The autokey cipher

The autokey cipher fixes the main weakness of the Vigenère cipher, the repeating key, by letting the message supply the rest of its own key. You pick a short priming word, and after that each letter of the plaintext becomes the key for a letter further along. The key is as long as the message and never repeats, which defeats the methods that broke Vigenère, although it brings problems of its own.

Try it

Nothing you type here leaves your browser.

Decrypting works one letter at a time, because each recovered letter extends the key for the letters still to come.

How the key grows

Take the message ATTACKATDAWN and the priming key QUEENLY. Write the key first and let the plaintext follow it. The keystream is QUEENLY ATTACKATDAWN, and the first twelve of those letters get used. Each plaintext letter and key letter are added, as in Vigenère.

The ciphertext is QNXEPVYTWTWP. To decrypt it, the receiver knows only QUEENLY. The first seven ciphertext letters decrypt as in Vigenère and give ATTACKA. Those seven plain letters are the key for the next seven ciphertext letters, which give TDAWN, and so on for as long as the message runs. It's a stream cipher in which the stream is the plaintext.

Another published example gives the same result in both directions. The plaintext MEETATTHEFOUNTAIN with the primer KILT becomes WMPMMXXAEYHBRYOCA, and the tool above agrees.

History

Blaise de Vigenère described an autokey cipher in 1586 in his Traicté des chiffres, using a single agreed letter to start the key. The cipher people now call "Vigenère", with its repeating keyword, is a different idea by Bellaso, and the nineteenth century hung Vigenère's name on the wrong one. Later forms replaced the single priming letter with a short word and a tabula recta.

There are two forms. In text autokey, as here, the key continues with the plaintext. In key autokey, each new key letter comes from earlier key letters. People usually mean text autokey when they say "autokey".

Why Kasiski and the index of coincidence fail

Both attacks on Vigenère depend on a key that repeats. A repeating key makes repeats in the ciphertext at distances that are multiples of the key length, and it makes columns that each have a single shift. Autokey has no period. The key is as long as the message and different at every position, so there are no telltale repeats and no columns to cut. You can see it in the numbers. The key-length test from the Vigenère page gave a spike of 0.078 at the true length of 7 for a message encrypted with DICKENS. Run the same 217-letter text through autokey with QUEENLY and the average column score for every length from 1 to 14 stays between 0.040 and 0.053, with no spike anywhere.

How it's broken anyway

The weakness is the one that makes autokey work, which is that the key is English. An attacker who guesses a likely word can slide it along the message and read off the key under it. Take the ciphertext QNXEPVYTWTWP and guess that the message begins ATTACK. Subtract each guessed plaintext letter from the ciphertext letter above it, and the key letters come out as QUEENL. That isn't random, since QUEEN is a word, so the guess looks right. Now guess that the primer is QUEENLY, seven letters, and decrypt the first seven letters as plain Vigenère. They give ATTACKA, which agrees with the guess, and the plaintext letters now extend the key through the rest of the message.

Attackers automate the same idea. For each primer length, they slide common words along the message and keep the guesses that produce English in both the plaintext and the key. Correct guesses reveal their neighbors, and the effect cascades.

One bad letter spoils a chain

There's a practical flaw too. Plain letters feed the key, so a single error in the ciphertext, whether a typing slip or a noisy radio, gives a wrong plaintext letter. That letter becomes a wrong key letter one primer-length on, which gives another wrong plaintext letter, and so on down the message. With a seven-letter primer, one letter in every seven goes wrong. Modern stream ciphers and block-cipher modes face the same question, and designers answer it differently. OFB mode keeps the key stream independent of the message, so an error stays where it happens, while cipher feedback mode feeds the ciphertext back into the key, as autokey feeds in the plaintext.

The code

// Autokey: the key is the keyword followed by the plaintext itself, so it is as long as the message and never repeats.
function autokey(text, keyword, decode) {
  var stream = keyword.toUpperCase().replace(/[^A-Z]/g, '').split('').map(function (c) { return c.charCodeAt(0) - 65; });
  var i = 0;
  return text.replace(/[a-z]/gi, function (ch) {
    var base = ch <= 'Z' ? 65 : 97, x = ch.charCodeAt(0) - base, s = stream[i++];
    var y = (decode ? x - s + 26 : x + s) % 26;
    stream.push(decode ? y : x);                           // decrypting: the letter just recovered extends the key
    return String.fromCharCode(y + base);
  });
}

Common questions