Playfair Cipher

A classical, polygraphic cipher. Invented by Sir Charles Wheatstone in 1854. Named after Lord Playfair who promoted its use in diplomatic communication. The first digram substitution cipher, encrypting pairs of letters (bigrams) rather than single letters.

Encryption

Key Grid

A 5x5 grid holding the 25 letters of the English alphabet, treating I and J as one letter.

Construction:

• Write a secret keyword with no repeating letters into the grid, starting from the top left, row by row.
• Fill the remaining cells with the unused letters in alphabetical order.

Preparation

Steps:

• Remove non-letters. Replace J with I. Uppercase the text.
• Split the plaintext into bigrams from left to right.
• If a bigram has 2 identical letters, insert a filler letter ($X$, or $Q$) between them and re-split.
• If the plaintext length is odd, append a filler letter to the last bigram.
• Encrypt each bigram by 1 of the 3 rules below.

Bigram Rules

• Same row
  Replace each letter with the letter to its right, wrapping from the last column to the first.
• Same column
  Replace each letter with the letter below it, wrapping from the last row to the first.
• Rectangle
  The 2 letters sit at opposite corners of a rectangle. Replace each with the letter on its own row at the other corner.

No plaintext letter encrypts to itself.

Decryption

The receiver builds the same grid from the keyword and splits the ciphertext into bigrams. Each rule is inverted.

• Same row
  Replace each letter with the letter to its left, wrapping from the first column to the last.
• Same column
  Replace each letter with the letter above it, wrapping from the first row to the last.
• Rectangle
  The same swap as encryption, each letter taken to the other corner on its own row.

Filler letters are spotted and dropped by reading the recovered plaintext.

Attacking

The unit of substitution is the bigram, so a monogram frequency count of the ciphertext is close to uniform.

Weaknesses that a cryptanalyst exploits:

• 600 bigrams carry an uneven frequency distribution, led by TH, HE, AN, IN. A long ciphertext still leaks this structure.
• A bigram and its reverse encrypt to a ciphertext bigram and its reverse. Plaintext pairs like RE and ER are detectable.
• A digram never contains a repeated letter, so ciphertext bigrams like LL never appear.

Steps for a ciphertext-only attack:

• Count ciphertext bigram frequencies and match the top ones against expected language bigrams.
• Guess a probable word (a crib) and place it against repeated ciphertext stretches.
• Each correct guess fixes relative positions of letters in the grid, as a row, column, or rectangle constraint.
• Propagate the constraints, filling the grid, and confirm against the rest of the ciphertext.

Known-plaintext attacks are far stronger. A few matched bigrams pin enough letters to reconstruct the grid, since the keyword layout is highly constrained.

Worked Example

Plaintext wakandaforever under keyword PANTHER.

The grid built from PANTHER:

P A N T H
E R B C D
F G I K L
M O Q S U
V W X Y Z

Positions are $(\text{row}, \text{column})$ with both starting at $0$.

wakandaforever has 14 letters. No bigram repeats a letter, and the length is already even, so no filler is needed.

WA KA ND AF OR EV ER

Encrypt each bigram by its rule.

• WA: $W(4,1)$ and $A(0,1)$ share column $1$. $W \to (0,1) = A$. $A \to (1,1) = R$. Gives AR.
• KA: $K(2,3)$ and $A(0,1)$ form a rectangle. $K \to (2,1) = G$. $A \to (0,3) = T$. Gives GT.
• ND: $N(0,2)$ and $D(1,4)$ form a rectangle. $N \to (0,4) = H$. $D \to (1,2) = B$. Gives HB.
• AF: $A(0,1)$ and $F(2,0)$ form a rectangle. $A \to (0,0) = P$. $F \to (2,1) = G$. Gives PG.
• OR: $O(3,1)$ and $R(1,1)$ share column $1$. $O \to (4,1) = W$. $R \to (2,1) = G$. Gives WG.
• EV: $E(1,0)$ and $V(4,0)$ share column $0$. $E \to (2,0) = F$. $V \to (0,0) = P$. Gives FP.
• ER: $E(1,0)$ and $R(1,1)$ share row $1$. $E \to (1,1) = R$. $R \to (1,2) = B$. Gives RB.

Ciphertext is ARGTHBPGWGFPRB.

Decryption reverses each rule under the same grid.

• AR: column $1$, shift up. $A(0,1) \to (4,1) = W$. $R(1,1) \to (0,1) = A$. Gives WA.
• GT: rectangle. $G(2,1) \to (2,3) = K$. $T(0,3) \to (0,1) = A$. Gives KA.
• HB: rectangle. $H(0,4) \to (0,2) = N$. $B(1,2) \to (1,4) = D$. Gives ND.
• PG: rectangle. $P(0,0) \to (0,1) = A$. $G(2,1) \to (2,0) = F$. Gives AF.
• WG: column $1$, shift up. $W(4,1) \to (3,1) = O$. $G(2,1) \to (1,1) = R$. Gives OR.
• FP: column $0$, shift up. $F(2,0) \to (1,0) = E$. $P(0,0) \to (4,0) = V$. Gives EV.
• RB: row $1$, shift left. $R(1,1) \to (1,0) = E$. $B(1,2) \to (1,1) = R$. Gives ER.

Recovered text is wakandaforever.

A known-plaintext attack uses 3 matched bigrams from the run above, with the grid unknown.

plaintext:   wa or ka
ciphertext:  AR WG GT

• wa to AR. Testing the same-row rule for w,a fails to reproduce AR, but the same-column rule holds: shifting each letter 1 row down (wrapping) turns w into a and a into r. So w, a, r sit in the same column, in that cyclic order.
• or to WG. The same-column rule holds again: shifting o and r 1 row down (wrapping) gives w and g. Since w was already placed in the shared column from the previous bigram, this extends it to o, w, a, r, g, in cyclic order.
• ka to GT. Testing the same-row and same-column rules both fail, so the bigram is a rectangle: the cell sharing k’s row and a’s column is g, and the cell sharing a’s row and k’s column is t. Since g was already placed in the shared column above, this confirms a’s column is the same one.

More matched bigrams pin the remaining letters the same way. Once most cells are known, the alphabetical order of the trailing letters exposes the keyword, and the full grid follows.