StartseiteCipherbrain

Die Friedman-Ring-Challenge von Matthew Brown

Von / 31. Oktober 2022 / 206 Kommentare
Mehr

Vor vier Monaten hat Matthew Brown die Challenge von Norbert Biermann gelöst und ist damit der aktuelle Träger des Friedman-Rings. Heute stelle ich Matthews neue Challenge vor. Wer sie löst, wird sein Nachfolger.

English version (translated with DeepL)

Wer das aktuelle Krypto-Rätsel als erstes löst, erstellt das nächste. Nach diesem einfachen Prinzip funktioniert der Friedman-Ring. Dabei handelt es sich um ein Spiel, das nach den Kryptologen William und Elizebeth Friedman benannt ist. Vorbild ist der Iffland-Ring, der bereits seit Jahrhunderten an Schauspieler vergeben wird.

Vor drei Monaten ging die sechste Runde des Friedman-Ring-Spiels zu Ende. Das bisher letzte Rätsel kam von Norbert Biermann. Matthew Brown hat es als erster gelöst und wurde damit der neue Träger des Friedman-Rings. Kurz nach ihm hat auch Jarl Van Eycke die richtige Lösung veröffentlicht. Außerdem haben Joachim, Rossignol, Doc Cool, Thomas Bosbach, Geoffrey Caveney, Jan, Nils Kopal, Chris, Gerd, David Vierra und Armin Krauß Hinweise gegeben.

Damit ergibt sich folgende Liste von Trägern des Rings:

  1. Frank Schwellinger
  2. Anna Salpingidis und Christoph Tenzer
  3. Armin Krauß
  4. Christoph Tenzer
  5. George Lasry
  6. Norbert Biermann
  7. Matthew Brown

Der jeweilige Empfänger des Friedman-Rings verpflichtet sich, ein Krypto-Rätsel zu entwickeln und mir zur Verfügung zu stellen. Wer dieses Rätsel als erstes löst, ist der neue Träger. Es gibt eine Webseite zum bisherigen Verlauf.

 

Matthew Browns Challenge

Kommen wir nun zur neuen Friedman-Ring-Challenge, die Matthew mir zugeschickt hat. Sie besteht aus zwei Teilen. Hier ist der erste:

Quelle/Source: Matthew Brown

Und hier ist der zweite Teil:

Quelle/Source: Matthew Brown

Weitere Informationen hat Matthew bisher nicht zur Verfügung gestellt. Wie man sieht, ist erst einmal keine Verschlüsselung zu erkennen. Es handelt sich also um einen steganografischen Code. Ich bin gespannt, was dahinter steckt. Danke an Matthew für diese Challenge.

Wie schon öfters erwähnt, gehört es zu den Eigenheiten dieses Spiels, dass jeder Leserhinweis, der als Kommentar veröffentlicht wird, einem anderen Codeknacker zum Gewinn verhelfen kann. Ich bitte meine Leser daher, nicht ganz so egoistisch zu sein. Wenn im Forum über Lösungswege diskutiert wird, macht das die Sache für alle spannender. Natürlich werde ich jeden Kommentar, der zur Lösung beigetragen hat, entsprechend würdigen.

Das Rennen ist eröffnet!


Further reading: Christoph’s Chaotic Caesar Challenge

Linkedin: https://www.linkedin.com/groups/13501820
Facebook: https://www.facebook.com/groups/763282653806483/

Subscribe to Blog via Email

Enter your email address to subscribe to this blog and receive notifications of new posts by email.

Stichworte:
Mehr

Kommentare (206)

  1. #1 Magnus Ekhall
    Borensberg
    31. Oktober 2022

    Interesting!

    I think I see a “pattern” of extra black dots in some of the characters. A threshold filter reveals them clearly. Perhaps the dots denote the letters of interest? Or maybe they form a pattern to be investigated? Or, maybe they are just part of the original scan and I’m seeing things. 🙂

  2. #2 Gerd
    31. Oktober 2022

    black dots and imperfectly printed characters are very similar to the scans of “The Sonnets, Quarto 1” from 1609. See:
    https://internetshakespeare.uvic.ca/Library/facsimile/book/UC_Q1_Son/13/index.html%3Fzoom=500.html
    and
    https://internetshakespeare.uvic.ca/Library/facsimile/book/UC_Q1_Son/22/?zoom=500

  3. #3 Martin Gillow
    Milton Keynes
    31. Oktober 2022

    As these texts are by Shakespeare, and given Magnus’ comment about the dots on some letters, may I suggest a Bacon cipher where dotted / non dotted letters stand for a/b?

  4. #4 Norbert
    1. November 2022

    I assume that the only black dot in image 1 that falls between two letters (in “things” in the last line, between I and N) indicates the end of the ciphertext. Then we have 250 “meaningful” characters (with or without a dot). In the second image, the last letter with a dot is the C in “captaine” in the last line. If this is also the last letter to be considered, we arrive again at 250 characters.

  5. #5 Norbert
    1. November 2022

    An attempt to transcribe the first image (1=with dot, 0=without)

    thybo somei sinde aredw ithal
    00010 00000 00110 10110 10110
    lhear tswhi chiby lacki nghau
    10001 01000 01010 00010 00010
    esupp osedd eadan dther eraig
    00111 10011 00111 10111 01000
    neslo ueand alllo ueslo uingp
    10111 00111 10111 10011 00111
    artsa ndall those frien dswhi
    01111 01011 01111 10110 10001
    chith ought burie dhowm anyah
    00011 00111 10110 00010 10101
    olyan dobse quiou stear ehath
    10011 01000 00011 01111 00110
    deare relig iousl ouest olnef
    00011 01010 10111 00000 10011
    rommi neeye asint erest ofthe
    00100 10011 01000 00110 01111
    deadw hichn owapp eareb utthi
    00010 00111 10110 00100 01000

    In groups of five expecting it to be something Bacon-ish, but I think there are intermediate steps needed (like logically combining the information from image 1 and image 2 somehow).

  6. #6 Norbert
    1. November 2022

    Image 2

    soami asthe richw hoseb lesse
    00000 00011 00111 10000 11001
    dkeyc anbri nghim tohis sweet
    01000 01111 10011 10011 00011
    uploc kedtr easur ethew hichh
    10011 01111 01111 10011 10101
    ewill noteu ryhow ersur uayfo
    00110 01111 10110 10010 01001
    rblun tingt hefin epoin tofse
    10011 10110 10000 00010 10011
    ldome pleas ureth erefo reare
    10010 00010 10011 00010 00111
    feast ssoso llemn eands orare
    10011 10011 10111 10100 01101
    since sildo mcomm ingin thelo
    00001 01101 00011 11001 10001
    ngyea reset likes tones ofwor
    10011 00111 10000 00001 01111
    ththe ythin lypla cedar eorca
    00010 01000 00111 00010 00010

    (Seems I miscounted. It’s 250 characters if we include the A after the last marked letter C.)
    Corrections are very welcome!

  7. #7 TWO
    1. November 2022

    All WWF

  8. #8 Norbert
    1. November 2022

    Considering the groups of five as binary numbers, it is noticeable that none of the numbers is greater than 25 (binary 11001). They can therefore be transcribed as letters a-z:

    img1: cagwwrikcchthxixhxthplpwrdhwcvtidpgdkxatetigpchwei
    img2: adhqzipttdtpptvgpwsjtwqctsctchttxunbndzrthqbpcihcc

  9. #9 Norbert
    1. November 2022

    Index of Coincidence for img1 (transcribed to 50 characters): 0.063,
    for img2: 0.072,
    for both images combined: 0.067.

    So I guess it’s one and the same monoalphabetic substitution for image 1 and image 2, plus some specific transposition. The plaintext could very well be English.
    That might be the core of the puzzle 🙂

  10. #10 Thomas
    1. November 2022

    @Norbert

    Maybe I need new glasses: How do you make out the additional dots in Matthew’s scans compared to the 1609 Quarto linked by Gerd? Or did you use an image processing program here?

  11. #11 Gerd
    1. November 2022

    @Thomas All dots from poor printing are the same. Matthew’s jpgs contain single black pixels on some letters. It can be seen if the image is displayed at 200% or 400% or using image processing.

    For the challenge, I expect some more tricky things. The original text uses an alphabet where v=u and f=s, could that be a hint?

  12. #12 Norbert
    1. November 2022

    @Thomas: Some of the dots are, as Magnus wrote, really black and not just dark. To make them visible I used GIMP and there I used the “Curves” tool (“Farbkurven” auf Deutsch). If you click in the curve somewhere there and drag it to almost exactly the upper left corner, everything becomes white that is not really completely black. Then the dots remain:

    https://ibb.co/4fx4Zf0

    Combined with a brightened copy of the original image, it will look like this:

    https://ibb.co/mX3D6gT

    The same for the second image:

    https://ibb.co/JjX2LHX

  13. #13 Thomas
    1. November 2022

    @Gerd

    “The original text uses an alphabet where v=u and f=s, could that be a hint?”

    As I see it, both the 1609 Quarto and Matthew’s images have u for v and use the long s as well as the round s. Do you make out any difference here?

  14. #14 Thomas
    1. November 2022

    @Norbert

    Thanks, great finds! Gimped it and will keep my glasses 🙂

  15. #15 Norbert
    1. November 2022

    @Gerd

    I expect some more tricky things

    I would say that if the assumptions are true (who knows) and my transcription is correct (needs to be cross-checked), then we (including Magnus and Martin) have at most “unwrapped” the challenge so far. The next steps should be the really difficult ones 😉

    By the way, the “wrapping” is beautiful. Just the way I like it!

  16. #16 davidsch
    UTR
    1. November 2022

    These jewels of the two octastichons seem to be complementary to each other, each having half of the solution.

  17. #17 Norbert
    1. November 2022

    Meanwhile it dawns to me how beautifully composed this puzzle is. I think it’s possible that the two sonnets are not only somehow crypto-related, but are actually chosen to describe the methods that apply to both layers of the riddle:
    1st Sonnette: “things (…) that hidden in there lie” => Steganography (Baconian Cipher)
    2nd Sonnette: The “key” leads us to the “treasure”, yes, that’s obvious. But could it be that the attributes “thinly placed”, “like stones of worth” give a clue about the nature of this key?

    Yes, I am talking of a grille … I’m still convinced that each image bears exactly 50 letters of ciphertext. Thus, 100 = 10×10 in total. Perfect for a grille! Which would also fit wonderfully into the time of Bacon and Shakespeare …

  18. #18 Magnus Ekhall
    Borensberg
    1. November 2022

    I was thinking along the same lines.
    Perhaps the form and structure of Shakespearean sonnets play a role?
    I totally agree that if there are exactly 2 x 50 letters that is not a coincidence, as well as the fact that no Baconian “letter” decodes to something grater than 25.

    The distribution of the letter frequency of the transcribed supposed ciphertext from the two images differ somewhat from each other. Perhaps 50 letters are a bit too few to get reliable statistics though…

    I like the idea of a grille type cipher.

  19. #19 David Vierra
    2. November 2022

    This puzzle reminds me of a copy of Military Cryptanalytics found in William Friedman’s personal collection. A dedication written to Friedman from his student Lambros Callimahos was written with dots below some of the letters.

    But it was not the pattern of present and absent dots that encoded the second message. The dots indicated a sequence of letters, and it was the pattern of vowels and consonants in that sequence of letters that encoded the sentence “BACON DID NOT WRITE THIS WORK” using Bacon’s method.

    https://www.nsa.gov/Portals/75/documents/news-features/declassified-documents/friedman-documents/publications/FOLDER_245/41748799078803.pdf

  20. #20 Norbert
    2. November 2022

    As said before, I assume that the ciphertext to be solved in step 2 is this one:
    cagwwrikcchthxixhxthplpwrdhwcvtidpgdkxatetigpchwei
    adhqzipttdtpptvgpwsjtwqctsctchttxunbndzrthqbpcihcc

    and that we are dealing with a combination of substitution and transposition. The transposition could be a grille (not necessarily Fleissner), but it could also be any other method. We simply do not know what type of transposition was used. This makes analysis extremely difficult.

    However, I think Matthew aimed to present a solvable puzzle. So maybe the substitution part is not that complicated?
    A Caesar shift (+11) yields:
    nlrhhctvnnsesitisiesawahcoshngetoarovilepetranshpt
    losbktaeeoeaaegrahduehbnednenseeifymyokcesbmantsnn

    The letter frequencies are now strikingly similar to English plaintext!

  21. #21 David Vierra
    2. November 2022

    Norbert:

    I double-checked your transcriptions and found no mistakes. I also found that both images have exactly 118 dots, not counting the “end-of-text” dot.

  22. #22 David Vierra
    2. November 2022

    Norbert: Caesar shift +11 looks correct. The peaks are in the right place, but more importantly JQXZ do not occur at all. K occurs twice, so there may be a way to break in by matching up the Ks with Cs.

  23. #23 TWO
    2. November 2022

    Sonnet 31 and 52, those are really interesting numbers imho.

    To me the dots look like they are simply the nuance of what was written on the previous page like a facsimile of sort.

    Makes you wonder if we are supposed to superimpose the images and treat them as the layers of this puzzle?

  24. #24 Norbert
    2. November 2022

    @David: Many thanks for cross-checking! And for counting the dots! Very interesting…

    @TWO:

    the dots look like they are simply the nuance of …

    The argument is justified. The black dots could be coincidence. We might have found them because we wanted to find them, and we might think they are relevant because we would like them to be relevant. These things happen, no one is immune from that.
    What helps here is statistics!

    We made out 236 black dots on letters in two images of texts with a total of 555 letters (plus one dot between two letters) by turning a slider in an image editing program. Let’s assume that we just made them exist and that their positions are entirely random, being exactly on letters because that’s where most of the printing ink is. But we can see that not a single letter carries TWO dots. How likely is that, if the distribution is otherwise purely random?
    Very unlikely! (I think something on the scale of 10^-26) So, based on this probability estimate, we can suspect with some reason that we are on the right track.

    The same is true for all subsequent steps. For example, the fact that the Caesar shift gave a “natural” letter distribution may be total coincidence, but the probability for that is extremely small. So it makes sense to continue working in this direction 🙂

  25. #25 David Vierra
    2. November 2022

    I am trying to apply Paul Relkin’s method for examining transposition ciphers (described in his paper on solving the Olam 2 cipher) but it seems to find very little because of how short the text is.

    The method finds all of the trigrams that can be made by rearranging letters, groups them into “intervals” where all of the trigrams in the group have the same distance between letters, and sums the log-likelihoods for those trigrams in each interval. Then, it weights the scores by the frequency of the individual letters. For example, if there is one “F” in the text, trigrams with “F” will have a higher score than trigrams with “T” when there are ten “T” in the text.

    And that’s just what it’s doing. There’s a single letter “F”, and the trigram “FOR” has a high likelihood, so it just gives me a list of all the different ways you can spell “FOR” by rearranging letters. It doesn’t find many intervals with more than one or two high-scoring trigrams – the top score has three trigrams “FOR”, “THE”, “ILL” with intervals (68, 51).

    This probably doesn’t help much.

    Here is the output, which includes the total weighted score, the intervals, and then the top 10 scoring trigrams in that interval with their weighted scores.


    22.841151: (68, 51) FOR ( 10.51) THE ( 4.18) ILL ( 3.46) NTH ( 0.50) ICA ( 0.39) GOF ( 0.30) ENT ( 0.30) ENT ( 0.30) EVE ( 0.25) REA ( 0.24)
    17.542301: (49, 70) FOR ( 10.51) THE ( 4.18) ROW ( 0.39) LLA ( 0.39) EVE ( 0.25) AME ( 0.24) EST ( 0.19) EST ( 0.19) ARI ( 0.12) TTO ( 0.11)
    17.379875: (42, 77) FOR ( 10.51) AND ( 3.70) OME ( 0.39) RMA ( 0.37) ERS ( 0.34) EST ( 0.19) CAR ( 0.17) AGE ( 0.16) LBU ( 0.14) DIA ( 0.09)
    16.226801: (52, 67) FOR ( 10.51) AND ( 3.70) ICA ( 0.39) OOK ( 0.29) ATE ( 0.18) ATE ( 0.18) EME ( 0.07) RYB ( 0.06) ESS ( 0.06) DHA ( 0.05)
    15.903684: (85, 31) ING ( 6.28) THE ( 4.18) DBY ( 1.54) INT ( 0.64) EDT ( 0.56) ERE ( 0.27) ETH ( 0.22) ERT ( 0.20) STA ( 0.20) BLU ( 0.19)
    15.698877: (91, 56) ING ( 6.28) ING ( 6.28) TOR ( 0.41) ERE ( 0.27) AME ( 0.24) ERW ( 0.23) SIN ( 0.22) NGA ( 0.22) RRE ( 0.10) GAN ( 0.10)
    15.630710: (51, 34) YOU ( 7.08) THE ( 4.18) LLO ( 0.56) MAN ( 0.38) OFI ( 0.34) ENT ( 0.30) AVE ( 0.27) ONS ( 0.16) NCE ( 0.16) RAN ( 0.16)
    15.407556: (68, 92) FOR ( 10.51) OMM ( 1.44) OTH ( 0.51) THI ( 0.49) TIN ( 0.27) REA ( 0.24) ETH ( 0.22) IME ( 0.19) NDE ( 0.19) AKE ( 0.10)
    15.208997: (49, 11) FOR ( 10.51) DIN ( 0.97) THI ( 0.49) HAT ( 0.40) LLA ( 0.39) DCO ( 0.31) EVE ( 0.25) ARK ( 0.18) ONS ( 0.16) SPO ( 0.15)
    15.191665: (92, 34) THE ( 4.18) THE ( 4.18) ROU ( 2.16) IVE ( 0.58) TED ( 0.48) PPE ( 0.32) AVE ( 0.27) NOW ( 0.27) ORE ( 0.25) RES ( 0.23)
    15.126775: (49, 34) YOU ( 7.08) LLY ( 2.99) ROM ( 1.24) LOW ( 1.20) OVE ( 0.34) ONT ( 0.28) EVE ( 0.25) ARE ( 0.22) SOM ( 0.17) SAN ( 0.11)
    15.061892: (36, 91) ING ( 6.28) THE ( 4.18) NGT ( 0.59) DER ( 0.54) UCT ( 0.54) LIN ( 0.33) REA ( 0.24) GRA ( 0.24) EDA ( 0.23) SIN ( 0.22)
    15.016277: (81, 18) ULD ( 7.15) THE ( 4.18) DTH ( 1.21) LIN ( 0.33) MAY ( 0.19) ATE ( 0.18) ALS ( 0.17) OPE ( 0.12) OOL ( 0.11) TOC ( 0.11)
    14.967057: (75, 10) YOU ( 7.08) THE ( 4.18) GHT ( 0.67) ENT ( 0.30) NDM ( 0.23) EAR ( 0.23) ATE ( 0.18) ONS ( 0.16) AUS ( 0.14) ORA ( 0.13)
    14.458886: (51, 23) THE ( 4.18) AND ( 3.70) OFT ( 2.94) TIC ( 0.30) ENT ( 0.30) AVE ( 0.27) EWA ( 0.26) UAR ( 0.23) STR ( 0.22) FRE ( 0.17)
    14.299738: (76, 84) FOR ( 10.51) TER ( 0.52) MAN ( 0.38) ERE ( 0.27) NDO ( 0.23) UNG ( 0.23) IME ( 0.19) ATE ( 0.18) DAN ( 0.18) LEA ( 0.11)
    14.285139: (42, 40) FOR ( 10.51) ION ( 1.08) ERT ( 0.20) OMA ( 0.18) ADI ( 0.17) CHO ( 0.15) MOD ( 0.13) NTI ( 0.12) RMO ( 0.12) SAN ( 0.11)
    14.260883: (65, 86) ING ( 6.28) THE ( 4.18) ATI ( 0.60) EFU ( 0.32) ENT ( 0.30) ENT ( 0.30) RES ( 0.23) BER ( 0.19) NGL ( 0.17) URA ( 0.17)
    14.177673: (68, 14) FOR ( 10.51) THI ( 0.49) NDI ( 0.47) ENT ( 0.30) ONT ( 0.28) ALI ( 0.22) MAD ( 0.21) DRE ( 0.15) HEB ( 0.12) SAN ( 0.11)
    14.109757: (72, 55) ING ( 6.28) THE ( 4.18) IMP ( 0.70) THI ( 0.49) ICA ( 0.39) SUC ( 0.34) ERE ( 0.27) ETH ( 0.22) RIE ( 0.10) REG ( 0.10)

