The cipher that convicted Mary, Queen of Scots

The cipher that convicted Mary, Queen of Scots was cracked by a man who never had to break anything in transit. In July 1586 Mary, a prisoner in England for almost nineteen years, wrote a letter in cipher agreeing to a plan to kill Queen Elizabeth. Elizabeth's spymaster, Francis Walsingham, read it before its intended reader did, and it cost Mary her life. In 2023, more than four centuries later, three researchers announced they'd deciphered another 57 of her letters, which had sat in a French archive under the wrong label. Both stories teach the same thing: a cipher that can't protect a message from the people who carry it isn't protecting anything.

The Babington plot

Mary fled Scotland in 1568 and spent the rest of her life in English custody, a Catholic claimant to Elizabeth's throne and a magnet for conspiracies. By 1586 she was held at Chartley Hall in Staffordshire under her jailer Sir Amias Paulet, and her correspondence had been cut off. Walsingham saw his chance. His double agent Gilbert Gifford, arrested at Rye in 1585 and released to work in the plot, arranged with Paulet and a local brewer to carry messages to and from Mary in a watertight box inside a beer barrel. Mary and her supporters believed the channel was secret. It wasn't. Every letter went first to Walsingham's cipher secretary, Thomas Phelippes, a language and cipher expert quartered at Chartley, who deciphered and copied it, resealed it and sent it on.

The conspirator was Anthony Babington, a young Catholic gentleman. Phelippes decoded Babington's letter on July 7, 1586, a week before Mary received it on July 14. On July 17 she replied in cipher, and the reply, as Phelippes read it, ordered the assassination of Elizabeth. Phelippes kept the original and added a forged postscript asking for the names of the conspirators. John Ballard was arrested on August 4 and, under torture, implicated Babington. Babington and Ballard were executed on September 20, 1586. In October Mary was tried at Fotheringhay Castle, where Phelippes's translations of her letters were read out. She was beheaded on February 8, 1587, before some 300 witnesses.

That week's head start between Phelippes and Mary is the whole story in miniature. Babington's first move was read before the person he wrote to saw it, and every move afterward was Walsingham's to time. He let the correspondence run until the reply gave him what he wanted, an order in Mary's own cipher, and only then closed the trap. A tapped channel is worse than a broken one, because the people using it keep trusting it.

What kind of cipher it was

Mary's system was a nomenclator, the standard cipher of sixteenth-century diplomacy. It combines two things. One is a substitution alphabet, where each plain letter has a symbol. The other is a list of symbols for whole words and names, the ones most likely to appear, such as "Elizabeth", "pray" and "your Majesty". Most nomenclators also threw in meaningless symbols, nulls, to disturb the counts. It's a close relative of the simple substitution, and for the same reason of the later Great Cipher of the French kings. Its weakness is the one al-Kindi found centuries earlier: the symbol standing for "e" shows up about as often as "e" does, and an analyst with enough text can count them (al-Kindi and frequency analysis). Phelippes was that analyst, and he had a great deal of text.

Look at what actually failed, though. The cipher was probably good enough to hold off a casual reader. What betrayed Mary was how she used it: she sent a lot of text in one system, for months, through a channel her enemy controlled. Walsingham didn't need to break a message in transit, because he already had every one. Once Phelippes knew the system, he could add the forged postscript, which shows in 1586 what an interceptor can do to a message nobody authenticates (authenticated encryption). Neither side needed a breakthrough. One side needed patience, and the other made a mistake about who was listening.

The lost letters, 2023

Mary wrote a great many letters in cipher through nearly two decades of captivity, and most are lost. In 2023 a team announced that they'd found and decoded dozens more. George Lasry, a computer scientist and cryptographer who is part of the DECRYPT project on historical ciphers, worked with Norbert Biermann, a pianist and professor of music, and Satoshi Tomokiyo, a physicist and patents expert. They came from three different fields, which is common in this one. They were searching the digitized collections of the Bibliothèque nationale de France when they came across a set of enciphered documents cataloged as Italian, from the first half of the sixteenth century. The label was wrong. The text underneath turned out to be French, and clues such as verbs and adverbs in the feminine form (a woman writing), mentions of captivity, and the name Walsingham pointed to Mary.

The cipher was homophonic, giving common letters several symbols, which was very common in the sixteenth century. The team broke it with a hill-climbing algorithm, the same family of method as this site's substitution solver. It starts from a random key and keeps any change that makes the text look more like the target language. The result was 57 letters written between 1578 and 1584, most of them addressed to Michel de Castelnau de la Mauvissière, the French ambassador in London. They run to about 50,000 words in all, and about 50 of the letters were previously unknown to historians. They cast new light on her captivity. The paper, Deciphering Mary Stuart's lost letters from 1578–1584, appeared in the journal Cryptologia (its DOI is dated 2022), and the announcement came on February 8, 2023, the anniversary of Mary's execution. The numbers here are from the publisher's announcement and press reports. The technical details are in the paper.

Why it worked, then and now

• Volume hands the analyst power. A cipher that's hard to break from a few lines becomes easy from hundreds of letters, and Mary's correspondents sent far too much text through one system.
• The channel mattered more than the cipher. The betrayal came from a route Mary thought secret and an enemy ran. A modern version is believing a key has been delivered securely when it hasn't (public-key cryptography was invented twice is the story of how that problem was finally solved).
• Computers made the old puzzle easy. What took Phelippes skill and patience, a hill-climbing program can attack in a fraction of the time. The main obstacle to reading old ciphers now is finding the documents.
• Archives hold more than their catalogs say. The letters sat in a public collection under the wrong label. How many other unread ciphers lie in the world's archives is anyone's guess, and projects like DECRYPT exist to look.

How cipher.ink uses this

A modern message doesn't rely on a secret channel, or on an analyst's lack of text. cipher.ink seals each message with a fresh key under AES-256-GCM, so even a thousand messages from one user give nothing to count, and any change to the ciphertext gets detected (AES-256-GCM, AES-GCM). The server that carries a message, like the brewer who carried Mary's barrel, sees only ciphertext it can't read and can't alter without being caught. One job stays with you: keep the key off the route the message takes. That's why the page recommends sending the passphrase separately from the link, and why it's the one habit that would have saved Mary.