Crypto expert Frode Weierud has published a collection of unsolved cryptograms from 1969. If you’re looking for a challenging codebreaking project, here you go.

Many readers of this blog certainly know Frode Weierud. Frode, a retired software developer from Norway, has been involved with cryptology for over 50 years. As a leading Enigma expert, he is mentioned in several books I have written (especially in Nicht zu knacken) and on this blog.

Among other things, Frode has deciphered hundreds of Enigma messages from the Second World War. His homepage, Frode Weierud’s CryptoCellar, contains plenty of interesting information about the Enigma, the Kryha machine, the Lorenz machine and more.


The Biafran Ciphers

Recently, Frode has published a report about a collection of ciphertexts from the Nigerian Civil War (1967-1970), also known as the Biafran War. This war was fought between the government of Nigeria and the secessionist state of Biafra. The conflict resulted from political, economic, ethnic, cultural and religious tensions. Control over the lucrative oil production in the Niger Delta played an important role.

Frode obtained the ciphertexts (he calls them Biafran Ciphers) already in 1969. They had been transmitted by radio teletype between Biafra and Lisbon, and apparently somebody in Norway had intercepted them. Frode tried to decipher the messages, but to no avail. He thought about publishing them in a Cryptologia article in the late 1970s, but he decided not to do so, as they stemmed from a recent war and the content still could have been sensitive.

40 years later and 50 years after the messages had been intercepted, Frode thought that meanwhile it was safe to publish the messages. So, he made scans and a few transpositions available on his website. You can help Frode by transcribing messages that have not been transcribed yet.


A transposition cipher and a code?

The scans are provided in some 60 PDF files. The messages were sent between August 2nd and October 21st, 1969. According to Frode, two different ciphers were used. He writes:

Source: Weierud

The ciphertexts in this collection are of two types, messages in groups of 5-letters and 5-figures. In 1969, shortly after receiving these messages, I made a quick analysis of both types of messages. A frequency analysis of the 5-letter traffic showed a monoalphabetic distribution corresponding to English plaintext, and the form of the messages made me believe that they were enciphered by a transposition system. The messages are divided into a number of blocks that often, but not always, consist of an odd number of groups. The message BAL025 from 04 August 1969 is divided into four blocks marked 71/4, 142/4, 11/4 and 22/4. The number behind the slash is the date when the message was enciphered. It therefore seems logical to believe that the same or a similar transposition is performed on each of these blocks. In 1969 and also later in 1978 a few feeble attempts were made to break into this system. Irregular columnar transposition and some other of the more common transposition systems were investigated but without any success. In the end I decided that either double transposition was used or a kind of stencil system.

Source: Weierud

The 5-figure system is most likely a code but it could also be a substitution cipher. No detailed analysis has been made of this system largely because there are so few of these messages.

Codes and transposition ciphers have both been discussed on this blog many times. Both systems are very hard to break if used properly.

To solve a transposition cryptogram, usually some trial-and-error is necessary. There are many ways to change the order of the letters in a message, some based on lines and/or columns, others based on stencils. For an example of a successful transposition cryptanalysis, check David Stein’s paper on the Kryptos inscription (the third part of the inscription is encrypted in a transposition cipher).

If the second type of encryption is based on a code, there are two common ways to solve it. First, one can hope that the code has a conceptual flaw – for instance that the code groups are sorted alphabetically. Second, one can try to find the codebook that was used. Both methods have been used successfully in the past. Good luck!

Further reading: What happened to codebreaker Heinrich Döring after WW2?


Subscribe to Blog via Email

Enter your email address to subscribe to this blog and receive notifications of new posts by email.

Kommentare (12)

  1. #1 Richard Bean
    21. November 2019

    The DARTLX message is great for an English like frequency. The order is etnaoirslhcudmfpbgywvkxqzj.

    The IC is 0.067. It has about 3,600 letters total. Most of the transcription work was done by Google Drive OCR – I uploaded the PDF and got good text back, although it confused lower-case I and L often.