  26. #26 Nils
    2. November 2022

    Hiho,
    I searched through my copy of the Gutenberg library for texts having a similiar letter distribution as Norberts Caesar-deciphered “plaintext”.

    The following texts are the closesest ones. Distribution distance 8 means, that the difference of the original text (Norbert’s “plaintext”) and the found is 8.
    Unfortunately, I did not find any matching text in the Gutenberg library which could be the original plaintext before transposing it.

    Here are the results of the search:

    TranspoTextSearcher.exe
    Creating files queue
    Files queue created
    Start search at 02/11/2022 16:46:55
    Found probable text in book: gutenberg\gutenberg_en\aleph.gutenberg.org\1\2\0\8\12081\12081-8.zip
    Distribution distance: 8
    Text is: SSUNSETANDSEATINGHERSELFBESIDEHERTHEYBEGANANANIMATEDCONVERSATIONPRESENTLYTHEREWASAKNOCKCOMEINBOTHSHO

    Found probable text in book: gutenberg\gutenberg_en\aleph.gutenberg.org\1\2\0\8\12081\12081.zip
    Distribution distance: 8
    Text is: SSUNSETANDSEATINGHERSELFBESIDEHERTHEYBEGANANANIMATEDCONVERSATIONPRESENTLYTHEREWASAKNOCKCOMEINBOTHSHO

    Found probable text in book: gutenberg\gutenberg_en\aleph.gutenberg.org\3\7\9\3\37937\37937.zip
    Distribution distance: 8
    Text is: HEYCANBECOMEANAGREEABLEHABITSLEEPINESSISASUNKNOWNTHEREASTHEWRITINGSOFTHOMASAKEMPISNOTONLYTHEDANCERSD

    Found probable text in book: gutenberg\gutenberg_en\aleph.gutenberg.org\3\7\9\3\37937\37937-8.zip
    Distribution distance: 8
    Text is: DTHEYCANBECOMEANAGREEABLEHABITSLEEPINESSISASUNKNOWNTHEREASTHEWRITINGSOFTHOMASKEMPISNOTONLYTHEDANCERS

    Found probable text in book: gutenberg\gutenberg_en\aleph.gutenberg.org\3\7\9\3\37937\37937-8.zip
    Distribution distance: 8
    Text is: THEYCANBECOMEANAGREEABLEHABITSLEEPINESSISASUNKNOWNTHEREASTHEWRITINGSOFTHOMASKEMPISNOTONLYTHEDANCERSD

    Found probable text in book: gutenberg\gutenberg_en\aleph.gutenberg.org\3\7\9\3\37937\37937-8.zip
    Distribution distance: 8
    Text is: HEYCANBECOMEANAGREEABLEHABITSLEEPINESSISASUNKNOWNTHEREASTHEWRITINGSOFTHOMASKEMPISNOTONLYTHEDANCERSDE

    Finished search at 02/11/2022 17:39:10
    Search took 00:52:14.8308633

  27. #27 Thomas Ernst
    nowhere
    2. November 2022

    The first two stanzas of 52 indeed read like a metaphor for the successful solution of a text that is found only in 31: “to which he will not every hour survey” = of which he/ will not always find a solution, the reason being that he/she “blunts the fine point of seldom pleasure” = goes the wrong way about solving a cipher, which makes the solution a rare occasion, “feasts so seldom and rare like holidays in a year”. – The u/v, btw., was a writing and printing convention of the times: initial v, inside a word a u.

  28. #28 TWO
    2. November 2022

    It is just an observation.

    Check these images from Wikipedia :

    Sonnet 31
    https://en.wikipedia.org/wiki/Sonnet_31#/media/File:Sonnet_31_1609.jpg
    Sonnet 52
    https://en.wikipedia.org/wiki/Sonnet_52#/media/File:Sonnet_52_1609.jpg

    Do you see anything Norbert?

    Are the images from Brother Matthew and Wikipedia identical?

  29. #29 TWO
    2. November 2022

    I see that my comment does not get published.

    @Norbert

    Did you compare Brother Matthew images with those on Wikipedia?

    Do you see anything?

  30. #30 Thomas Ernst
    nowhere
    2. November 2022

    In order to juxtapose the first two stanzas of two sonnets so they can be allegorically read to pertain to a cryptological riddle and the second to pertain to the cryptological solution is only possible with a common denominator. This cannot be the word count (62/63) or the letter count (274/269), although some such stanzas can probably be found in the sonnets. Thus the common denominator must be the pentameter.
    The stresses in 31 are (please correct if wrong): BIDWH/ILHPD/TLALP/AAWIB/MHOQT/DILFE/IODNP/TMHIL.
    “obsequious” was probably stressed on the “s”, but then there are only four stresses; here quantity has overriden quality of rhyme.
    The stresses in 52 are:
    SIRBK/BTSLT/WWEHV/BTPSP/FFSAR/SCILS/SWTPA/CJICN.
    Assuming that the key does not repeat – which would be the elegant thing to do – plaintext, key, and transposition would each encompass a text of 40 letters. Perhaps plaintext and key are the same.

  31. #31 Thomas Ernst
    nowhere
    2. November 2022

    In order to juxtapose the first two stanzas of two sonnets so they can be allegorically read to pertain to a cryptological riddle and the second to pertain to the cryptological solution is only possible with a common denominator. This cannot be the word count (62/63) or the letter count (274/269), although some such stanzas can probably be found in the sonnets. Thus the common denominator must be the pentameter.
    The stresses in 31 are (please correct if wrong):
    BIDWH/ILHPD/TLALP/AAWIB/MHOQT/DILFE/IODNP/TMHIL.
    “obsequious” was probably stressed on the “s”, but then there are only four stresses; here quantity has overriden quality of rhyme.
    The stresses in 52 are:
    SIRBK/BTSLT/WWEHV/BTPSP/FFSAR/SCILS/SWTPA/CJICN.
    Assuming that the key does not repeat – which would be the elegant thing to do – plaintext, key, and transposition would each encompass a text of 40 letters. Perhaps plaintext and key are the same.

  32. #32 Thomas Ernst
    nowhere
    2. November 2022

    A further guess, and I have no computer system to run these letters through (but neither did Shakespeare’s contemporaries): the key may be polyalphabetic and change after two letters (two sonnets): SI + 5 = YO, RB + 3 = CA; haven’t checked for N, because writing tires me.

  33. #33 Thomas Ernst
    nowhere
    2. November 2022

    Sorry – RB + 3 = wrong; got carried away by YO …

  34. #34 Thomas Ernst
    nowhere
    2. November 2022

    Perhaps Matthew used the 1609 print and not a commented-to-death modernized text because the last line of the first stanza of Sonnet 52 comprises 40 letters if you keep the 1609 final “e” of “seldome”: “For blunting the fine point of seldome pleasure”.
    No other line in 52 qualifies, and line 31/3 would only have 40 letters if “raignes” is modernized to “reigns”; in 1609 it’s 41.

    If 52/4 is a/the key – what a beautiful double-entendre to lead up to it via the first three lines:

    “SO am I as the rich whose blessed key,
    Can bring him to his sweet vp-locked treasure,
    The which he will not eu’ry hower suruay,
    For blunting the fine point of seldome pleasure.”

    But perhaps i am over-interpreting it.

  35. #35 Thomas Ernst
    nowhere
    3. November 2022

    If you line up the first eleven stresses of Sonnet 52 (did not get any further) against its line 4, i. e. FOR BLUNTING = SIR BKBTSLTW, the following emerges:

    F=S, O=I, R=R, B=B, L=K, U=B, N=T, T=S, I=L, N=T, G=W ….

    Perhaps a shifting auto-key with a couple further tricks in its gear; but it’s too late an hour for me to continue. However, the non-transposed letters R=R and B=B, the simple Caesar on the letters L=K, T=S, and twice the substitution N=T cannot be accidental. I lined up alphabets without “j” and “v”, but it does not matter whether you include those letters or not, the spacing will be the same. Yes, at this point I am convinced that the key is line 52/4, and that all three units, plaintext, key, and enciphered text contain 40 letters.

  36. #36 Thomas Ernst
    nowhere
    3. November 2022

    Of course there had to be a blunder my stress-count: 52/1 should begin with AA. However, that‘s even better, since it suggests a Trithemian w = vv.

  37. #37 Thomas Ernst
    nowhere
    3. November 2022

    … which somehow suggests the first letter of the plaintext to be a „W“ – Who, What, Where – Whatever. I would also suspect that „Friedman Ring“ is part of the plaintext. But that is an approach by brute-force, which I do not have anymore.

  38. #38 Thomas Ernst
    nowhere
    3. November 2022

    It occurred to me that only the stressed vowels may count, however you want to count diphthongs, phonetically or by their first letter. Then we are down to five letters = numerals, and line 52/1 would not be AARBK, but rather AAIEE = 11322 etc. If someone thinks that makes more sense, please take over. My gut tells me it‘s the first letters of the stressed words, counting a W only as one U resp. V – a little spelling/printing feature that would be historically more appropriate, especially since the plaintext begins with a W = V V, to which you can add as the third letter an H.

  39. #39 Thomas Ernst
    nowhere
    3. November 2022

    If my initials-only theory is correct, it needs a little revision. 52/1-8 would read AARBK BTSLT VVEHS BTPSP FFSAR SCLIS SVTPA CIICC (counting i/j as one letter); lines 31/1-8 need respective corrections. Karl Kraus once wrote: „The longer you look at a word, the longer it looks back at you.“

  40. #40 Bill Briere
    Wyoming, U.S.A.
    3. November 2022

    Norbert is surely correct in assuming that we’re now up to “NLRHH CTVNN SESIT ISIES AWAHC OSHNG ETOAR OVILE PETRA NSHPT” and “LOSBK TAEEO EAAEG RAHDU EHBNE DNENS EEIFY MYOKC ESBMA NTSNN” in the puzzle.

    As @David Vierra and @Norbert have said, this looks exactly like transposed English, right down to individual letter frequencies. Note also that the first string is 32% vowels, and the second is 40% vowels (if we limit ourselves to considering a, e, i, o, and u). So, the next–and maybe final–step is transposition.

    So what kind of transposition might this be? And should we run these two ciphertext chunks together end-to-end? Or weave them together? Or address them separately?

    Fragments like “GET” and “SEE” (and others less obvious), which match up between the two strings vaguely suggest that each half gets separate but equal treatment in either a grille or a route transposition.

    However, the slightly low vowel count in the first string and the slightly high vowel count in the second string (especially with the Ys thrown into the calculation) kind of nudge the argument toward merging the two.

  41. #41 Bill Briere
    Wyoming, U.S.A.
    3. November 2022

    If anyone needs it, here’s the interwoven string, alternating between the first and second strings: NLLOR SHBHK CTTAV ENENO SEEAS AIETG IRSAI HEDSU AEWHA BHNCE ODSNH ENNGS EETEO IAFRY OMVYI OLKEC PEEST BRMAA NNSTH SPNTN.

    If you pad it by columns into a 10×10, and then read across the rows, each row has a (somewhat) sensible mix of letters, including no fewer than 2 and no more than 5 vowels. But, yeah, that would probably be too simple, and nothing’s jumping out at me.

  42. #42 Thomas
    3. November 2022

    As Norbert wrote in #17, the chosen sonnets probably contain a hint at the cipher method used. It is unlikely that their numbers (31, 52) form a transposition key for a 4 x 25 rectangle, for Matthew could have chosen a sonnet whose number contains the digit 4. But I can’t think either of a particular order of jewels in a carcanet (maybe some kind of circular transposition?)

  43. #43 TWO
    3. November 2022

    It occured to me that the sonnets maybe are chosen for their numbers and perhaps not as much as their conent.

    If you add 3+1+5+2 you get the number 11.

    The cryptoexpert such as Bll Briere that Rot 11 seems a very interesting method that Matthew could have used for the dotted letters.

    And since Herr Schmeh published often article about double transposition I wonder of Matthew used that method and maybe the numbers 13 and 52 have to be manipulated to find the correct transposition keys.

  44. #44 TWO
    3. November 2022

    @Thomas

    You were looking for a 4?

    %2 divided by 13 is 4

    There is your 4.

  45. #45 Bernd Adameit
    Germany
    3. November 2022

    I see a possibility that the plaintext might start with SO I CAN OPEN.

    Let’s take the 50 characters hidden in the first sonnet, and arrange them in columns of five, thus:

    nlrhh
    ctvnn
    sesit
    isies
    awahc
    oshng
    etoar
    ovile
    petra
    nshpt

    The lines may be re-ordered as follows:

    sesit
    ovile
    isies
    ctvnn
    awahc
    nlrhh
    oshng
    petra
    etoar
    nshpt

    If we read down the first column, we then get “so i can open”, which would be somehow fitting with the themes of the sonnets and the nature of the challenge.

    The last two columns could hide the word “arranges” (as ar-ra-ng-es), which could be coincidence or indicative of some further transposition.

  46. #46 Bill Briere
    Wyoming, U.S.A.
    3. November 2022

    @Bernd, the problem there is that those 10 letters could just as easily be rearranged to spell other legitimate (and arguably relevant-sounding) sentence fragments, like COPIES ANON, A COIN OPENS, or I CAN POSE NO. Now, if any phrase also produced legible text in the adjacent columns, at the same time, then we’d be on to something.

    Since we’re dealing with a transposition, all of the letters in our sample will “look” like real English, frequencywise. Any random handful of these letters–and even the entire set of 100 letters–could easily be arranged to spell interesting things.

  47. #47 Bernd Adameit
    Germany
    3. November 2022

    @Bill: You’re absolutely right with your comments 🙂

    That was actually the reason I only talked about a (somewhat remote) possibility. What I like about the challenge is that this open forum allows us to get different kinds of input from different angles. Naturally, many of these suggestions will lead nowhere (just like mine, probably).

    🙂

  48. #48 Bill Briere
    Wyoming, U.S.A.
    3. November 2022

    @Bernd, yes, absolutely! 🙂 I confess that I’ve spent some time doing the same thing you’re doing.

    Just for fun, here’s a sentence using all 50 letters from the first string: “HEAR, I CAN POSE NOTHING WHICH IS LESS RELEVANT THAN TV SPORTS.”

  49. #49 Thomas Ernst
    nowhere
    3. November 2022

    Hello Klaus, please feel free to remove all my comments on this cipher. Giving it a Go by ignoring the dots apparently was the wrong approach. The best to all of you!

  50. #50 Norbert
    3. November 2022

    Short report: Since David’s comment #19, the triad of Shakespeare, Bacon, and Friedman keeps running through my head, so I went to the library today and picked up “The Shakespearean Ciphers Examined” by William and Elizebeth Friedman. A joy to read! But doesn’t provide us with a new clue, I’m afraid …

  51. #51 Thomas Ernst
    Nowhere
    4. November 2022

    Trying to add something possibly more sensible: the six pairs of repeated letters suggest a polyalphabetic substitution; Porta gave the well known example of “DE”, which also applies to English, and then there is “ST”, and a few more. This means that letter repetitions in the plaintext would not show up as such in the cipher text. If there were three identical letters in a row, it would be a give-away (Heidel’s cipher, 1676), but of course there aren’t. I do not think the two “strings” should be intertwined, but stay separate. 31 may contain the poly-key to 52, and vice versa; this could be tried out “as is”. With Heidel’s polyalphabetic cipher, it was easier to figure out the plaintext than to reconstruct his polyalphabetic key. – The association of the Baconian “5” with a modern plaintext alphabet of 25 letters may be inviting, but the plain text, à la 1609, probably does not distinguish between i and j, u and v, vv and W, and may rather contain a few homophones.

