The affine cipher

The affine cipher turns each letter into a number, multiplies it by one secret number, adds another and wraps around at 26. In symbols, the letter x becomes ax + b modulo 26. It's the Caesar cipher with a multiplication added, and it has 312 keys, which a computer tries in an instant.

Try it

Nothing you type here leaves your browser.

Only some values of a are offered, the ones that share no factor with 26. The reason is below.

Encrypting a letter

Number the letters A = 0 to Z = 25. To encrypt, compute y = (a·x + b) mod 26, and the result is the number of the cipher letter. Here's one letter, H, through a = 5 and b = 8:

Do that for each letter of AFFINE CIPHER and you get IHHWVC SWFRCP. Both Fs become H, since a given plaintext letter always becomes the same ciphertext letter. That matters when we get to breaking it.

Why a can't share a factor with 26

For decryption to work, different letters must give different results. Try a = 2 with b = 0 and the alphabet maps to ACEGIKMOQSUWYACEGIKMOQSUWY. A and N both become A, B and O both become C, and so on. If two letters share a ciphertext letter, the receiver can't know which was meant. With a = 13 it's worse, because every letter becomes either A or N. To rule this out, a and 26 must have no common factor except 1, which leaves twelve choices: 1, 3, 5, 7, 9, 11, 15, 17, 19, 21, 23 and 25. Together with the 26 values of b that gives 12 × 26 = 312 keys, and one of them (a = 1, b = 0) leaves the text unchanged.

Decrypting needs an inverse

To undo the multiplication you divide by a. In arithmetic modulo 26, "dividing" means multiplying by the number a⁻¹ for which a·a⁻¹ leaves a remainder of 1 when divided by 26. Decryption is then x = a⁻¹(y − b) mod 26. The twelve valid values of a have these inverses:

With a = 5 the inverse is 21, because 5 × 21 = 105 = 4 × 26 + 1. The same idea makes the three-pass protocol and RSA work, a multiplication that a second one can undo. The extended Euclidean algorithm finds such inverses for huge numbers, and for 26 you can simply try them.

Where it comes from

The affine cipher is mainly a teaching cipher. It shows up in cryptography courses as the smallest example of a cipher built on modular arithmetic, and because two older ciphers are special cases of it. a = 1 is the Caesar cipher, and a = 25, b = 25 is Atbash. No well-known historical use of it as a working system exists, and it doesn't need one to be worth knowing.

Breaking it

• Try all 311 other keys. There are only 312 in all. Run each, score the result against English letter frequencies the way the Caesar decoder does, and the right key stands out.
• Solve for the key from two letters. This is the neat way. Suppose the commonest letters in the ciphertext are C and Z, and you guess they stand for E and T. Then E (4) became C (2) and T (19) became Z (25). Subtracting the two equations eliminates b: a(19 − 4) ≡ 25 − 2, so 15a ≡ 23 (mod 26). The inverse of 15 is 7 (15 × 7 = 105 = 4 × 26 + 1), so a = 23 × 7 = 161 ≡ 5. Then b = 2 − 5 × 4 = −18 ≡ 8. Two letters recover the key a = 5, b = 8, which shows the affine cipher offers no more security than a handful of equations.

Both methods work because the cipher is a simple substitution. It maps letters to letters, one to one, so letter frequencies carry straight through.

The code

// Affine cipher: letter x (A=0 ... Z=25) becomes (a*x + b) mod 26. `a` must share no factor with 26.
function affine(text, a, b, decode) {
  var inv = 0;
  if (decode) {                                            // find a^-1, the number with a * inv = 1 (mod 26)
    for (var i = 1; i < 26; i++) if (a * i % 26 === 1) inv = i;
    if (!inv) throw new Error('a has no inverse mod 26');
  }
  return text.replace(/[a-z]/gi, function (ch) {
    var base = ch <= 'Z' ? 65 : 97, x = ch.charCodeAt(0) - base;
    var y = decode ? inv * (x - b + 26) : a * x + b;
    return String.fromCharCode((y % 26 + 26) % 26 + base);
  });
}

Common questions