  2. #2 Georg
    21. November 2019

    Hallo Hr. Schmeh,
    woher weiß man, daß der Adressat in Lissabon saß?
    (übrigens “INTERcepted” in Norwegen zwischen Biafra und Lissabon ist eigentlich lustig. )
    Diese Klartext-Überschriften “for o from dr. … “, gehören die
    zum eigentlichen Fernschreiben oder ist das was Internes in
    Was ist dies 123/4 für ein Datumsformat?
    Haben die 5er-Gruppen etwas mit dem Code zu tun,
    oder sind die nur zweckmäßig für den Schreiber?

  3. #3 Frode Weierud
    Oslo, Norway
    21. November 2019

    Many thanks for the OCR scan of DARTLX 1/11th Aug. I have corrected the remaining OCR errors, mainly problems with h and n, u and l. I have also tried to correct for the reception garbles. The details of that has been explained on the Web page with the transcript which you can now find on my Biafran Cipher Web page.

  4. #4 Klaus Schmeh
    22. November 2019

    >woher weiß man, daß der Adressat in
    >Lissabon saß?
    Das geht wohl aus den Klartextteilen hervor.

    >Diese Klartext-Überschriften “for o from dr. … “,
    >gehören die zum eigentlichen Fernschreiben
    >oder ist das was Internes in Norwegen?
    Ich vermute, das stammt von demjenigen, der die Nachricht mitgehört hat.

    >Was ist dies 123/4 für ein Datumsformat?
    Das weiß ich nicht.

    >Haben die 5er-Gruppen etwas mit dem Code zu tun,
    >oder sind die nur zweckmäßig für den Schreiber?
    Das weiß man nicht. Es könnte sein, dass die Codegruppen aus jeweils fünf Ziffern bestehen. Es kann aber auch sein, dass der Geheimtext in Fünferblöcken notiert wurde, obwohl das verwendete Verfahren keine solchen Blöcke vorsieht.

  5. #5 Joe
    22. November 2019

    Ich hoffe das das ein Aprilscherz ist:

    >Haben die 5er-Gruppen etwas mit dem Code zu tun,
    >oder sind die nur zweckmäßig für den Schreiber?
    >>Das weiß man nicht. Es könnte sein, dass die Codegruppen aus jeweils fünf Ziffern bestehen. Es kann aber auch sein, dass der Geheimtext in Fünferblöcken notiert wurde, obwohl das verwendete Verfahren keine solchen Blöcke vorsieht.

  6. #6 Gerd
    22. November 2019

    >Diese Klartext-Überschriften “for o from dr. … “,
    >gehören die zum eigentlichen Fernschreiben
    >oder ist das was Internes in Norwegen?
    Looking at the files on Frode’s site, you can see that the “for .. from ..” lines are printed on the teleprinter paper or teleprinter stripes, and they are also in the same way included in the cleartext messages. So I think they are part of the original transmissions.

  7. #7 Richard Bean
    26. November 2019

    The good news – I have solved the short parts (two 22 x 5 transpositions) from 4 August 1969 at (TDDTA … LYISS and TBHHL … TOGTE).

    I noticed that they coincided quite a bit in the same locations, and discovered that this is because they use the same key and begin with the same 13 letters. It’s not hard to solve them as a 22 x 10 matrix with hill climbing (with 6-gram stats).

    The bad news – I can’t see any pattern in the key – 10 3 12 18 0 13 11 7 14 19 16 15 1 20 8 4 2 6 21 5 9 17 – so I am thinking the keys may be derived from a book somehow. So I couldn’t apply it to the rest of the message or generalize it. The “5 9” near the end is for two dummy columns.