  52. #52 Thomas Ernst
    Nowhere
    4. November 2022

    Stab in the dark on 31: NLRHH CTVNN SESIT = FIRST YOU DE…(tempting to continue with SERVE, but that does not fit; at any rate, the pattern may be substitution alphabet 1, substitution alphabet 2 on letters1 and 2, and 4 and 5 respectively, while the middle of a fiver remains in plaintext. If one removes the letters “J” and “W” from the alphabet, and substitutes U/V by only one letter, the distance between plaintext S and cipher H (no. 4 in the first fiver) is the same as between plaintext D and cipher S (no. 4 in the second fiver), i. e. 12 letters in between, IF I counted right. The main substitution alphabet would then consist of only 23 letters, not 25.

  53. #53 Thomas Ernst
    Nowhere
    4. November 2022

    31 ctd.: FIRST YOU DESERVE MY SINCERE CONGRATULATIONS … yes, some of the letters in the string need to be adjusted, but the pattern will be the same for the rest of the cipher for every fiver: 12 apart, 13 apart, plaintext, 12 apart, 13 apart.

  54. #54 Thomas Ernst
    Nowhere
    4. November 2022

    31 ctd.: FIRST YOU DESERVE MY SINCERE CONGRATULATIONS FOR THE SOLUTION OF … then the strings break down too much; doing the rest of 31 would just be guesswork.

  55. #55 Bill Briere
    Wyoming, U.S.A.
    4. November 2022

    @Thomas, I might be misunderstanding your proposal, but I wasn’t able to reproduce your results at all.

    At this point in the game, we really seem to have only a transposition cipher ahead of us. (Unless Matthew has deviously built a substitution that *looks* like a transposition …)

  56. #56 Thomas Ernst
    Nowhere
    4. November 2022

    Admittedly, I have not been able to open the GIMPs that Norbert kindly provided. My laptop is from 1609. – Should the dots appear in different positions to their respective cipher letters, ideally four, this may indicate four rather than two substitution alphabets. Also, in establishing the strings, the suggested alphabetic discrepancy 23/25 needs to be revisited. So far reading no. 31 has been like looking through a glass darkly – I think I am right because there are sufficient cipher letters to suggest so, but I cannot explain the mistakes.

  57. #57 Thomas Ernst
    Nowhere
    4. November 2022

    Brief addendum: “for the solution” does not sound proper; better would be “for having [solved]” …

  58. #58 Bill Briere
    Wyoming, U.S.A.
    5. November 2022

    I like Norbert’s suggestion that this might be a grille. If it is, maybe a generous bit of plaintext is suggested in the verses that we can use as a crib.

    A 10×10 grille is essentially a bag of Scrabble tiles, unless we have a generous crib or other information supplied, to get us started.

    Since we know that we’ve been given a fair challenge, we can assume that what we need has already been given to us and that this isn’t meant to be inaccessible to anyone who doesn’t have the patience to hill-climb for weeks.

  59. #59 Bill Briere
    Wyoming, U.S.A.
    5. November 2022

    There’s also a chance we’re dealing with a double columnar or route transposition, in which case the keyword(s) or route should/may be moderately intuitive or hinted at in the sonnets.

    “Obsequious” is the longest word in the puzzle and has a convenient length of 10, so maybe that comes into play. (“Blessed key” also has 10 letters.)

    The other piece to consider is whether the transposition was applied separately to each set of 50 letters, or if it was applied to the whole thing.

    So, identification of the specific system seems to be the essential first task here. Anyone have any thoughts on how to narrow the search space from here?

  60. #60 David Vierra
    5. November 2022

    @Bill Briere

    Transposition ciphers have always been hard to identify. The only historical method that comes to mind is the vowel-consonant test for identifying the size of the rectangle in transpositions that use rectangles. I think the best method we have, nowadays, is to simply put the ciphertext into every automatic solver we can find and see if any of them have convincing output. I have (and I’m sure many others have) tried all of the transposition solvers in CryptoCrack and CrypTool, with no luck.

    There is also Relkin’s method which I attempted earlier, which is described in his paper on Olum’s cipher:

    https://www.tandfonline.com/doi/full/10.1080/01611194.2021.1992686

    This method tries to find repetitions in the way letters are rearranged – if some part of the cipher uses (for example) letters #5, 8, and 13 in that order, and later on uses #15, 18, and 23 in that order, then that is a kind of repetition in the transposition method. That repetition will be visible (maybe) because the letter trigrams at those two sets of positions will both have high log-likelihoods.

    The manner of “repetition” I just described reminds me of a section from Military Cryptanalytics Part IV. It assumes that two Columnar Transposition ciphers in the same key had already been solved using the “multiple anagramming” method, which produced two plaintexts and also one list of numbers (a kind of “keystream” for general transpositions) which gives the order to read each letter in the ciphertext. Friedman remarks that the “repetitions” like [5, 8, 13] and [15, 18, 23] are isomorphic to each other, and all of the isomorphic sequences in the recovered “keystream” can be superimposed in order to establish the edges of the two transposition rectangles.

    But if the “keystream” is more or less unpredictable, then no repetitions/isomorphs will be found and there is no way to corroborate the anagramming of one part of the text with the identical anagramming of another part. This was the case for the earlier Friedman-Ring challenge by Armin Krauß, where the keystream was created mathematically. This challenge was solved by searching a large corpus of text for a section with identical letter frequencies to locate a quote which was enciphered. The mathematical scheme that created the keystream was only discovered after the fact. This is the same approach Nils attempted for this challenge in #26.

    https://scienceblogs.de/klausis-krypto-kolumne/2021/08/11/christoph-tenzer-ist-der-neue-traeger-des-friedman-rings/

    Some kinds of route transpositions can be identified because they leave many fragments of plaintext intact, and don’t do a good job of mixing up the vowels and consonants. The largest readable piece of text I can see is “TRANS”, which makes me look for the rest of the word and find “SITI”. But this may be just a coincidence.

  61. #61 David Vierra
    5. November 2022

    @Bill Briere

    Transposition ciphers have always been hard to identify. The only historical method that comes to mind is the vowel-consonant test for identifying the size of the rectangle in transpositions that use rectangles. I think the best method we have, nowadays, is to simply put the ciphertext into every automatic solver we can find and see if any of them have convincing output. I have (and I’m sure many others have) tried all of the transposition solvers in CryptoCrack and CrypTool, with no luck.

    There is also Relkin’s method which I attempted earlier, which is described in his paper on Olum’s cipher:

    https://www.tandfonline.com/doi/full/10.1080/01611194.2021.1992686

    This method tries to find repetitions in the way letters are rearranged – if some part of the cipher uses (for example) letters #5, 8, and 13 in that order, and later on uses #15, 18, and 23 in that order, then that is a kind of repetition in the transposition method. That repetition will be visible (maybe) because the letter trigrams at those two sets of positions will both have high log-likelihoods.

    The manner of “repetition” I just described reminds me of a section from Military Cryptanalytics Part IV. It assumes that two Columnar Transposition ciphers in the same key had already been solved using the “multiple anagramming” method, which produced two plaintexts and also one list of numbers (a kind of “keystream” for general transpositions) which gives the order to read each letter in the ciphertext. Friedman remarks that the “repetitions” like [5, 8, 13] and [15, 18, 23] are isomorphic to each other, and all of the isomorphic sequences in the recovered “keystream” can be superimposed in order to establish the edges of the two transposition rectangles.

  62. #62 David Vierra
    5. November 2022

    But if the “keystream” is more or less unpredictable, then no repetitions/isomorphs will be found and there is no way to corroborate the anagramming of one part of the text with the identical anagramming of another part. This was the case for the earlier Friedman-Ring challenge by Armin Krauß, where the keystream was created mathematically. This challenge was solved by searching a large corpus of text for a section with identical letter frequencies to locate a quote which was enciphered. The mathematical scheme that created the keystream was only discovered after the fact. This is the same approach Nils attempted for this challenge in #26.

    https://scienceblogs.de/klausis-krypto-kolumne/2021/08/11/christoph-tenzer-ist-der-neue-traeger-des-friedman-rings/

    Some kinds of route transpositions can be identified because they leave many fragments of plaintext intact, and don’t do a good job of mixing up the vowels and consonants. The largest readable piece of text I can see is “TRANS”, which makes me look for the rest of the word and find “SITI”. But this may be just a coincidence.

  63. #63 Thomas Ernst
    Nekropolis
    5. November 2022

    Finally got the gimps, but their brightness – no disrespect – is “Augenpulver”. However, looking at Matthew’s original posts again closely – black dots on nice yellowed four-hundred-year old paper – it appears there are four different dotting-positions, as suggested earlier: 31/3 “parts” the “t” is dotted in the top left, 31/4 “thought” the “t” is dotted in the bottom right; 31/4 “friends” the “i” is dotted in the bottom left, 31/6 “religious” first “i” top left, second “i” bottom left; 31/2 first “A” dotted in the top, 31/3 first “A” dotted middle left; 31/5 “many” the “a” is dotted top left, 31/6 “Hath” the “a” is dotted bottom right, 31/8 “appeare” the “a” is dotted top right, 31/3 “teare” the “a” is dotted right middle; this may suggest four different positionings overall. 31/2 “Which” the first ”V” of “W” is dotted in the middle; 31/4 “which” the second “v” is dotted left middle, and there is another “w” which I can’t find anymore right now that, depending on your preference, is either dotted in the top middle, if you want to retain the Baconian ”w”, or is a “v” dotted in the top right. Other letters that, like “i”, are difficult to dot in four different places, like “r” and “t” appear to have those variants, too: 31/4 “buried” the “r” dotted bottom left, 31/6 “teare” the “r” is dotted top left. ”4” may be the central number: four quatrains, possibly four different letter-dotting-positions, probably Bacon’s earlier 24-letter alphabet, which does include “W”, but pairs “I/J” and “U/V”. Bacon or no Bacon, revisiting Matthew’s original letter pointing and grouping similia similibus should be a big step towards the solution.

  64. #64 Bill Briere
    Wyoming, U.S.A.
    5. November 2022

    @David Vierra, thanks. That’s a pretty good rundown of the options. I did consider the method you mentioned from MCIV. Maybe that’ll be something to come back to if we determine it’s two 50-letter DCTs and if we have a large crib. I still hope that there’s some kind of indicator to be found in what we already have–without brute force being the sole path to a solution.

  65. #65 Bill Briere
    Wyoming, U.S.A.
    5. November 2022

    @Thomas Ernst, I noticed the same thing, but I decided that the dot placements didn’t quite fall into clear-cut locations. I suspect that Matthew wouldn’t torment us with Dorabella-style ambiguity. Still, it does make me wonder.

  66. #66 Thomas Ernst
    Nekropolis
    5. November 2022

    The four dotting positions may indicate alphabetic substitution: left/right one letter back, one letter forward; top/bottom beginning and end of a word.

  67. #67 Thomas Ernst
    Nekropolis
    5. November 2022

    @ Bill Briere: if we go with „Dorabella style ambiguity“, then Matt‘s cipher is a fake …

  68. #68 Bill Briere
    Wyoming, U.S.A.
    5. November 2022

    @Thomas Ernst, yes, indeed! Let’s hope that’s not the case. 🙂

  69. #69 Thomas Ernst
    Nekropolis
    5. November 2022

    @ Bill Briere: your point about the torment is actually well taken: yes, repeated looking at and sorting of letters by their dots would be difficult on anyone‘s eyes. However, since the different positions do exist, this suggests that one „close reading“ should suffice, and that simplicity rather than complexity is at the core of this cipher; vide my suggestion 65.

  70. #70 Thomas Ernst
    Nowhere
    5. November 2022

    The dots may indicate preceding and following letter: the initial dotted b points at the preceding y, but I am too blind by now to look for the dot pointing at one of the letters o in bosome …

  71. #71 Bill Briere
    Wyoming, U.S.A.
    5. November 2022

    @Thomas Ernst, yes, that could be made into a tidy cipher. But I think it’s settled science that Bacon has already taken this seat.

    Fitting both of these into the existing ciphertext would be a superhuman feat. You’d be limited to superimposing a message onto the “ones” (the dotted letters), while allowing extremely limited motion to the left and right of the given letter.

  72. #72 Thomas Ernst
    Nekropolis
    5. November 2022

    Left: preceding letter; right: following letter; bottom: beginning of a word; middle: continued word; top: end of word.

  73. #73 Norbert
    5. November 2022

    I have tried to devise a statistical test that could support the assumption of a grille.

    For this, I assumed that the text was written horizontally (row by row) into the grille and also read out this way at the end. Of course, this does not need to be the case, but it’s common practice at least with the Fleissner grille. This procedure leads to the fact that from all bigrams (adjacent letters) of the plaintext the majority ends up in the ciphertext in such a way that the second letter stands somewhere behind the first. Maybe this can be dectected by statistical means?

    In our 100-character ciphertext (“nlrhh…”) , 100×99=9900 pairs of letters can be formed. From all such pairs their frequency in English plaintext is taken and from that the average is computed. The result is 0.004299.

    If we instead examine all pairs of letters in the ciphertext where the first letter holds a position somewhere before the second which gives only 4950 pairs, the average bigram frequency is somewhat higher: 0.004358. A higher result is indeed what one would expect from a grille, but is the small difference statistically significant?

    To decide on this question, I randomly scrambled the ciphertext 100,000 times and ran the same calculation on my computer. About 14% of the time, the result was greater than or equal to 0.004358.

    So, unless I made a fundamental error, this means that with a probability of 14%, the observation made was due to pure coincidence. With a probability of 86% an encryption system was used, which places pairs of letters AB into the ciphertext preferentially in such a way that A is located somewhere before B. That’s far away from being a prove, but for me it strengthens the grille’s position among the possible candidates. If the text snippets “TRANS” and “SITI” indeed belong to the plaintext word “transposition”, this could be consistent with some grille method and could be a crib that Matthew deliberately left to us.

  74. #74 Thomas Ernst
    nowhere
    6. November 2022

    @Norbert: if each dotted letter is divided into four sectors, could the dotted sector indicate the four turns of a grille?

  75. #75 Thomas Ernst
    nowhere
    6. November 2022

    The rounded letters, a, e, o, p etc. are the clearest indicators four a four-sectional dotting: in 31/4 the first a is dotted in the left upper corner, the second a int the right upper corner, the last a – may have missed one – perhaps the bottom right. The rounded “lead letters” are the most susceptible to establish a possible pattern of the angles. However, this is Bel[l]as[s]o-stuff …

  76. #76 Bill Briere
    Wyoming, U.S.A.
    6. November 2022

    Perhaps not statistically significant, but the positional coincidence between the letters of the first string compared to the second is 8%, while the figure is 14% when comparing one in direct order to the other in reversed order.

    …N…E…AN… (8%)

    N…IE…AR…E…E… (14%)

  77. #77 Norbert
    6. November 2022

    @Thomas Ernst: I think it’s important to keep in mind that marking letters was Matthew’s last encryption step. The Bacon sequence was already fixed at that point, meaning Matthew had no control which letters his dots would land upon. So I’m uncomfortable with the assumption that dots are deliberately placed on the right or left – if they happen to be placed on an l or i, that will be hard to determine unambiguously.

    I must confess that until now, I didn’t think the position of the dots on the letters mattered at all. But after looking at the pictures again, I have to admit that you can possibly make out a three-way vertical positioning of the dots on the letters (top / middle / bottom), even if it doesn’t always look clear to me. That would actually be a way to include additional information. With three different positions, three consecutive dotted letters would possibly encode one character. After all, there are 2 x 118 + 1 = 237 dots, which is divisible by three (a hint without any particular statistical significance though).

    As to the grille (if there is any): For Fleissner-style turning grilles there are solving tools that I’m sure many other readers of this blog besides me already have tried. Also, it seems to me that this type of grille, even though Fleißner didn’t invent it himself, was not yet in use in the 1600s. I like the idea that Matthew used a method for the transposition step that also fits the time of Shakespeare and Bacon. Pure gut feeling though. It would be possible, for example, to have several Cardan grilles used in sequence to cover all 100 letters of the text. Or some specific route. Wikipedia, s.v. Grille (cryptography), also mentions the so-called Trellis cipher, allegedly used by Walsingham now and then, though without citation.

  78. #78 Narga
    6. November 2022

    Just following the discussion, unfortunately I have no actually helpful ideas…
    I think the two-part nature of the challenge needs to come into play at some point. Otherwise one sonnet with 100 letters encoded could have been chosen. And their content suggests (at least to me) a secret/key relationship. But I have no idea at which step – probably there is a maximum of 4 steps necessary to decode.
    While the Caesar shift +11 looks correct, it feels a bit random at the moment for such a well-constructed puzzle. As I have unsuccessfully tried many transpositions and Grilles, I wonder if a substitution that is only similar to a shift by 11 was done instead, so that the statistics look overall correct but many less frequent letters are still wrong.
    I feel that we haven’t really spotted any of the clues/hints, yet.

