Nothing you type here leaves your browser.

The first box is the 6×6 square (36 letters and digits, or a keyword that starts one), and the second is the transposition keyword. To decrypt, paste a ciphertext made only of the letters A, D, F, G, V and X.

Two stages, one after the other

1. Substitution (fractionation). A 6×6 square holds the 26 letters and ten digits in a scrambled order, with rows and columns labeled A, D, F, G, V and X. Each plaintext character becomes the labels of its row and column. With the square in the picture, A becomes DG and T becomes XG.
2. Transposition. The pairs of letters are written out in rows under a keyword. The columns are then read off top to bottom in the alphabetical order of the keyword's letters and joined into the ciphertext.

Say you encrypt ATTACK AT 1200AM with the square from the picture and the transposition keyword PRIVACY. The 14 plaintext characters become 28 letters: DG XG XG DG GV GD DG XG DV FD AF AF DG DD. Written in four rows of seven under PRIVACY and read column by column in the order A, C, I, P, R, V, Y (the key's letters in alphabetical order), they give XDFGGDDDXVDFDGXFGGGAGGVDDGAD.

The six letters were picked because they sound different in Morse code, which cut down a radio operator's errors. Messages went out by radio in Morse, and one error in a transposition cipher spoils far more than one character.

The first version

The cipher started as ADFGX in March 1918, with a 5×5 square (I and J shared a cell) and no digits. In June the square grew to 6×6 to carry digits, and the extra letter V joined the set. The tool below does the original.

Nothing you type here leaves your browser.

It reproduces the textbook example, where attack at once with the key CARGO gives FAXDFADDDGDGFFFAFAXAFAFX.

Who made it, and who broke it

Lieutenant Fritz Nebel of the German Army's signal corps devised it and introduced it in March 1918 as the "Secret Cipher of the Radio Operators 1918" (Geheimschrift der Funker 1918), shortly before the German spring offensives. ADFGX went into use on 1 March 1918 on the Western Front, and ADFGVX followed from 1 June 1918, on both the Western and Eastern Fronts. The keys, often a couple of dozen characters, changed daily.

The French Army's cryptanalysis bureau put Lieutenant Georges Painvin to work on it. He solved ADFGX in April 1918 and ADFGVX in early June. His method was to look for messages that began with predictable words and find repeating patterns. Then he used frequency counts to tell which transposition columns held row letters ("top" letters) and which held column letters ("side" letters), paired them up and recovered the transposition. Once he had the key for one message, he could read every other message sent with the same key, and a key lasted a day. People often say his work helped stop the German offensive of 1918, but historians dispute that, since the offensive may already have stalled when the first solutions arrived.

Strong in combination, weak in parts

Each step on its own is weak. The square, as a Polybius square, is a substitution that leaves the letter statistics intact. The transposition, as a columnar transposition, leaves the letter counts alone and only moves them. Together, though, the pair of letters for one plaintext character no longer sit side by side, and the ciphertext holds only six symbols, whose counts come out flat. It's a product cipher, two simple operations whose combination is much stronger than either. That's the principle behind modern block ciphers (AES repeats substitution and permutation ten times).

The key space is large. A 36-character square can be arranged in 36! ways, about 3.7 × 10⁴¹, and a 10-letter transposition keyword can be ordered in 10! = 3,628,800 ways, giving about 1.4 × 10⁴⁸ keys. A search didn't break it. Structure did. The transposition leaves the ciphertext's six symbols in columns of equal length, and the letters A, D, F, G, V and X don't occur equally often in the top and side positions of the pairs, because plaintext letters aren't equally common. Separate the two kinds, put the columns back in order, and the problem becomes a simple substitution of pairs.

A modern program can search for the transposition by hill climbing, as it can for the Playfair and substitution ciphers.

The code

// ADFGVX encryption. `square` is the 36-character 6x6 square (letters and digits) row by row; `keyword` is the transposition key.
function adfgvx(text, square, keyword) {
  var labels = 'ADFGVX', pairs = '';
  text.toUpperCase().replace(/[^A-Z0-9]/g, '').split('').forEach(function (c) {      // 1. each character becomes two labels
    var i = square.indexOf(c);
    pairs += labels[Math.floor(i / 6)] + labels[i % 6];
  });
  var key = keyword.toUpperCase().replace(/[^A-Z]/g, '').split('');
  var order = key.map(function (c, i) { return [c, i]; })                             // 2. columns in alphabetical order of the key,
    .sort(function (a, b) { return a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : a[1] - b[1]; }); // ties broken left to right
  return order.map(function (col) {
    var out = '';
    for (var i = col[1]; i < pairs.length; i += key.length) out += pairs[i];          // one column, top to bottom
    return out;
  }).join('');
}