    I tried several things to get more keys

    (a) looking at all the ways to begin the two messages with “PARTONEBEGINS”
    (b) implementing the algorithm of Lasry, Kopal and Wacker (2016) –

    (b1) trying it on BAL020 and BAL050 with width 40 and 42 messages – 40 x 5 and 42 x 5
    (b2) trying it on BAL141 as a 149 x 30 block (5 rows and 6 pages) – BAL141 is error-free
    (b3) BAL025, 026, 029 combined as 142 x 10 or 142 x 15 blocks – all from the same day, with width 142, and 026 and 029 are error-free

    I didn’t find anything because of many reasons: five rows is not much to work with solving these, I have to pad out the errors, there might be 10% dummy columns, and it may be that the BAL141 message uses a different key on each page. There are many difficulties to overcome. Approach (b3) really should work … perhaps there is just not quite enough to work with.

    So I seem to be at an impasse, unless someone can spot a pattern in the key somehow …

  8. #8 Thomas
    26. November 2019

    @Richard Bean:

    Congratulations! That’s a great achievement!

    As for the key: Why do you include two column numbers for the dummy goups BICTR and NNEDI resp. BICTR and OOERT in the key? If they are dummies, what seems to be proved by the plaintext, they cannot be assigned to a certain plaintext column. Or do I overlook anything?

  9. #9 Richard Bean
    27. November 2019

    Thanks Thomas and Narga!

    Yes, Thomas – you make a good point, so the “5” and the “9” in the key sequence above can be distributed anywhere in the sequence without changing the plaintext outcome. There’s 21 choose 2 = 210 combinations. For each of those, I still couldn’t see any patterns in the key or its inverse.

  10. #10 Frode Weierud
    Oslo, Norway
    2. Dezember 2019

    I have now published transcripts of all the code and ciphertext messages. Hopefully there are no or few errors. Should you find any errors then please let me know.
    Georg ask if the addresses such as “For O from Dr. Obonna” belongs to the message. Yes, everything that you find printed on the facsimile copies are original and belong to the message. Only in a few cases have notes been added by the interceptor of the messages. All these notes are handwritten with pen or pencil. Georg also asks about the format 123/4. As I explain on the Web page these numbers indicate the end of a ciphertext block. The first number before the slash indicates the number of 5-letter groups in the block, while the number after, 4 in this case, indicate the date or day number. Here 4 August 1969. The purpose of these numbers are not yet fully understood, but it seems they are part of the indicator system that show which key has been used.

  11. #11 Thomas
    2. Dezember 2019

    @Frode Weierud
    What a tedious task, wasn’t it?

    “it seems they are part of the indicator system that show which key has been used”: As for the parts decrypted by Richard, the number before the slash indicates both the number of preceeding groups and the number of columns used in the transposition. Is that what you mean or are you referring to another connection between that number and the key?

  12. #12 Frode Weierud
    Oslo, Norway
    2. Dezember 2019

    Not so bad as lot of the work was done by @Richard Bean and Google Doc. The most tedious task is to crosscheck the OCR results. The number before the slash indicates the number of groups in the block. For the part broken by Richard the number for the end block, 22, did correspond to the number of columns used in the transposition, but I do not think this is a general rule. For example the large block of the same message is 142 and this would be unworkable as a column size. My theory is still that it is a stencil system and that in this case the empty cells in this stencil starts only below the fifth line. This will explain why the short message of only 22 groups shows up as regular columnar transposition. Longer messages will not. I also think that the two dummy group BICTR and OOERT which are in the sixth and tenth groups of the 11/4 block are indicators of some sort. In the first large block of 71/4 we again find BICTR in group 66th and OOERE in the 70th group. The distance between these groups are 4 in both cases. Is this somehow related to the date or are these positions fixed? It is quite possible the OOERT is an error for OOERE. OOERE seems to be a solidly received group as it shows up also in a repeat transmission, unfortunately there is no repeat for the end of the message with OOERT. All this could indicate that also the same stencil is used for the large blocks and that also here the number of columns are 20, what you get after removing the dummy or indicator groups. The large block will then have 140 groups which give columns with a depth of 35 letters, however some of them staggered due to the empty cells. However, all this is only one of my theories so far and I am not willing to place any bet on it.