  79. #79 Thomas Ernst
    Matratzengruft
    6. November 2022

    Given that this challenge is not even a week young, it is amazing how much time spent thinking about it has already gone into it. That’s a tribute to Matthew, as well as to all the participants. This cipher requires devotion, and it requires intelligence, whatever form the latter may take; and both of these – devotion and intelligence – are becoming increasingly rare in our world. –
    Grilling the grille: I have vociferated against ahistorical solution approaches for all of my thirty years of cryptological life. Then Fleißner is out; I forced myself to think along those terms because he/it became such a hot property early on in the discussion. Cardano is out, too, because his stuff is just too crude for this cipher. Whatever else Wiki has to say about trellisses and Walsingham and ham is as trustworthy as the “W“ the compositors used for printing the Sonnets. However, if a grille it must be, Vigenère may be worth a look. Not the always wrong c..p to be found online about “Vigenère”, but the real thing, available at bnf; for example this page/recto: https://gallica.bnf.fr/ark:/12148/bpt6k1040608n/f512.item, preceding his grille “en forme d’vun ciel semé d’estoilles”, https://gallica.bnf.fr/ark:/12148/bpt6k1040608n/f516.item. Vigenère was precise about dots. – A very promising place of orientation – one can’t always trust the stars – is the concept of bigrams, pointed out by Norbert and Narga; perhaps Polybian.

  80. #80 Thomas Ernst
    nowhere
    7. November 2022

    Vigenère f. 257r (star-trellis) may bring home the Bacon: “[..] il y a vingt colomnes & interualles descendans en bas marquees de leurs nombres par ordre: & seize transuersales rengees […] où se doiuent asseoir les notes qui doiuent representer les lettres, selon qu’elles leur correspondent en l’alphabet cotté à la main gaulche, & que l’ordre de leur situation le requiert. Mais d’autant qu’en tous les seize carrez de chacune de vingt colomnes […] ne se peuuent mettre plus de cinq notes, parce qu’il n’y a que cing differences d’assiettes […] ceste maniere de treilliz ne peult contenir que cent lettres […].” Five positions of a letter in a trellis of 16×20 allow for maximally 20×5 plaintext letters. This cipher appears to be a variation, super-imposing the positional value directly on the letters; that also explains the dots in the middle. Unlike with Vigenère’s trellis, however, there must be some sort of substitution involved in each set of 50, otherwise things would be too easy. 52 may contain the (polyalphabetic) key to 31, or perhaps it goes both ways; the plaintext comprises either 50 or 100 letters; the “end of text” dots at 250 letters in each sonnet were an effective “canard”. Now the dotted letters need to be assigned a number according to their dot-position – a possible counting mistake with the ”difficult“ letters “i” etc. should fall into place after all is said and done. Vigenère exemplifies a variation of the dot-values for the “laurel-trellis” f. 260r.

  81. #81 Thomas Ernst
    nowhere
    7. November 2022

    Should not have called the 250 a « canard »: their function was to indicate the Baconian fivers, while the dot positions indicate the Vigenarian fivers. So both are related to eachother; I assume that the placement dots are related to the placement of the Baconian « 1 ».

  82. #82 Thomas Ernst
    nowhere
    7. November 2022

    Vigenère begins his ciel d’êtoiles top left = 1, top right = 2, middle = 3 bottom left = 4, bottom right = 5. Thus the dotted letters of 31, first line with a pseudo-Baconian translation in parantheses, are:

    31/1: b4 (00010), n5 (00001), d2 (01000), a4 (00010), e4 (00010), d3 (00300), i3 (00100), h1 (10000), a5 (00001), l1 (10000), r4 (00040), s5 (00001);
    31/2: V3, h4, b4, k5, a1, u4, p3, p1, o1, d4, d1, d1/
    31/3: A1, n5, d3, h1, e5, r1, r4, n3, s4, L3, o3, a4, n1, a1, l1, o1, u2, l1, o3, n2, p4, r4, t1, s5/
    31/4: A3, d4, l1, l4 (or l5), h4, o3, e5, f3, i4 (?), e3, d1, i1, t1, h1 (?), g4, h1, t5, b4, r4/
    31/5: v2 (or w3?), a1, y3, h3, o3, a2, n3, o3, o1, u2, t4, e5, a3, r1/
    31/6: a5, t2, r4, e3, i1, i4, u1, s3 (?), l4, o3, e3, f3, m2, n2, y2, e3 (?)/
    31/7: s5, e3, s4 (?), f3, t2, h3, e2, d3, c1, h3, n3, o4, a2, p5 (?), r2/
    31/8: t5.

    This from a close-up reading on my iphone (nmore recent vintage than the 1609 laptop). As mentioned before: the few questionable letters should clear up in context; and i may have missed/messed up some letters.

  83. #83 Thomas Ernst
    nowhere
    7. November 2022

    52/1: h1, e3, c4 (or c3), h5, v3 (or w4), l1, e3, e2, k4/
    52/2: n1, b2 (or b3), r3, i2, m5, t3 (?), i3, s2, e3, v3, c3, e2, d1, t4, r2, a4, s2, u5, r1, e2/
    52/3: e3, v2 (or w3), h5, c3, h3, l5, o2, t4/5, e3, u4, r2, h3, o4, e4, u1, a1/
    52/4: 03, r4, f3, a1, r4/5, e3, f?, s3, t5, s5, s5, o3, e4, m3, n1, e4, n3, r3, a5, e3/4/
    52/5: T1, h4, f3, a1, r?, e3, f4/5, s3, s3/4, s5, o4, l2, e4, m3, n1, e4, n3, r3, a4, e4/
    52/6: e3, e2 (misprinted letter), l4, o3, m1, m3, n5, n1, t5, o2/3, n3, e3, a2, s4/5, e3, t1/
    52/7: L3, s3, f3 (?), v3 (or w4), o3, r4/5, h3, t4 (a guess), p3, l3, a3/5, a5/
    52/8: c3.

    May be you are supposed to only read Braille after doing this? Is the Friedman-Ring actually a white cane? – 52/6 second letter is a nice example of compositor-breakdown, which occurs so frequently in the plays, especially the first Folio, between compositors A, B, C etc. – Matthew’s dotting is precise, and a cross-comparison between specific letters should resolve most doubts. Still unclear whether v takes precedence over w. And there is probably something really evident by now, which I cannot see any more tonight.

  84. #84 Bernd Adameit
    Germany
    7. November 2022

    Norbert and David (and maybe others, too) suggested that Matthew might have left the word “transposition” as a crib in the first sonnet.

    Now, I’m fully aware of how problematic anagramming can be, as it can produce almost arbitrary results, but still…

    Playing around with the presumed crib “transposition” as a nucleus for anagramming, I find it interesting that the fifty characters hidden inside the first sonnet can be anagrammed as follows (if I’m not mistaken):

    “with transposition cipher challenges, sonnets have vast rh[…]” (admittedly this specific anagram falls apart unless the second part speaks about rhymes, rhapsodic potential or some such)

    In the end, this may be nothing but a silly exercise, but I do think that Norbert’s and David’s suggestion is worthwhile pursuing!

  85. #85 Thomas Ernst
    nowhere
    7. November 2022

    Someone please re-check (!): at a third close reading of 52 alone, I counted 113 dotted letters (list will follow). The dots are actually very tiny crosses.

  86. #86 Thomas Ernst
    nowhere
    7. November 2022

    A recount of 31 yields 106 dotted characters. Given a few counting errors on my part, the quantites of dotted letters per line of 31 correspond to the respective lines of 52, e. g. lines 1 eleven characters each, lines 3 twenty-four/twenty-six characters each, lines 7 fifteen characters each, lines 8 one character each; the remaining only one or two characters short of each.

  87. #87 Thomas Ernst
    nowhere
    7. November 2022

    It gets even a better: not only are the dotted-letter line counts of 31 and 52 identical, but so are there dotted letters AND their dot-positions, i. e. 31/1 = 52/1. The quickest way for me to prove this is the single t5 in lines 8.

  88. #88 Thomas Ernst
    nowhere
    7. November 2022

    In other words: 52 is the key against which to double-check your solution of 31. Any miscounts certainly make such a double-check necessary.

  89. #89 Thomas Ernst
    nowhere
    7. November 2022

    Tried a few substitutions on line one only, which yielded nothing. Meaning that the elements of the cipher text are „aligned“, but that the plaintext is spread across all eight lines.

  90. #90 Thomas Ernst
    nowhere
    7. November 2022

    There appear to be – only a surmise at this point – five different substitutions involved, each one identified the positional number of the dot.

  91. #91 Norbert
    7. November 2022

    @Thomas Ernst: I don’t quite follow. However, in comments #5 and #6 I logged which letters I think carry dots – could you perhaps write where exactly you made divergent observations?
    I cross-checked for myself and found only one little thing: In sonnet 52, there seems to be one additional dot between two letters (between a and p in “captaine”) which apparently marks the end of the ciphertext, as does the extra dot in sonnet 32. Seems I misgimped this one.

  92. #92 Thomas Ernst
    nowhere
    7. November 2022

    The next step is to compare 31 and 52 literally dot by dot, in order to establish a proper cipher text without mistakes. The rest will fall into place, I hope …

  93. #93 Thomas Ernst
    nowhere
    7. November 2022

    two things: please ignore all my comments on the identity of 31 and 52 – I looked at 31 one time too many! – @Norbert: will do, as promised – just need to double-check all the letters before sending them off …

  94. #94 Thomas Ernst
    nowhere
    7. November 2022

    @Norbert:
    31/1: b4, n5, d1, a4, e4, d3, i3, h1, a5, l1, r4, r1, s5,
    31/2: h4, b4, k5, a1, u4, p3, o1, d4, d1, d1,
    31/3: a1, n5, d3, h1, l4, r1, r4, n3, s4, l3, o3, a4,, n1, a1, l1, o1, u2, e1, o3, n2, g2, p4, r4, t1, s4,
    31/4: a4, d3, l1, h4, o4, s3, e5, f3, i4, e3, i1, t1, g4, h1, t5, b4, r4, i1,
    31/5: a5, y3, h3, o3, a2, n3, o3, o1, u2, t4, e5, a3, r1, n2(??);
    31/6: a5, t2, r4,l3, e3, i1, i5, u1, s4, l4, o3, e3, f3, m2, h2, y2, e5;
    31/7: s5, e4, s4, f3, t2, h3, e2, d3/4, c1, h3, n3, o4, a2, p4/5, r2;
    31/8: t5.
    Can‘t always distinguish between my handwritten e and l; otherwise, these are the letters in 31/3 in which I find the tiny superimposed crosses

  95. #95 Thomas Ernst
    nowhere
    8. November 2022

    The only reasons I can think of why Norbert‘s count and mine differ are technical: I have to read the dots off my iphone because it is too difficult to do so from my laptop (see above). So the iphone magnification may be at fault, though I doubt that. The other possible reason may be that Matthew, by whatever technical feat, „pre-gimped“ the images he posted so that any tool like „Farbenkurve“ would come up with a deceptive count of 50/50. Wouldn‘t be historical, after all …

  96. #96 Thomas Ernst
    nowhere
    8. November 2022

    These are the 2 x 118 = 236 cipher characters of 31 and 52. They correspond to each other numerically. Thus, 52 is the key to 31, and the plaintext comprises 118 letters:

    bndaedihalrs
    hbkauppoddd
    andherrnsloandalloulongprts
    adllhosefiedithghtbri
    wayhoanooutear
    atreeiiusloefmnye
    sesfthedchnoapr
    t

    hechwhleek
    nbrinimtisetvocedtrasure
    ewhchiloteurhoeua
    oruntnghitselmau
    thfarefstssolemnenrae
    eelomminntoneaset
    lsfworhtplaa
    c

    Am sure the right computer program can finish these off. I am – happily – not a computer program.

  97. #97 Thomas Ernst
    nowhere
    8. November 2022

    I apologize for my post-script in #95. It was uncalled for.

  98. #98 Peter Bull
    heaven
    8. November 2022

    This may be completely off the wall, but the following occurred to me. The sonnet 31 extract is neatly truncated above the folio number – C3. It is very noticeable as “things removed” (if you look at the original). One can also work out that sonnet 52 must be on folio D4. This hints at a gematria-based solution. Looking at the original printing, the initial letters of each sonnet (the T in 31/1 and the S in 52/1) jump out because they are four times bigger than the main text. By gematria, these letters are valued at 19 + 18 = 37. 37 can also be derived from 3 and 4 (folio numbers) because 4 cubed minus 3 cubed is 37. The significance of 37 may be because it is the gematria value of ‘dot’ (4 + 14 + 19 = 37). This would indicate that counting dots is important.
    Taking advantage of Thomas’ confirmed count of 118 dots duplicated, I began to wonder about the ‘holy’ or ‘religious’ angle from the first extract. It led me to look at Psalms 118 (no other book has this many chapters). The duplication of 118 directed my attention to verse 22, ‘The stone, which the builders refused, is the head of the corner.’ Could this be the plain text? A ‘thinly placed stone’?
    Trying to confirm this, I noticed that the Hebrew expression ABN MAShV HBVNIM (the stone which the builders refused – transliterated) has a gematria value of 513 in that language. Is this reflected in the 2 sonnet numbers? In the New Testament, the chief stone is Peter – so named in John 1, 42. The Greek expression συ κληθηση κηφας (thou shalt be called Cephas) has a gematria value of 1612. 1612 is the product of the sonnet numbers, 31 & 52.
    Is there method in this madness?

  99. #99 Thomas Ernst
    nowhere
    8. November 2022

    If 250/250 and 50/50 were but false semblances, so may be 118/118. Then the plaintext would comprise 236 letters. In order to solve this cipher properly, especially if a polyalphabetic key phrase is involved, we need to clarify each of the five dot-positions, as well as the V/W-question. There is a positive side-effect to my regrettable comment about software-solutions: probabably no such program exists that can deal with non-modernized Shakespearean English. This, in turn, suggests that the plaintext IS in Shakespearean English, and that it is to be found in the 1609 print of the Sonnets. It probably is not the rest of 31, but, more likely, a different selection from the 1609 Sonnets altogether, the contents of which compliment the first two texts.

  100. #100 Thomas Ernst
    nowhere
    8. November 2022

    The only « trigram », ddd of 31/2, are positional d4, d1, d1.

  101. #101 David Vierra
    8. November 2022

    @Bernd Adameit

    If you want to have even more fun with anagramming, try multiple-anagramming. Take the two 50-letter texts one above the other, and make anagrams using the vertical pairs of letters (e.g. wherever you put the first letter of the first text, you also put the first letter of the second text below it).

    Using this method, I managed to spell a famous name alongside a few legible words. The numbers above are the numeric position shared by the letters in their respective texts.


    39-21-12-15-00-24-41-22-06-42-03-11-14-13
    E__W__S__I__N__C__E__A__T__T__H__E__T__I
    C__H__A__R__L__E__S__B__A__B__B__A__G__E

    I could also get “CIPHER” above “THEKEY” using this method, but I have yet to form a complete message.

    I also tried to get CrypTool to do the multiple anagramming method for me, by putting the two 50-letter texts one after another and setting the transposition solver to “50 letter key, write by rows, transpose by columns, read by rows”… but none of the solutions were convincing. I’m not sure whether this means the two texts cannot be multiple-anagrammed, or whether it means a 50-letter key is beyond Cryptool’s abilities.

  102. #102 Thomas Ernst
    nowhere
    8. November 2022

    Perusing all of the sonnets (ed. Arden 3), the most appropriate finish to this cipher challenge would be the conclusion of no. 52, which, albeit in modernized spelling, runs a little short of 236 characters.

  103. #103 Thomas Ernst
    nowhere
    8. November 2022

    The 1609-print can be had – where else – at the BL: https://www.bl.uk/collection-items/first-edition-of-shakespeares-sonnets-1609.

  104. #104 Thomas Ernst
    nowhere
    8. November 2022

    In 1609, Sonnet 52 ends as follows:

    “So is the time that keepes you as my chest,
    Or as the ward-robe which the robe doth hide,
    To make some speciall instant speciall blest,
    By new vnfoulding his imprison’d pride.
    Blessed are you whose worthinesse giues skope,
    Being had to tryumph, being lackt to hope.”

    Letters only (counting w as w, and not vv), as follows:

    So is the time that keepes you as my chest
    Or as the wardrobe which the robe doth hide
    To make some speciall instant speciall blest
    By new vnfoulding his imprisond pride
    Blessed are you whose worthinesse giues skope
    Being had to tryumph being lackt to hope

    = 210 characters.

    Matthew may have added a brief congratulatory message to this, perhaps:

    My congratulations to you Matt = 26 characters.

    Total of 236.

    Now comes the difficult part: proving this solution …

  105. #105 Thomas Ernst
    nowhere
    8. November 2022

    @Peter: since you mentioned it, I have been thinking about Psalm 118/22. Am probably wrong, but I find in the verse “The stone, which the builders refused, is the head of the corner stone” not a reference to a “a thinly placed stone”, but rather to a “headstone”, namely the one which the builders refused, indicating their rejection of mortality. However, “head” only occurs once in the verse, and “stone” twice, at the beginning and the end, thus the gematria value would differ with either combination, depending on whether you read 118/22 in Greek or in Hebrew.

  106. #106 Thomas Ernst
    nowhere
    9. November 2022

    @Peter: PS: I added the second « stone » to 118/22 according to Luther’s translation. Even if Luther may have gotten it wrong, the two «corner » words are still the same, implying the head’s thinking is based on faith which ought to be of the same solidity as stone.

  107. #107 Thomas Ernst
    nowhere
    9. November 2022

    My surmises remain as posted; however, since neither Vigenères fivers nor his 100 letters (see #80, 82) are relevant anymore (what a pity), the number of dot positions ought to be simplified/reduced to three horizontal levels; otherwise, there are a few too many iffy cases, especially between Vigenère’s/my dot positions 3 and 4. Since “3” does not fit in the grand scheme (it’s just the wrong gematria) Norbert’s suggestion that the dot positions may not matter at all becomes more appealing. And since anyone else could have just as easily figured the actual 236 in the early stages of the game, the focus shifts back to polyalphabets, probably keyed from within the sonnets. While finding the proper alphabetic substitutions if you have an inkling of the plaintext is not so difficult, re-assembling the key phrase can be difficult. Wolfgang Ernst Heidel (vide #51) is haunting me across my decades and his centuries.

  108. #108 Thomas Ernst
    nowhere
    9. November 2022

    Am sticking to the different dot positions, after all.

  109. #109 Thomas Ernst
    nowhere
    9. November 2022

    That the dot positioning is not random but intentional can best be seen in the final two words of line 31/2, « supposed dead »: two adjacent « p » the first of which is dotted in the middle, the following in the top; and the final three « d », of which the first one got hit in the belly, while the other two just look down on him. Perhaps they suppose him dead?

  110. #110 Thomas Ernst
    nowhere
    9. November 2022

    Have reduced the dot positions from 5 to 3 horizontals: top, middle, bottom. However, there are probably only two dot positions, which, according the shape of the letter, may be Left and Right, and Top and Bottom. – So far the only coincidence between the two ciphertexts and my suggestion for a plaintext are that each contains the letter « e » 29 times. Have not looked at the respective positions of « e » in both texts, and this is probably just that, coincidence. If not, it may imply that the most frequent letter remained in plaintext, while the others were transposed in two keyed polyalphabets.

  111. #111 Thomas Ernst
    nowhere
    10. November 2022

    « e » = « e » = wishful thinking.

  112. #112 Norbert
    10. November 2022

    For me it’s settled that the 2 times 50 characters “nlrhh…” and “losbk…” lead to the solution if we apply the correct transposition. But it seems that until we know the nature of the transposition, we will not get anywhere. Even assuming that both 50-character blocks were each transposed in the same way is not sufficient: much like David, I have been unable to find any results under this premise, and I’m sure others have taken this approach as well.

    It is therefore plausible to assume that Matthew hid additional information in the images. But where?

    I tend to think Thomas Ernst is right that the position of the dots on their letters somehow matters (although he draws different conclusions). I don’t see any other way Matthew could have provided additional information. However, I am completely in the dark as to how such information could be extracted from the positions.

    One observation: in the second image, some dots seem to be on a straight line, e.g. the dots on the B and the R in line 2, “bring”, together with long S and T in line 5, “feasts”, I and N in line 6, “comming”, and the H in line 7, “they”. But does this have any meaning? Rather not …

  113. #113 Thomas Ernst
    nowhere
    10. November 2022

    Since I began the debate about the dot-positioning, I should also like to end it. a) there is no common denominator to fit all letters, whether top-middle-bottom, left-right, or up-down. b) there are vagueries of dotting with identical letters, for instance the dotting of the lower curve of the “e”, of the curves of the regular “s”, similar meanderings in “o”, as well as in the central dotting of ”i” and “l”. These vagueries are minute but recognizable. c) overall, intentionally placed red herrings are a major facet of this cipher. Attempts to solve it could have just as easily started out with the pre-gimped Baconian 50/100/250, as with the actual count of 236 letters. In the latter scenario, there would have ensued a lively discussion about the different dot-placements, whether initiated by me or someone else. – This, in turn, makes my unproven solution more plausible: it is likely that someone could have counted the letters of the remainder of 52 against the 236 cipher letters, and would have been thrown off by the discrepancy of about twenty letters, whether counting the letters in 1609 or in any modernized edition. Another red herring.
    Thus the arena is open for polyalphabetic substitutions. I will limit myself to my suggested solution, i. e. trying to solve it backwards, but anyone mixing up the 236, regardless of dot position, may quickly come up with a completely different result.
    Having to begin somewhere, I lined up the first fourteen letters of 52/9, “So is the time that keepes you as my chest” against the first fourteen cipher letters in 31/1, and ran afoul on the 13th letter (h=h): 52/9 plaintext > 31/1 cipher letters: s>b, o>n, i>d, s>a, t>e, e>d, e>i, t>h, i>a, m>l, e>r, t>s, h>h, a>b. While this specific substitution is NOT correct, the four transpositions of letters into their preceding letter on such a short stretch are noteworthy (and nothing more than that): o>n, e>d, m>l, t>s. Lining up the only triplet “ddd” in the cipher text against the only three sequential letters “ghi” in 52, “vnfoulding his”, makes it clear that the polyalphabets involved do not run à la Trithemius, because the surrounding letters do not fit. Thus the transpositions, however few or many alphabets may be involved, would have to be keyed. Again: all depends whether you start carte blanche mixing up the 236, or whether you start backwards with a pre-proposed solution, as I have. As a matter of fact, it would help tremendously if someone ran the 236 through whatever software to see if a coherent text comes up. Just to get to the solution, because working on this cipher, with so many missteps, many on my part, is exhausting.

  114. #114 Norbert
    10. November 2022

    @Thomas Ernst: Adding red herring or not into our Caesar Salad with Bacon might be a matter of taste 😉 I myself trust the probability considerations.

  115. #115 Matthew Brown
    10. November 2022

    Hi all, I’ve really enjoyed following the discussions so far!

    To save everyone some time I will confirm that the images only contain the Bacon encoding.

  116. #116 Thomas
    10. November 2022

    Since Norbert has already brought home the Bacon, the question remains whether anything else (maybe the text chosen by Matthew, why these Sonnets? ) might give a hint which transciption method was used.

  117. #117 Thomas
    10. November 2022

    Edit: transposition method

  118. #118 YeS
    10. November 2022

    Maybe transposition is somehow connected with Sonnete composition – 14 lines and abab cdcd efef gg rhyming pattern?

  119. #119 Thomas Ernst
    Birnam Wood
    11. November 2022

    It’s time to ask of the plaintext alphabet: “How many letters dost thou really haue?” Bacon’s numerical binary has 24 letters (i=j, u=v), his “changed-font”-binary has 26 letters. There is no 25-letter alphabet, at least not with Bacon. A consideration of 24 letters only seems appropriate. Thomas Thorpe’s type-setters did not print phonetically. Replacing the only j by i would change “gpwsj” to “gpwsi”, and reducing u/v to v alone (or u, if you prefer) would change “ttxun” to “ttxvn”. In appearance but a minor difference; however, polyalphabetic shifts produce a butterfly-effect if you go from uneven numbered alphabets to even ones. It should also be rewarding to consider the ten fivers not just as a unit, but to reconsider alphabetical hotspots, such as the third and fourth fivers of 31: “hthxi xhxth”. – This may remoue from vs the means of all annoyance …

  120. #120 Thomas
    11. November 2022

    Two sentences from Lanaki’s Cryptography Course Lesson 16 (Transpositions):

    “Long groups of vowels or consonants show up when English is written horizontally and transcribed vertically; these may be assumed to be adjacent.

    The presence of parts of words are found with certain routes such as spirals and helps to identify the route.”

    Norbert’s result #20 has parts of words as well as a long vowel group in line 2. For example a spiral can yield both a vertical reading of horizontally written characters (and vice versa) and a vertical reading of vertical written parts (preserving parts of plaintext) as well as a horizontal reading of horizontally written parts (also preserving parts of plaintext).

    But sure you guys have already tried out several kinds of spirals, haven’t you?

  121. #121 David Vierra
    11. November 2022

    @Thomas

    I think I have mostly been experimenting with methods that write the plaintext into the grid in by a route, and then read the ciphertext out by rows, in the usual order. I find it harder to wrap my head around methods that write the text in by one route and out by another. Definitely worth exploring some more in that direction.

  122. #122 Gerd
    11. November 2022

    As the Bacon code as first step is confirmed now, it seems we are stuck at the nontrivial transposition step now. That reminds me of Klaus’ post about the messages from the ship Schleswig Holstein:
    https://scienceblogs.de/klausis-krypto-kolumne/2021/01/03/drei-weitere-ungeloeste-verschluesselte-nachrichten-vom-kriegsschiff-schleswig-holstein/
    With those messages of 55 chars each, we have the cleartext and the ciphertext, however up to now, no one could find the transposition system.
    Maybe another hint about the system is hidden in the images?

  123. #123 Thomas
    11. November 2022

    @Gerd

    Matthew: “the images only contain the Bacon encoding”. Hence there should be no hint hidden in the images. So only either the Sonnet’s texts or their numbers might indicate the method used. If Matthew wanted to provide a hint at all…

  124. #124 Tom Larsen
    12. November 2022

    1) I doubt there is a straightforward transposition, because:

    a. there are too many apparent words / word components preserved from the letters with dots from the original messages – whereas from a transposition they would look more scrambled

    b. the two parts of the message having the same lengths is suggestive that they need to be combined somehow – try lining up:

    BNDAEDIHALRSHBKAUPPODDDANDHERRNSLOANDALLOULONGPRTSADLLHOSEFIEDITHGHTBRIWAYHOANOOUTEARATREEIIUSLOEFMNYESESFTHEDCHNOAPRT
    HECHWHLEEKNBRINIMTISETUOCEDTRASUREEWHCHILOTEURHOEUAORUNTNGHITSELMAUTHFAREFSTSSOLEMNENRAEEILOMMINNTONEASETLSFWORHTPLAAC

    2) I tried adding (via XOR) the binary numbers from the two parts. There were some binary numbers which did not have standard Bacon equivalents. Nevertheless, offsetting the second part by 24 to the right, and wrapping around, then XORing did produce binary values which all had equivalents:

    GQISSROFDQXMARPRZIUNDUCSCEKWHSXNFLJENYIJGJPVMEIWGW

    (no other offset produced situations where all binary values after XORing the two parts had Bacon letter equivalents)

    This could be a Vignere, running-key, or autokey cipher, although I worry that there are too many assumptions down this rabbit-hole!

  125. #125 davidsch
    utr
    12. November 2022

    #122: I am not stuck. Although I think that some people, like Norbert f.e. will have the solution soon, seeing his quick progress curve.

  126. #126 TWO
    12. November 2022

    The author of this puzzle for sure did write a very nice wordplay.

  127. #127 Etsch
    12. November 2022

    Hello folks, i just wanted to share the ideas that i tried to solve the challenge so far:

    I started using Norberts revealed intermediate ciphertexts:

    C1 = nlrhhctvnnsesitisiesawahcoshngetoarovilepetranshpt
    C2 = losbktaeeoeaaegrahduehbnednenseeifymyokcesbmantsnn

    Approach A)

    I tried several programs to test for route transpositions – no success, as probably many of us did.

    Approach B)

    I tried some affine approaches, i.e. assuming that the transposition was executed by picking every $c_i = a_1*p_i+b_1 mod (100)$ letter from a plaintext subset 1 and every $c_i = a_2*p_i+b_2 mod (100)$ from a plaintext subset 2 for all
    combinations $a_1,a_2,b_1,b_2 in [0,99]$ (The reverse step is then to compute $(c_i-a_1)*b_1^(-1) = p_i mod (100)$) – no success, as probably some of us already tested.

    Approach C)

    C.1) If you assume that C1 is the only ciphertext and C2 is the key, you could for example assume that the transposition was done by sorting C2 lexicographically and then the same transposition was applied to the plaintext.
    To decrypt, you have to reverse this process. I.e. first sort C2 and apply the reverse ordering to C1. (Matthew could have sampled C2 randomly from the english letter distribution to fool us). This was no success. I also tried to apply several Caeasar shifts to C2 and then do the reverse ordering. Again, no success.

    C.2) Then i tried to combine C1 and C2 in various ways. Concatenation: C1|C2, Interweaving_1: C1 and C2 (C1 first), Interweaving_2: C2 and C1 (C2 first),
    Interweaving_3: C1 and C2 (C1 horizontally and C2 vertically). Using these combined ciphertext i tried the reverse order technique using all substrings of length 100 from all Sonnets 1 – 154.
    Again, no success.

    Approach D)

    I started to look at the Trellis cipher, which uses a Chessboard layout. I filled the chessboard with all cipertext combinations from C.2) and looked for a closed knights tour (like Wikipedia suggest).
    I didnt managed so far to write a program which simultaneously tries to find a closed knights tour on a 10×10 chessboard and to generate english text. (My Program until now only finds words fragments, which are probably random). You could also try to eyeball a solution, but one gets mostly stuck after a several moves. For example one can use the combined ciphertext Interweaving_1 to generate a partial “plaintext” starting with: “NEW IDEAS TO SEEK TERMS IN” but it fails afterwords and it is not guaranteed that this starting tour is a valid starting sequence that still leads to a complete closed knights tour.

    I am still with approach D) – perhaps someone with better coding skills is able to write a program, which generates complete knights tours combined with a hill climbing approach to generate readable text.

  128. #128 Tom Larsen
    13. November 2022

    Knight’s chessboard is an interesting idea, though I ran a Boggle-solver-esque algorithm (hopefully implemented correctly) over the grid to find connected words following knight’s chessboard rules. (results on GitHub)

    Nothing particularly striking except

    RIVERBANK [the Friedmans worked there; would fit with the theme of Shakespeare and Bacon]
    PATRIOT?
    SONNET(ING)
    ARCHIVE
    TROOP(S)

    however…. I worry this may just be a selection bias.

  129. #129 Marc
    14. November 2022

    @TWO
    T H I S I S T R U E I N S O M E W A Y W E L L D O N E

  130. #130 Peter Bull
    Heaven
    15. November 2022

    Given there are actually 119 dots in each text (118 + end-stop), Psalm 119 may be indicated. This is ‘the alphabet psalm’ and gets 8 verses for each named letter of the Hebrew alphabet (8 x 22 = 176). It is the longest chapter in the Bible. Anyone for Hebrew?
    In the context of the Sonnets, 119 is also significant because two sonnets are so numbered – the famous 116th sonnet was printed with an inverted 6. ‘Let me not to the marriage of two texts admit impediments’. That must be line 1612, which is 31 x 52. Mmmm – is this going somewhere?

  131. #131 Bob
    Minnesota
    15. November 2022

    Undoubtedly Norbert is correct in his work thus far. The statistics are pretty obvious. No sense rehashing what has already been done.

    I wanted to explore the idea that we might be seeing certain portions of the plain text simply by virtue of the transposition method. The most obvious possibilities are the fragments “trans” and “siti” (which would form part of the word “transposition”) and the fragment “seeify” (which could be “see if you”). These promising fragments appear at positions 43-47, 13-16 and 80 – 85, respectively (assuming you string both sets of 50 characters together).

    My hypothesis, which you should feel free to reject, is that if the plain text is “poking through” then fitness measures of the intermediate text using bigram, trigrams, etc, should be better the the same fitness measures using the same intermediate plaintext letters, but distributed randomly.

    Using bigram statistics, I compared the intermediate plaintext with 1,000 random rearrangements of the same letters. I found the intermediate plaintext to have no better fitness than the same letters randomly distributed. In fact, in 623 cases, the random letters scored better.

    Again, feel free to poke holes in this method, because I’m actually not sure it’s statistically sound. I had hoped it would prove that we ARE seeing the plaintext. We might be, but this method did not provide that proof.

  132. #132 Magnus Ekhall
    Borensberg
    15. November 2022

    I have made a simple experiment to see if the intermediate plaintext of 100 characters could be an anagram of a substring out of Shakespeares work, but to no surprise it does not seem to be the case.

  133. #133 Tom Larsen
    16. November 2022

    The run of 11 consonants at the beginning is odd – only ~0.15% of random samples of nlrhhctvnnsesitisiesawahcoshngetoarovilepetranshpt
    losbktaeeoeaaegrahduehbnednenseeifymyokcesbmantsnn

    have 11 consonants at the beginning. There may be nulls sampled at standard English letter frequencies, especially if a grille is involved.

  134. #134 Marc
    16. November 2022

    The Bacon code (UCTSEBKD) and Caesar (6) gives:

    own my vex

    VEX could stand for KEY. To get this word, you just need to change the key to RGF. So maybe this steganographic message was made simply to transmit this key information.

  135. #135 Tom Larsen
    17. November 2022

    In terms of route transpositions – assuming a 10×10 arrangement, I ran the following routes:

    * Spiral matrix (inwards vs. outwards) (clockwise vs. anticlockwise)
    * Diagonal (single vs. alternating direction)
    * Row/column-wise (single vs. alternating direction)
    * L-shapes (large vs. small) (single vs. alternating direction)

    } in all transpositions
    for each inscription and takeoff combination.

    Nothing promising here, unfortunately! Could be different routes, or different dimensions, or perhaps we need to revise the Caesar +11 assumption.

  136. #136 Magnus Ekhall
    Borensberg
    17. November 2022

    Does anyone have a theory on why the text is split up in two different images with exactly 50 letters each?

    50 letters being the key and 50 the real message perhaps, but I have not been able to get anywhere with that yet.

  137. #137 Tom Larsen
    18. November 2022

    That is a central question Magnus. No idea….

    The run of consonants NLRHHCTVNNS at the start of the first message, and the run of vowels AEEOEAAE, suggest that …..

    1. I am seeing patterns that are not significant
    1. OR the vowels/consonants have been rearranged somehow
    3. OR they are indicators telling how to un-transpose potentially the rest of the message
    4. OR they are the result of a stealth substitution (i.e., substituting probably mono-alphabetically at standard English letter frequencies) …. but this is unlikely

  138. #138 bob
    Minnesota
    18. November 2022

    @Tom Larsen,

    The “rareness” question can be answered statistically. If you take the frequency count of the intermediate plaintext (which has 36 vowels and 64 consonants), and randomly draw 11 letters, you should expect to get 11 consonants .53% of the time. In a cipher with 100 characters, there are 90 different ways to draw 11 letters in a row. Therefore, 11 consonants in a row is expected to occur, on average, 48% of the time. What makes this case somewhat curious is that it’s at the beginning, but if we relax that constraint, it’s not rare at all.

    8 vowels in a row is more unusual. There it’s 1.5% of the time. Curious for sure, but not impossible.

    Transposition ciphers tend to group consonants and vowels together. I’m more inclined to think these groupings are an artifact of the method used as opposed to some deliberate technique, but of course I can’t prove that. I will note that there are 100 characters, 36 vowels and 64 consonants. All of these numbers are perfect squares. This result isn’t strange statistically, so its probably nothing (English is roughly 38% vowels), but it makes me go “huh”.

  139. #139 bob
    Minnesota
    18. November 2022

    @magnus,

    Several theories have been tossed about here. These include:

    1) you need to somehow interweave the two texts;
    2) one is a key and the other is the real CT;
    3) they are two plaintexts encrypted the same way, presumably to aid in decrypting;
    4) it’s random and/or irrelevant; or
    5) something else entirely.

    My money is on either #3 or #5, in that order, but I don’t eliminate #1.

    Specifically regarding #3, there has been the suggestion that multiple anagramming could yield a solution. If the transposition method is straight forward, then that is certainly true, though nobody has found it yet.

    However, let’s say each set of 50 letters is rearranged with some random or pseudo random key, and the same key is used for both texts. There, the keyspace is mindbogglingly huge (50!). Even with two identically encrypted ciphertexts, hillclimbers would be faced with an ungodly number of local maxima AND no guarantee that the global maxima is the right answer. I’ve been down this path with software, and its not hard to find a gibberish decryption that scores better than regular English (at least when using quadgram scoring.) Maybe someone can make a dictionary attack work better.

  140. #140 Rizzie
    Montreal
    19. November 2022

    Grille idea. 3 photos to illustrate the thought (all three photos are in the same link, just scroll).

    https://imgur.com/a/tkBmubZ

    PHOTO 1: the two lines of cipher-text one on top of the other. See the letters C-O-D-E falling at the 25th position from the right, and the left.

    PHOTO 2: Friedman’s “Grille” Christmas Card. (Stray thought: Is Sonnet#52 referencing 52 weeks in the year? “Feast Days”… (And Xmas, the 25th of 31 days, falling in the 52nd week?)).

    PHOTO 3: the 2 line cipher-text inputted into Friedman’s grille example, with the letters C-O-D-E anchoring the centre, like a keystone.

    Stray thought: “Quarto” is a page folded into four sections.

    Just an idea…

  141. #141 Thomas Ernst
    Cimmeria
    19. November 2022

    Bellaso 1564 à 24.

  142. #142 Bill Briere
    Wyoming, U.S.A.
    19. November 2022

    @Rizzie, nice ideas.

    The 1928 Friedman key doesn’t work on the current challenge, but something in that style would be a clever connection to Friedman/Bacon/Shakespeare.

    Just a few minor corrections to the Friedman puzzle solution you linked:

    FOR CHRISTMAS GREETINGS IN ’28
    WE USE A MEANS QUITE UP TO DATE
    A CRYPTOPHOTOTELEGRAM HERE
    BRINGS YOU WORD OF XMAS CHEER

  143. #143 Rizzie
    Montreal
    19. November 2022

    @Bill Briere – thanks for your comment.

    Unfortunately, I can’t make the idea work, (especially as – like you pointed out – the perforations don’t work on the cipher-text and I have no other ideas on where potential perforations might have to be!)

    … but there’s something about the letters C-O-D-E forming a square exactly in the middle of the two lines (when stacked on top of each-other) that I can’t get out of my head!

    However perhaps it is just a coincidence.

  144. #144 Bill Briere
    Wyoming, U.S.A.
    20. November 2022

    @Rizzie, I agree that the C-O-D-E being a hub on a turning grille is really tempting. The letters are even “in order” around the four quadrants to suggest rotation! But still, coincidence seems most likely there.

  145. #145 Bill Briere
    Wyoming, U.S.A.
    20. November 2022

    Matthew has only chimed in once, so far, at Message #115, so I suspect we’re all on track with our hunt for the transposition type. But this problem of identifying a transposition, where the specific system, key(s), and all plaintext are unknown, is a biggie.

    Back in Message #73, @Norbert came up with a clever bit of evidence that leaned toward a Fleissner grille. Does anyone have any thoughts on his diagnostic test or further angles like that that could be pushed?

  146. #146 Bill Briere
    Wyoming, U.S.A.
    20. November 2022

    Back in Message #73, @Norbert came up with a clever bit of evidence that leaned toward a Fleissner grille. Does anyone have any thoughts on his diagnostic test or further angles like that that could be pushed?

    Since this is a fair and carefully designed puzzle, we should be able to make certain assumptions.

    For example, the step or steps ahead really should consist of no more than either a single transposition (including grilles here) or of an intuitive/hinted-at double transposition (including even two different transposition types here).

    Sure, it’s still possible that the challenge could be a substitution, with one sonnet being the ciphertext and the other the key, and with letter frequencies in both of them disguised to look like transpositions, but that seems a little too far out. And I think Matthew probably would have nudged us by now, since all of our efforts have been honed in on transpositions.

  147. #147 Bill Briere
    Wyoming, U.S.A.
    20. November 2022

    We should also keep in mind that there might be two 50-letter cryptograms keyed the same and meant to be solved in depth. That would be entirely in fair territory.

    I see that @David Vierra did some multiple anagramming of one half against the other, but no joy (Message #101). And brute-force dictionary attacks and hill-climbing attacks haven’t produced a solution yet–but has that been tried only on the full 100?–what about the two halves separately?

    Even having one text forward and one in reverse would be entirely fair, if other factors were relatively simple (my Message #76).

  148. #148 Rizzie
    Montreal
    20. November 2022

    @Bill Briere – your comments summarize a lot of what I’ve been mulling over as well. I’ve also tried treating the two lines separately, but not necessarily as two separate grilles – perhaps that could be worth thinking about?

    On a separate tangent, why do you think sonnet #31 was chosen for this? #52 seems on-target for a puzzle like this, with the words like “KEY” and “UP-LOCKED” (is this directing us “up”?) “TREASURE” etc etc.
    But #31 seems less… pointed. Other than “things removed that hidden in there lie”… there’s not much to it. So is there something in that final line we should be thinking about? Otherwise, #31 seems like an arbitrary choice, unless we should be paying attention to its number.

    Another random thought: I can’t shake that a “Quarto” is a page folded/segmented into 4 parts.

    Or… that we have Sonnets 31 and 52 from the “Quarto”… (4)-3-1-5-2… {1-2-3-4-5?}

    Anyway, Sorry for the stray ideas. Sharing on the off chance that one of them is *something* sparks an aha! moment in anyone : )

  149. #149 Bill Briere
    Wyoming, U.S.A.
    20. November 2022

    @Rizzie, two separate grilles (one for each sonnet) would be problematic, I think. The size restrictions would require you to use some kind of nonstandard arrangement, incompletely filled grilles (8×8, for example), or a bunch of nulls–none of which seems very elegant or fair.

    It’s definitely worth mining the two sonnets for hints on the system or keys. I don’t have any good ideas there, though.

  150. #150 Rizzie
    Montreal
    20. November 2022

    @Bill Briere

    Fair point! Definitely a fool’s-errand. This is making me nuts ; )

  151. #151 Thomas Ernst
    Cytherea
    20. November 2022

    Klaus’s previous “Friedman-Cipher” was designed by Norbert, and solved by Matt. Nothing like a little alphabetic reciprocality: nb → mb → nb. The 1564-Bellaso does not work; tried a few variants. The 1555-Bellaso looks very promising, but Matt would probably not have used it in its original format (Nota Bene: https://opus4.kobv.de/opus4-udk/frontdoor/index/index/docId/1296). Then there is the recently (2019) discovered Venezia-Bellaso of 1552, apparently a “Jugendsünde“ inspired by Trithemius’s “Polygraphia” (which had its first reprint in 1550). Since no cipher-example of the 1552-Bellaso exists, would it not be nice to have (a variation of) it here?

  152. #152 Thomas
    20. November 2022

    Line 1 contains a consonant cluster at the beginning and a plaintext part (‘trans’) at the end, in line 2 we have a vowel cluster at the beginning and another plaintext part (‘seeif’) at the end. So it appears we have both garbeled passages and preserved plaintext parts. Each time the reading direction of a rectangle/aqare based transposition system differs from the writing direction ( horizontal/vertical or vice versa), the plaintext gets totally garbeled. When the reading direction is the same as the writing direction, plaintext parts are preserved. This might indicate that a transposition with altering writing directions was used. The only one I could think of up untill now is a spiral. But a 10 x 10 square would preserve two plaintext parts of length 10 ( one forward and one backward), two of length 9 and so on, which isn’t the case here. If the plaintext parts aren’t longer than 5, this requires a rectangle with not more than 5 rows or columns. I keep looking for other systems with altering writing directions.

  153. #153 Bill Briere
    Wyoming, U.S.A.
    20. November 2022

    @Rizzie, you could still make your idea of multiple grilles work (your message #148, plus some stuff from your Message #140), if you were to pluck out the C-O-D-E sequence as a hint/nulls, leaving you with 96 letters of ciphertext.

    You would then need to use either two 7×7 grilles or four 5×5 grilles. The center square on both sizes would be unusable, since all four rotations would share it, so you’d have (7×7)-1=48 twice or (5×5)-1=24 four times. Furthermore, the “C-O” portion might hint at normal order in the first string, while the “E-D” might hint at reversed order in the second. The four-grille option would be stretching–but not snapping–the limits of sensible vowel distribution (between 29% and 50% vowels).

    Incidentally, the Friedman turning grille you mentioned (Message #140) used 24 holes to encipher 96 characters, but it was designed in a nonstandard format with 25 cryptographically cosmetic nulls in an 11×11 grid.

    There are lots of creative route transpositions (including grilles in that category) that might be reasonable, if Matthew has hidden some guidance in plain sight. However, his statement that “the images only contain the Bacon encoding” (Message #115) could be taken to mean that there aren’t any clues to be gleaned there.

  154. #154 Bob
    Minnesota
    20. November 2022

    @Bill Briere,

    Hi Bill. I have tried multiple anagramming using a hillclimber assuming two 50 letter ciphers in depth. No joy. I’ll caveat this by saying the setup was probably too loose: I wanted to test if the key has length 50 and randomized or pseudo random. Unfortunately, the key space for that is just too big. The hillclimber would get stuck in local maxima with a better fitness score than regular plaintext. I think we would need considerably more depth to get a solution if this is indeed the method.

    Regarding Norbert’s grille math, It’s a heck of a brilliant idea for a test (and Norbert is obviously smarter than I am), I’m just not sure the result tells us that much. 14% is like rolling an 8 with two dice, which isn’t that rare. Plus, beyond throwing it into cryptocrack or cryptool (which I suspect many of us already tried) I wouldn’t even know where to begin trying to identify a grille.

  155. #155 Rizzie
    Montreal
    20. November 2022

    @Thomas – I agree with your thoughts, I have also tried various methods of trying to “zipper” (backwards/forwards) the 2 lines together, to no avail. I’ve also tried to to this in a grid formation, routes, etc., — just any way of getting those runs of consonants and vowels to knit together, and I can’t seem to make it happen!

    @Bill Briere — you’re spot on with the “the limits of sensible vowel distribution” remark, re: splitting grilles. The second string is vowel-heavy, especially if you count “Y”.

    (Maybe overlaying string 2 grid over string 1 grid, like a checkerboard, in some backwards/forwards letter arrangement, is an idea?)

    As you say, I am also wondering if there are hints/clues beyond the 2 cipher strings we are missing. Grrr

  156. #156 Thomas Ernst
    Titanic, 15. April 1912
    20. November 2022

    Assumption: just like nature, this cipher has four elements:
    plaintext → cipher-alphabt → key-phrase → ciphertext. If 31/52 are not enciphered à la Bellaso, the difference of letters in the cipher alphabet and in the key phrase may have been supplanted by a different intermediate step, such as partial non-transposition.
    The letters e (2), k (2), l (1) occur only in 31; the letters b (2), n (2) o (1), q (3), s (2), z (2) occur only in 52; the letters f, m, y occur in neither. The complete absence of the twelfth letter “m” suggests some sort of reciprocal jiggling between m/x, or m/z. Any of the Bellaso-ciphers works just as well with 22 as with 24.

    Assumption: the alphabet used for plaintext, cipher-alphabets, key-phrase and ciphertext comprises 24 letters (i=j, u=v).

    Assumption: the key phrase is either:
    1) soami asthe richw hoseb lesse dkey
    (semantic: first verse/line of Sonnet 52, à la Belasso’s first verse of the “Aeneid”; however, then the Bellasonian vowel-sequence “oaie” would end on an invisible “u/v”.

    2) soami asthe richw hoseb lesse dkeyc anbri nghim tohis sweet
    (numeric: the first 50 letters of Sonnet 52).

    3) soami asthe richw hoseb lesse dkeyc anbri nghim tohis sweet vploc kedtr easur ethew hichh ewill noteu ryhow ersur uayfo.
    (numeric: the first 100 letters of Sonnet 52. The guillotined “fo|r” is in line with separated “thi|ngs” in 31 and “ca|ptaine” in 52. i. e. the key did end abruptly, just like the lives of many Parisians in 1792.

    Some observations about the presumed key-phrase, relevant or not:
    1) Frequency count across the key à 100:
    a (5), b (2), c (4), d (2), e (14), f (0), g (1), h (10), i (7), k (2), l (4), m (2), n (3), o (7), p (1), q (0), r (7), s (9), t (6), v (5), w (5), x (0), y (3), z (0). No f, q, x, z.

    2) Frequency count of ciphertext and key juxtaposed:
    cipher: a (3), b (2), c (11), d (6), e (2), f (0), g (4), h (10), i (7), k (2), l (1), m (0), n (2), o (1), p (9), q (3), r (3), s (2), t (14), v (3), w (7), x (5), y (0), z (2).
    key: a (5), b (2), c (4), d (2), e (14), f (1), g (1), h (10), i (7), k (2), l (4), m (2), n (3), o (7), p (1), q (0), r (7), s (9), t (6), v (5), w (6), x (0), y (3), z (0).

    The numerically sequential occurrences of “h”, “i” “k” in both sets are identical, and suggest a sort of limited non-transposition of letters, which would throw off any Bellasonian analysis. I tried Bellaso 1564 with SO AM, then even with his IO VE, but neither one worked. That’s why Bellaso 1564 is probably out.

    A comparison of letter-distances of cipher and presumed key yields:

    [c → s = 15 | a → o = 13 | g → a = 18 | w → m = 15 | w → i = 12 |
    r → a = 8 | i → s = 9 | k → t = 9 | c → h = 5 | c → e = 2]
    [h → r = 9 | t → i = 14 | h → c = 16 | x → h = 10 | i → w = 12 |
    x → h = 10 | h → o = 6 | x → s = 20 | t → e = 10 | h → b = 18]
    [p → l = 20 | l → e = 18 | p → s = 3 | w → s = 21 | r → e = 12 |
    d → d = 0 | …

    The possible pattern of repetition breaks off after the first twenty-five cipher letters. If the [partial] substitution is Bellasonic, any two distances can stand for the same cipher-alphabet.

    At any rate, juxtaposing the suggested key-phrase(s) against the cipher text(s) should be rewarding. “Things done well and with a care exempt themselves from fear.” That’s 50 letters right there …

  157. #157 Tom Larsen
    20. November 2022

    We have to be careful with anagramming. ….. as transposition ciphers are tantalizing but often we see stuff not there. e.g. take these random rearrangements of the ciphertext:

    HHATNEAASSIMSBOAAGDOEATFNELNNVVISEECMRNNSPLYOEANEEINEHTOSTRCBPNHYEREKKNHSBCTHNISTOASIEEADSHURELWETGO

    Plaintext words: HAT, DOE, SEE, WET …. is it about a secret meeting with John/Jane Doe in the wet? …. maybe the letters are pulled out of a HAT…

    TTDARNIEAISBVECANLEONHNGTNELEACSSSEKSFSHSEVINHNNOHTHCOKORAHEAISRYWNEELAPTSEAYMNEEHIGEROOMEBSDBPATTUN

    LAP? SEA? ROOME? Maybe the sea is lapping against the shore of the island on which our intrepid adventurer has her ROOME

    MPEITYGESAKOREEHECNTSAURDOMATGHEBISRANNFALNRHEBNNNOESIBTVSEAKIPLICWETATSAEHSHODOEOCESNVNSLNHYNHSAETE

    The WET SEA again!!! And RAN.

    HNCEERSITPLLRESALEIAAHAGBHNTENOHASHNESEYOVNASTHONKEAOETKNSTRBEPITCETUNMNNAOEBNMODDEGYCSIRSAWFIVHSSEE

    ODD? TEN? Perhaps an auction? Or perhaps every ODD letter is transposed somehow?

    SIT, SALE, AAH, SIRS, SEE ….

    NEWEEVOECASKNOEABLEIENIOIHDEVSTBNRRNRTHNTMPLOAIYEESRTFTHATLHAYOSANAGEHESNCAPENGCEBSTISHKODNESASHMSNU

    NEW, ASK, ABLE, THAT, NAG, CAP, TIS, SASH ….

    ABANERKISEASNLOHHTNNTHYSERVNTENNAHTENCGSOOIBSICARAGASLDOMPSCNNLIHSEENVESEAEEWYKEOIEFRSPTBUTEHHADEOMT

    BANE? SEA again? TEN CARs? GAS …. that fits with the car theme. SEA and SEEN? BUT HAD?

    This is why transposition ciphers are so tortuous! And it’s why I’m pretty skeptical of the ‘IT IS’, ‘GET’, ‘VILE’, ‘TRANS’, ‘SEE’, ‘IF’, ‘YMY’ as words from the plaintext.

  158. #158 two
    20. November 2022

    @Marc

    Have a cookie.

  159. #159 Bill Briere
    Wyoming, U.S.A.
    21. November 2022

    @Bob, yeah, the matter of ID-ing transpositions is a tough one–aside from the current method of just trying everything and seeing which one cracks the cipher. Definitely room for research.

    @Tom Larson, you’re right that we have to be careful with how we use anagramming. But the examples you give show rearrangements of single ciphertexts. I think what most of us have been talking about are situations involving *multiple* anagramming, in which moves made in one string of ciphertext are mirrored/checked in another ciphertext, on the presumption that they are keyed the same (and are of the same length, as we might have in the current challenge). That’s a legitimate cryptanalytic technique, when managed responsibly.

    As for the snippets of apparent plaintext that usually show up, those can sometimes be starting points for entry into route transpositions, so it’s worth paying attention to any that appear (and, yeah, some will always appear, whether they’re tied to real plaintext or not).

  160. #160 Tom Larsen
    21. November 2022

    PS – some plots which highlight possible cribs:

    https://user-images.githubusercontent.com/39791708/202929039-8f6d711d-97b1-4f95-8fbd-aa4a20dca0c7.png

  161. #161 Tom Larsen
    21. November 2022

    And here are the common bigrams (assuming 10×10 grid):

    https://user-images.githubusercontent.com/39791708/202929417-8aae47c8-2b6d-4850-ad87-b9224b7571ce.png

    They may help someone!

  162. #162 Thomas Ernst
    Collapsible A
    21. November 2022

    PS: since the first « u/v » does not occur vntil letter 51 of Sonnet 52, « vplocked », the key probably comprises the first 100 letters, and the assumptions of only 25 or only 50 key letters can be thrown overboard …

  163. #163 Norbert
    21. November 2022

    Since the transposition part is quite obviously hard enough, it might be worth asking why a relatively simple Caesar Shift is included at all. Just a thought: could it perhaps be meant as a hint? Does the transposition have something to do with the number 11? SHAKESPEARE has 11 letters … The turning grille of the Friedman Christmas card (#140) is 11×11 letters and can be easily modified to hold exactly 100 characters … As I said, just a thought. (Of course, one might argue that the number 15 could just as well be hinted to as Caesar +11 is equal to Caesar -15.)

  164. #164 Marc
    21. November 2022

    Just a small addition to #134:

    Sorry, I did not read all the comments here carefully. The plaintext I published there is not a result of Norbert’s approach to interpret these tiny dots as a Bacon cipher, but the different fonts of the letter S (s/f):

    Thy bo(A)ome i(B) endeared with all heart(B), etc.

    In the first part f stands for A and s for B, in the second part it is the other way round (s -> A and f -> B).

  165. #165 Rizzie
    Montreal
    21. November 2022

    @Norbert, comment #163

    Great thoughts/questions. I was wondering if Caesar 11 was hinted at by the two Sonnets being “cut off” — sometimes in poetry this is called a “Caesura cut” and is usually parsed with a double // or ||. So, Caesura || (Caesar 11?). However, these “cuts” usually apply to a pause in the middle of a line, and not by text being cut off at the end of a sentence. So maybe not…

    I have also been asking myself questions about the numbers that pop up — 31, 52, Quarto/Quatrains (4), 8 lines, 1609… etc. Are they meaningful? (3,1,5,2,4,1,6,0,9 = column numbers 1-10, or 0-9?).

    IS there a reason these particular sonnets were chosen?

    Finally, I’m curious to know if any kind of rhyming scheme (ABAB CDCD), or analysis of the metre/syllable arrangement (usually parsed like x / x / x /, etc.) are worthy of being looked at, perhaps as some kind of grid arrangement guides, or perhaps as points for a grille overlay?

    (PS – I can’t shake my Friedman Christmas Card idea, although I also feel like I have exhausted my options with it….)

  166. #166 Matthew Brown
    22. November 2022

    Hi all, really enjoying the discussions again, lots of interesting analysis and ideas.

    As the next clue I will confirm that intermediate ciphertext should treated as 50+50 not as a block of 100.

  167. #167 Thomas
    22. November 2022

    This rules out square based transpositions like Fleisser grids. Two 5 x 10 rectangles appear to be the likeliest option.

  168. #168 Thomas Ernst
    Collabsible B
    22. November 2022

    „And now that Fleissner’s been slayne / wé’ll ne’er perceiue him agayne.“

  169. #169 Tom Larsen
    23. November 2022

    Here’s an idea I have toyed with, but I am not 100% sure how to progress with it. Probably easiest to show with an example:

    1. Let’s use an example plaintext
    OKSEEIFMYCIPHERISHARDERTHANBIERMANNS

    2. Divide the text up into blocks of different sizes – let’s use the sonnet numbers, 31 and 52 – so e.g. sizes:


    _3__1___5___2___3__1___5___2___3__1___5___2__3___1_
    OKS E EIFMY CI PHE R ISHAR DE RTH A NBIER MA NNS X

    3. Create indicators using regular letter frequencies:
    LOSBKTAEEOEAAE
    (becomes key = {10, 11, 13, 4, 9, 14, 1, 5, 6, 12, 7, 2, 3, 8})

    4. Reshuffle the blocks according to the random? key:

    10__11__13__4___9__14__1___5___6__12__7___2___3__8_
    OKS E EIFMY CI PHE R ISHAR DE RTH A NBIER MA NNS X

    becomes

    __1___2___3__4__5___6____7___8__9__10_11_12_13__14_
    ISHAR MA NNS CI DE RTH NBIER X PHE OKS E A EIFMY R

    5. Add the indicators as a prefix and the example ciphertext thus becomes:
    LOSBKTAEEOEAAEISHARMANNSCIDERTHNBIERXPHEOKSEAEIFMYR

    I’m not sure this is especially likely.

    However, the vowel run AEEO EAAE in part 2 doesn’t fit with expectations from a regular transposition cipher; nor does the consonant run in part 1 insofar as it comes at the beginning.

    Assuming we are on the right track when it comes to some transposition being done, it seems either the transpositions are very unusual (insofar as it treats vowels / consonants differently), or else these patterns constitute indicator groups (they could also be nulls, but I doubt that).

    So we should consider the possibility of irregularly-sized transposition units.

  170. #170 Bill Briere
    Wyoming, U.S.A.
    23. November 2022

    @Tom Larsen (with my apologies for misspelling your name in #159), your comment about irregularly sized transposition units (#169) brought to mind the rail fence, for whatever reason. It would be yet another cipher that fits into the Too Easy To Be It category–just like the Bacon and Caesar that we’ve already been served.

    A rail fence could (maybe, possibly) account for clusters like NLRHHCTVNNS and AEEOEAAE, by nature of its staggered sampling of text that would otherwise slightly tend toward alternating vowels and consonants.

    I’ve tried this on both of the 50-letter ciphertexts, forwards and backwards, up to about 11 or so rails, without finding anything, but it might be worth doing a deeper dive to see if there’s some other super simple twist.

    Wouldn’t that just be perfect if we’ve all been throwing everything we have at this, and it turns out that we’ve been pwned by a series of embarrassingly simple ciphers? 😀

  171. #171 Rizzie
    Montreal
    23. November 2022

    @Bill Briere – I having been playing with the exact same “railfence” idea as you! Specifically, applying a 3,1 to the string from 31, and a 5,2 offset to the string from 52.

    After that I have been trying to use both newly railfence-d strings in some kind of transposition.

    Specifically because the hint:
    “… I will confirm that (the) intermediate ciphertext should treated as 50+50, not as a block of 100.” What jumps out at me here is the word “intermediate”…

    … meaning, perhaps an intermediate step of applying railfence (3,1 & 5,2) on the lines before the next step. The Caesar 11 shift was just as simple a twist in this process, so perhaps this intermediate step is something like railfence, before moving on to a more complicated transposition?

  172. #172 Thomas Ernst
    Collapsible C
    23. November 2022

    “50+50”, “intermediate”: Matthew knoweth our cryptological affliction and sorrows (that’s another 50 letters right there). Thus a keyed polyalphabetic cipher it is. The pork has to stop with the core-alphabet: it is unlikely that an alphabet retains both “i” and “j”, and chucks “u” for “v”, or retains both “u” and “v”, and chucks “j” for “i”. Have been spending an afternoon of juxtaposing the possible key phrase – Sonnet 52, letters 1-100 – against ciphers 31 and 52, and not just 100 against 100, but also 50 against 50, and 25 against 25, and the latter in four different sequences: forward, backward, divided into four segments; a fragmentation beyond four sets à 25 letters of either cipher and/or key seems implausible. Beyond the 50+50, the juxtaposition of combined ciphers 31+52 against 52/1-100 suggests – overall – , if you combine the quantities of neighbouring letters, and not just individual ones, as I had done earlier, a polyalphabetic substitution with two adjacent letters identifying one cipher alphabet:

    31+52: a (3), b (2), c (11), d (6), e (2), f (0), g (4), h (10), i (7), k (2), l (1), m (0),
    n (2), o (1), p (9), q (3), r (3), s (2), t (15), v (3), w (7), x (5), y (0), z (2).

    52/1-100: a (5), b (2), c (4), d (2), e (14), f (1), g (1), h (10), i (7), k (2), l (4), m (2),
    n (3), o (7), p (1), q (0), r (7), s (9), t (6), v (5), w (6), x (0), y (3), z (0).

    The fifteen “t” of combined 31+52 lined up against the fifteen neighbouring notes “s” and “t” in 52/1-100, or the five “a” of 52/1-100 lined up against the five neighbouring notes “a” and “b” in 31/52, the tutti of combined “h” and “i” à 17 in both, the combined three “k” and “l” of 31/52 against zero “x” and three “y” in 52/1-100, as well as the pianissimo of 31/52 “m” (letter 12) and 52/1-100 “z” (letter 24) make this cipher sound Bellasonic. At the core of all Bellaso-ciphers lies the division à 2, whether split cipher alphabets keyed by one letter (1552), split cipher alphabets keyed by two letters (1553 and 1555), or split cipher alphabets keyed by four letters (1564).

    Incidentally, while brushing up on Bellaso, I came across a host of online-boobs beating up on Vigenère for having “stolen” Bellaso’s keyed cipher. While it was not uncommon between writers of cryptological treatises of the time to kick their predecessors – Fedele Picchol’huomini unsuccessfully trying to better the “cifra posta in stampa dell eccelente Belasio” (Meister 1906, p. 145), Cardano putting down Trithemius with both feet (worthwhile reading), or Vigenère making fun of Alberti – this was not the case regarding Vigenère and Bellaso. In his “Traicté” BdV (f. 36rv) explicitly acknowledges: “Premierement donques ie mettray le chiffre” – keyed polyalphabets, which BdV clearly distinguishes from Trithemius’s non-keyed polyalphabets Polygraphia/VI – “que i’attribue quant à moy à vn certain Belasio de la suitte du Cardinal de Carpi, pour auoir le premier de tous ceux dont i’ay eu cognoissance, qui le practiqua & mit en auant l’an 1549. que ie fuz à Rome la premiere fois […]”. Vigenère’s differentiation between “practiquer” and “mettre en avant” suggests an even earlier publication by Bellaso than the Venezia 1552. Which would certainly be a great cryptological find.

    A happy Thanksgiving to all.

  173. #173 Bob
    Minnesota
    23. November 2022

    Does anyone know if Cryptool can be made to solve ciphers in depth? I know @david vierra was able to essentially trick it for a very specific case. See post 101 above.

    While Matthew didn’t explicitly say it, it is certainly possible that each 50 character block is encrypted using the same method. Therefore, if both blocks can be evaluated simultaneously, it could significantly enhance our ability to crack this.

  174. #174 Matthew Brown
    27. November 2022

    With the blog shutting down at the end of the year I feel I should probably offer a more explicit clue, I will confirm that many are on the right path and multiple anagramming is the intended method to solve this last step.

  175. #175 Bill Briere
    Wyoming, U.S.A.
    27. November 2022

    For those of us who have been working this problem lately as a pair of identically keyed 50-letter transposition ciphers, we now have the great comfort of knowing that our efforts haven’t been wasted!

    Some other assumptions I’m operating under:

    1. The texts are in English. Why? Analysis of the specific letters we see (and other stats) gives us confidence that we have a great match for English and maybe a barely passable match for some other language. It’s possible that one is in English and that the other one (the one with fewer vowels) is a translation of the same into another language, but that seems unlikely, since there could be much difficulty in getting the two to come out to the same length. Still, we know that dictionary solvers are not getting anywhere, which could be based on incorrect assumptions about the language or some other oddity in spelling or wording.

    2. One of the texts is written in reverse. Why? In manual testing–you can even do this with Scrabble tiles–it appears that this is somewhat more likely than not. When one text is reversed and the two are placed one above the other, it becomes more likely that vertically adjacent pairs of letters will match (for example, NN or II) and that vertical bigrams will be repeated elsewhere (e.g., TM or IY) and that reversals of vertical bigrams will appear (e.g., HN/NH or NS/SN). (Note: For purposes of our multiple anagramming, it makes no difference which one is reversed. Also, for purposes of multiple anagramming, having *both* written backwards would effectively be the same problem as having *neither* written backwards.) Yes, it’s entirely possible that the texts are not reversed, but the problem has to be broken down somehow, and this is my limited search area.

    3. There should be a hint or indication somewhere of how to get into this. Why? Multiple anagramming with only two texts–both of which are complete unknowns–might not be a fair challenge. We should be keeping our eyes out for some kind of hint or logical entry point. I’m not seeing any, and there might not be any. It’s easy to get strings of 4 or 5 letters to pop out on both sides of the anagramming, but that’s meaningless. Obviously, if we had a reasonably sized *known* plaintext crib or a solid idea of the subject matter to give us some *probable* plaintext cribs, this would be a much simpler problem to solve.

    4. This final transposition step should be embarrassingly simple. Why? The first two stages were Baconian steganography and a Caesar cipher–arguably two of the simplest encryption systems on earth. It would be elegant and poetic if the entire puzzle were constructed as exercises in ridiculously elementary cryptanalysis and if a bunch of cocky code breakers could be stumped by it. Imagine the communal “d’oh” feeling and the laughter we’d all experience at this and the immense satisfaction this would give the designer.

  176. #176 Thomas Ernst
    Collapsible D
    28. November 2022

    With Christmas approaching, thoughts naturally turn to Russian Easter-dolls. Specifically the colourfull encapsulation of cipher-texts 31 and 52.
    Since 31 and 52 carry different cryptological weight (Matt # 166), the plaintext may not contain one hundred, but fifty letters. If 52 serves as matryoskha to 31, an new cipher text emerges. This time I counted the alphabetical distance between each letter of 31 and its respective counterpart in 52, with the first Baconian alphabet à 24 as point de départ, and then – because letters are easier to deal with than numbers – I translated the distance value into its absolute position in the Baconian alphabet, i. e. c → a = 22 = x, a → d = 3 = c etc. Counting from 52 to 31 will produce different distances and letters, but identical proportions. For easy reference, I kept the blocks à five:

    31: cagww | rikcc | hthxi | xhxth | plpwr | dhwcu | tidpg | dkxat | etigp | chwei
    52: adhqz | opttd | tpptu | gpwsi | twqct | sctch | ttxun | bndzr | thqbp | cihcc

    c → a = 22 = x | a → d = 3 = c | g → h = 1 = a | w → q = 19 = t | w → z = 3 = c |
    r → o = 20 = u | i → p = 6 = f | k → t = 9 = i | c → t = 16 = q | c → d = 1 = a |
    h → t = 11 = l | t → p = 20 = u | h → p = 7 = g | x → t = 21 = w | i → u = 11 = l |
    x → g = 9 = i | h → p = 7 = g | x → w = 23 =y | t → s = 23 = y | h → i = 1 = a |
    p → t = 4 = d | l → w = 10 = k | p → q = 1 = a | w → c = 6 = f | r → t = 2 = b |
    d → s = 14 = o | h → c = 19 = t | w → t = 22 = x | c → c = 24 = z | u → h = 12 = m |
    t → t = 24 = z | i → t = 10 = k | d → x = 18 = s | p → u = 5 = e | g → n = 6 = f |
    d → b = 22 = x | k → n = 3 = c | x → d = 6 = f | a → z = 23 = y | t → r = 22 = x |
    e → t = 14 = o | t → h = 13 = n | i → q = 7 = g | g → p = 8 = h | p → b = 11 = l |
    c → c = 24 = z | h → i = 1 = a | w → h = 11 = l | e → c = 22 = x | i → c = 18 = s.

    Amalgam of 31 and 52 à fifty letters:

    x c a t c u f i q a l u g w l i g y y a d k a f b | o t x z m z k s e f x c f y x o n g h l z a l x s.

    Frequency first half:
    a (4), b (1), c (2), d (1), e (0), f (2), g (2), h (0), i (2), k (1), l (2), m (0),
    n (0), o (0), p (0), q (1), r (0), s (0), t (1), u (2), w (1), x (1), y (2), z (0).

    Frequency second half:
    a (1), b (0), c (1), d (0), e (1), f (2), g (1), h (1), i (0), k (1), l (2), m (1),
    n (1), o (2), p (0), q (0), r (0), s (2), t (1), u (0), w (0), x (4), y (1), z (3).

    The six letters “b” (1), “d” (1), “i” (2), “q” (1), “u” (2), “w” (1) occur only in the first half, the seven letters “e” (1), “h” (1), “m” (1), “n” (1), “o“ (2), “s” (2), “z” (3) only in the second half. Here, only two letters do not occur in either half, “o”, “p” (as compared to the three letters “f”, “m”, “y” in 31/52 combined. Either set reduces the cipher-alphabet to 22 letters (21 in 31/52). Bellaso’s Italian cipher alphabets comprise the 22 letters a b c d e f g h i l m n o p q r s t v x y z. Bacon’s first English alphabet comprises the 24 letters: a b c d e f g h i k l m n o p q r s t v w x y z. Since Bellaso always used the full range of his alphabet à 22 in both cipher and key, one may expect the same from our presumably English cipher-alphabet à 24. While the doubling of “i/j” and “u/v” poses no problem, amputating “k” and “w” from any English alphabet is a cruel thing to do. Which makes it possible, nay likely, that Matt shortened the English alphabet by two letters that do not occur in his chosen plaintext. The two most likely suspects are “x” and “z”, much less so “k” and “q”. If zounds claims plaintext-“z”, and the xenagogue plaintext-“x”, there emerges an English Bellaso à 11 + 11: a b c d e f g h i k l | m n o p q r s t v w y. The key-phrase (less likely key-word) should contain all five vowels up-front. That is why Bellaso chose the first verse of the “Aeneid”. Superimposing “Arma virumque cano troie qui primus ab oris” on a reduced English alphabet à 22 is possible, but then “h” and “k” disappear from the plate: armauirumquecanotroiequiprimusaboris = rmqcntpsb + dfghly = rmqcntpsbdfghklwy + aueio in second place for the cipher alphabts = ramuqicenot | psbdfghklwy, and in fourth place for the key-pairs = rm qa cn tu ps bi df ge hk lo wy.
    Which brings me back to the first two verses of Sonnet 52:

    “so am i as the rich whose blessed key can bring him to his sweet vplocked treasure […]”.

    It fits contextually and cryptologically; there are no “x” and “z”, and there are no invisible letters, although the “u” does not show till letter 51. But that does not matter for creating a cipher-alphabet and a paired key à la Bellaso. Earlier I tried it with Bellaso 1564, which did nit work. Here it is with Bellaso 1555:

    smthrcwbnrgwplkdf + oaieu
    = substitution alphabets: s o m a t i h e r u c | w b n r g w p l k d f
    = eleven pairs to identify the eleven substitutions: sm to hr ca wb ni rg we pl ku df.
    A plausible contra-segno would have to include at least one letter of each pair. “Shakespeare” could not be a key-word, because it contains only eight different letters, which would leave any three alphabet-substitution unused; likewise “William Shakespeare”, which would leave substitution “to” of my assumed key in the cold.

    Summa summarum my assumptions are:
    • cipher 31 and cipher 52 cannot be weighted equally, because their cryptological function is different, whether in the manner suggested by me, or for a different reason.
    • the actual cipher to be solved is an amalgam of 50 letters distilled from the 100 letters of 31 and 52; if measuring the letter-distances between 31 and 52 is a proper intermediate step, the resulting text will require further transposition (21 possibilities).
    • the plaintext-alphabet and the cipher-alphabet comprise only 22 letters, most likely the first Baconian à 24 reduced by “x” and “z”. The purpose of this reduction is to allow for Bellaso-like substitutions. The apparent “peak-value” of 11 discussed early in this thread, and the impossibility to solve it, speaks for a Bellaso 11 + 11. So does the absence of three letters in 31 and 52 across, and two letters in 31 and 52 combined.
    • the polyalphabetic substitution is constructed à la Bellaso 1555, less likely 1564.
    • the most promising key-text on which to construct a Bellaso 1555 are the first two verses of Sonnet 52.
    • if Bellaso 1555 is correct, the key phrase dictating the sequential use of the eleven cipher-alphabets must contain at least one letter of each key-pair, maximally all 22 letters, exclude “x” and “z”, and all of this at a relatively short distance.

    It’s getting cold; I hope to see the “Carpathia“ soon; meanwhile any corrections welcome.

  177. #177 Thomas Ernst
    Collapsible D
    28. November 2022

    Two emendations: „further transpositions (23 possibilities)“; „all of this at a memorable distance“, i. e. a verse from 31 or 52, or, more promising, verses 52/1-2 as an auto-key.

  178. #178 Tom Larsen
    28. November 2022

    Interesting! In light of Matthew’s comment, I’m not sure there is a way into the cipher other than multiple anagramming, although that would be more probable than not. This informs whether the direction from here is down the ‘raw computational power + creativity’ route or ‘sit down with paper and pencil and experiment with many configurations of the ciphertext / sonnets / etc.’

    The difficulty with multiple anagramming is that the two parts of the ciphertext are quite short, so it’s hard to get strong “signals” of which ngrams / words are valid and which are not.

    I assume Matthew has validated that it is possible to solve the cipher this way (as otherwise I’m not sure 2 parts of 50 letters each would be sufficient for multiple anagramming in depth, unless we are dealing with a columnar transposition in which the key is a lot shorter than 50 letters).

  179. #179 Bob
    Minnesota
    29. November 2022

    @Tom Larsen and @Bill Briere,

    Just to put a fine point on Tom’s comment and Bill’s point #3 above, yesterday I put a 50 x 2 cipher where I KNEW the correct result into a hillclimber and it didn’t even get close. In fact, in only two cases were correct bigrams even adjacent to one another. I was using log quadgram scores, which are usually pretty good, though a dictionary attack here might work better.

    As I said before, if the key is length 50, we will need more depth to get there. My hope and belief is its not, because it may be impossible if it is, without some other insight.

    Also, do either of you know if there is a way to get any of the solver programs to work a problem in depth? I can’t figure it out for the life of me.

  180. #180 Thomas Ernst
    Collapsible D
    29. November 2022

    Two further emendations in # 176: the two letters lacking in the matryoshka 31/52 are not “o” and “p”, but “p” and “r”, which supports the assumption that “x” and “z” are missing from the plaintext. – The correct consonant-sequence derived from 52/1-2 is smthrcwbldkyngpkf. – With regard to anagramming my skills stop with the “Présages” (1617) by Thomas Billon, who was appointed official court-anagrammatist by King Louis XIII of France.

  181. #181 Tom Larsen
    29. November 2022

    // Also, do either of you know if there is a way to get any of the solver programs to work a problem in depth? I can’t figure it out for the life of me. //

    One way is to reframe the two texts as a simple columnar transposition problem. For example, say we are trying to solve these two ciphertexts in depth:

    1: ABCDEFGHIJ
    2: QRSTUVWXYZ

    each with a width of 10. You can interweave them like this:

    AQBRCSDTEUFVGWHXIYJZ

    (total length 20) and feed them into the solver of your choice, specifying the number of columns is 10. They will then get turned into a complete columnar transposition problem with AQ in one column, BR in another, etc. Functionally, this will perform multiple anagramming.

    Applied to the problem at hand, given

    nlrhhctvnnsesitisiesawahcoshngetoarovilepetranshpt
    losbktaeeoeaaegrahduehbnednenseeifymyokcesbmantsnn

    and assuming no unusual offsets, you could try solving for

    nllorshbhkcttaveneno
    seeasaietgirsaihedsu
    aewhabhnceodsnhenngs
    eeteoiafryomvyiolkec
    peestbrmaannsthspntn

    (you can see I interwove the texts …. plug it into your solver with length = 50 and it should work fine).

  182. #182 Tom Larsen
    29. November 2022

    (This works because the columns are all complete and the length is equivalent to each part of the ciphertext – letters will always stay in the same row no matter how you rearrange the columns.)

  183. #183 Tom Larsen
    29. November 2022

    My best run so far, assuming no reversals, is

    VPORTENCISSTVALITHHANCILINATROOPGEANSHERSESSENTHWH
    ENDSEALEHUTBYFORABEENTOKENAGYIMESSBEAKEMADENCONNHS
    {7 15 4 18 38 22 17 1 36 46 43 6 41 25 28 16 37 9 42 10 20 49 35 48 8 3 44 19 26 33 39 5 30 14 29 31 13 23 24 45 32 34 12 40 27 21 11 50 2 47}

    With the second line reversed, it’s
    PHISCESSTINGTRINANEVERNSPANSTIOCHEVAHOWOLLTHERSHAT
    ONANDEBOMINEDAYSTHEBESKCOSEFLYHANKEABENGANETURESEM
    {11 42 22 44 33 32 9 20 16 27 24 34 8 30 50 15 28 10 6 47 26 39 49 2 5 38 4 37 18 12 45 13 31 36 46 40 35 3 41 21 1 19 43 14 17 23 7 48 25 29}

    However there is a lot of variance – I doubt either of these is on the right track. They both have similar scores.

    I am summing log quadgrams to score arrangements, and sliding column groups of arbitrary lengths, with a combination of hill-climbing and simulated annealing.

    Quadgram scores obtained from the top 100 Gutenberg books, Lanaki’s lectures on cryptology, Singh’s *The Code Book,* and Shakespeare’s complete works (covering different bases).

  184. #184 Tom Larsen
    29. November 2022

    @Thomas Ernst – seems like Thomas Billon was a fascinating person!

  185. #185 bob
    Minnesota
    29. November 2022

    @Tom Larsen,

    What are you using to run your test, or is it homegrown code? I’ve got this plugged into cryptool and I’m going to let it run all day to see what I get. I suspect there are literally billions of local maxima, but maybe I can use the resulting key to see if there any clues.

  186. #186 Tom Larsen
    29. November 2022

    Homegrown code (I can’t run CrypTool as I use a Mac).

    Unfortunately I am getting lots of local minima, e.g.,

    WCSHANISHALTHAVENTERSPERINGHISSLOVEPARINTOCONTHEST
    HEAKFORESAKENBYALBEYANDMONSBENTOMESEESHEADTINGECUN

    NAVISISHETHECLARNSTTHINGSOPPOSSINCERTHERVANOTHEWAL
    LBEHERAKEBESTOFYOUNGBEESAMENINTONEASANDMYANDESCHEK

    PRESSLAVERWISHAVELOCANTSTHEPRONTHINGTHECISINTONASH
    EMSTAKEYESHOUSBECOMEALENBEANYINGBENSANDTHERENDOFAK

  187. #187 Tom Larsen
    29. November 2022

    If CrypTool allows it, you could try solving with cribs e.g. TRANSPOSITION, SHAKESPEARE, FRIEDMAN, RIVERBANK, etc

  188. #188 Magnus Ekhall
    Borensberg
    29. November 2022

    I’m also getting local minimas so far. For example:

    PESTSHAVESPRINCESORALINTERINGTHANISHCLOTHESWONTHAV
    EDANUNBECANYONEANDMAKELESSHESBEFORESTOMAKETHINGBEY

  189. #189 Thomas Ernst
    Lifeboat A
    30. November 2022

    Attempts to squeeze Bacon’s 24 into Bellaso’s 22 have been futile, and now rest at the bottom of the North Atlantic. Matt’s # 166, of course, stands: ciphers 31 and 52 cannot be treated in one wash. Instead, their manner of interaction needs to be figured out, before an effective substitution can be attempted, which – a guess – may turn out to be an plaintext-anagram with a letter distribution à four. In that context, a hitherto overlooked (?) detail becomes prominent: both cipher 31 and cipher 52 miss the sixth and twelfth letters of the alphabet, “f” and “m”. Which supports the idea of further quatrains. Since there is one way or another of looking at this, I’ll go with the other first.

  190. #190 Thomas Ernst
    Lifeboat A
    30. November 2022

    PS: if „z“ does not occur in the plaintext, it is tempting to assign it to the corner-stones of cipher-„f“ and cipher-„m“.

  191. #191 Thomas Ernst
    Lifeboat A
    30. November 2022

    If „m“ = „z“ it could be an extended Bellaso 1564 after, which I debunked earlier in the wrong context. 1564 has only five substitution alphabets (in English it would be six) which, unlike 1555, could easily accomodate „Shakespeare“ as key-word (Bellaso used his middle name; Shakespeare ain‘t got none).

  192. #192 Matthew Brown
    30. November 2022

    Comparing Norbert’s transcription with my notes I’ve realized I made a mistake with the placement of a couple of dots in the Bacon encryption, apologies for the mix up! Here are the corrected texts with 2 letters adjusted in the first message;

    NLRHHCTVNNSESITISIESAEAHCOSENGETOAROVILEPETRANSHPT
    LOSBKTAEEOEAAEGRAHDUEHBNEDNENSEEIFYMYOKCESBMANTSNN

  193. #193 David Vierra
    1. Dezember 2022

    @Matthew Brown

    Thank you for the correction!

    EVENTHESTRONGESTTRANSPOSITIONCIPHERSHAVEANACHILLES
    HEELANDANYMESSAGESFOUNDTOBEINTHESAMEKEYCANBEBROKEN

    Key: 21 7 30 0 6 23 18 16 49 34 35 8 29 41 12 14 31 2 33 9 19 48 25 46 37 42 13 32 45 5 17 40 47 11 43 10 4 20 36 39 44 28 22 24 3 15 1 38 27 26

    The solution was achieved through long, manual trial and error, starting with the suspicion that the words “TRANSPOSITION CIPHER” appeared in the text. The automatic transposition solvers were practically useless. I had a little computer assistance from scripts that would take a suspected word and print all of the corresponding letters in the other message that were usable for anagramming, which helped to exclude or promote words. Big thanks to everyone who commented and helped with the investigation, and a special mention goes to the DECIPHER crew and the discussions we had on Discord about the puzzle.

  194. #194 bob
    Minnesota
    1. Dezember 2022

    Congrats @David Vierra and Crew. Awesome work!

  195. #195 Thomas
    1. Dezember 2022

    Great job, David!

  196. #196 Magnus Ekhall
    Borensberg
    1. Dezember 2022

    Well done David!
    Congratulations!

  197. #197 Matthew Brown
    1. Dezember 2022

    @David Vierra

    Fantastic work, congratulations!

    It is pleasing to know that a completely random key with just 2 messages in depth can be broken with a well chosen crib.

  198. #198 Tom Larsen
    2. Dezember 2022

    David, congratulations!!!!!
    And Matthew, thank you for creating a very interesting challenge!

    David, I’m jealous 😉 – as I had a very similar suspicion to you – and in fact was using ‘TRANSPOSITION CIPHER’ as an assumed plaintext in the first part of the message. I suspected Matthew must have included something along those lines to make the cipher solvable, and all the letters occurred in that part! I’m glad to know I was on the same track.

    I’m curious, how did you figure out the remaining text? E.g. did you use a particular solver, what length of ngrams did you optimize for, or did you do this completely by hand? I had just started to experiment with using ngrams with length 8.

  199. #199 David Vierra
    2. Dezember 2022

    @Tom Larsen

    I experimented with making a kind of anagram solver, where I would enter a crib and it would use 4-grams to rank all of the possible anagrams of letters in the opposite message, but it was just as useless as the transposition solvers. The most useful tool was one whose output looks like this:


    TRANSPOSITIONCIPHERS

    ASELEEDEEAEDLTEEBASE
    GYBEANIARGRIEERNKDYA
    EMFOA_MAHEHMO_H_NHMA
    B_ANU__UOBO_N_O_SE_U
    N__NN__N_N__N____E_N
    ____T__T_________C_T
    _________________S__

    Which is something the old codebreakers could have done using letters written on strips of paper! So it was solved more or less by hand.

  200. #200 Bill Briere
    Wyoming, U.S.A.
    2. Dezember 2022

    Wow, I’ve missed a few busy days here.

    @David Vierra, that’s quite an accomplishment!

    There’s a massive difference between *suspected* plaintext and *known* plaintext. There weren’t any obvious “ins”–not even a Q or other freebie starter. (I had pinned some hope on building a “WH-” word, but the W turned out to be a phantom, along with one of the Hs.)

    It’s kind of surprising that various programs weren’t able to lock in on any part of the solution. Maybe this particular type of solution problem–depth of 2, in which the key is random–might actually be easier to solve by hand than with help.

    But even more surprising to me is that the manual solution was pulled off without any *known* plaintext. I had the ciphertext set up on pairs of Scrabble tiles taped together domino-style on standby, waiting for Matthew to eventually throw us an inevitable crib.

    @Matthew Brown, kudos for creating a relevant and satisfying plaintext phrase! So, did you suspect that this would end up being worked manually? And how confident were you that it would be solved without having to resort to giving us a crib?

  201. #201 Matthew Brown
    2. Dezember 2022

    @Bill Briere

    When I set the problem I knew it would be very difficult but could be solved by hand with the right crib, and hoped that if the text was made somewhat predictable it could be found. Most of the other Friedman challenge plaintexts have been releated to the theme of the puzzle, so I hoped this would suggest some likely cribs.

    One thing I didn’t know is how well computer solvers would do as there don’t seem to be any existing tools developed for this specific problem, so i was interested to see if anyone had any success this way.

    I had a go myself at a solver and with the crib of “TRANSPOSITIONCIPHER” I was able to hillclimb (selecting from the pool of available letter sets as David shows above) to get the following;

    226.547: ESANANDTOBEINTHESAM
    222.904: EMANANDERBEINTHESAS
    221.977: ESFOUNDERBEINTHESAM

    and with the shorter crib of “TRANSPOSITION”;

    144.399: ASANANDTHERIN
    139.634: AMEONEDTHERIN
    136.621: ESANANDTOBEIN

    but all this still requires a long+likely crib and the closest solution often isn’t the highest scoring solution, so a fully automated solver seems like a very hard problem to solve.

  202. #202 Narga
    2. Dezember 2022

    Congratulations, David!

  203. #203 Tom Larsen
    3. Dezember 2022

    Interesting! This suggest some of the automated solvers could probably be significantly enhanced. If they were improved so they could solve this problem (e.g., by testing cribs based on particular topics and with improved optimization approaches), they could likely solve more messages (particularly when in depth).

    It is unfortunately too easy to use computational power to substitute for optimal techniques – this suggests we could improve the algorithms quite a bit, and open up other solutions!

  204. #204 David Vierra
    3. Dezember 2022

    Using the usual log-likelihood 6-gram scoring, it turns out the actual plaintext in this puzzle has a lower score than many of the results from different solvers. That is, it is not a global maximum. I wonder if a very different scoring method is needed, maybe something like natural language processing? A casual search turns up this paper on Vigenere solving, which uses as a scoring method a recurrent neural network trained on natural language. Unfortunately, most of it is jargon to me as I haven’t been keeping up on neural network research, but it claims to have near-100% accuracy.

    https://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=9408655

  205. #205 Norbert
    5. Dezember 2022

    Congratulations to David! What a great achievement! I sincerely hope that the Friedman Ring lives on in some way, just as I hope this blog does. Klaus, please feel free to send news of any kind to my email address!

  206. #206 Klaus Schmeh
    5. Dezember 2022

    David: Congratulations also from my side! You’re the new winner of the Friedman Ring.
    And thank ypou very much to all other readers who have contributed to this success!
    Of course, I will write a blog post about this story.