Playfair Cipher | Sahithyan's Notes

A classical, polygraphic cipher. Invented by Sir Charles Wheatstone in 1854. Named after Lord Playfair who promoted its use in diplomatic communication. The first digram substitution cipher, encrypting pairs of letters (bigrams) rather than single letters.

Key Space

The key is the arrangement of the 25 symbols in the grid, with I and J sharing 1 cell. The key space has $25! \approx 2^{84}$ possible grids. A keyword is only 1 method for selecting a grid and does not cover every arrangement.

Encryption

Key Grid

A 5x5 grid holding the 25 letters of the English alphabet, treating I and J as one letter.

Construction:

Write a secret keyword with no repeating letters into the grid, starting from the top left, row by row.
Fill the remaining cells with the unused letters in alphabetical order.

P	A	N	T	H
E	R	B	C	D
F	G	I/J	K	L
M	O	Q	S	U
V	W	X	Y	Z

Key grid from PANTHER.

Preparation

Steps:

Remove non-letters. Replace J with I. Uppercase the text.
Split the plaintext into bigrams from left to right.
If a bigram has 2 identical letters, insert a filler letter ( $X$ , or $Q$ ) between them and re-split.
If the plaintext length is odd, append a filler letter to the last bigram.
Encrypt each bigram by 1 of the 3 rules below.

Bigram Rules

Same row
Replace each letter with the letter to its right, wrapping from the last column to the first.
Same column
Replace each letter with the letter below it, wrapping from the last row to the first.
Rectangle
The 2 letters sit at opposite corners of a rectangle. Replace each with the letter on its own row at the other corner.

No plaintext letter encrypts to itself.

Decryption

The receiver builds the same grid from the keyword and splits the ciphertext into bigrams. Each rule is inverted.

Same row
Replace each letter with the letter to its left, wrapping from the first column to the last.
Same column
Replace each letter with the letter above it, wrapping from the first row to the last.
Rectangle
The same swap as encryption, each letter taken to the other corner on its own row.

Filler letters are spotted and dropped by reading the recovered plaintext.

Attacking

The unit of substitution is the bigram, so a monogram frequency count of the ciphertext is close to uniform.

Weaknesses that a cryptanalyst exploits:

600 bigrams carry an uneven frequency distribution, led by TH, HE, AN, IN. A long ciphertext still leaks this structure.
A bigram and its reverse encrypt to a ciphertext bigram and its reverse. Plaintext pairs like RE and ER are detectable.
A digram never contains a repeated letter, so ciphertext bigrams like LL never appear.

Steps for a ciphertext-only attack:

Count ciphertext bigram frequencies and match the top ones against expected language bigrams.
Guess a probable word (a crib) and place it against repeated ciphertext stretches.
Each correct guess fixes relative positions of letters in the grid, as a row, column, or rectangle constraint.
Propagate the constraints, filling the grid, and confirm against the rest of the ciphertext.

Known-plaintext attacks are far stronger. A few matched bigrams pin enough letters to reconstruct the grid, since the keyword layout is highly constrained.

Worked Example

Plaintext wakandaforever under keyword PANTHER.

Solution Reveal Hide

The grid built from PANTHER:

P	A	N	T	H
E	R	B	C	D
F	G	I/J	K	L
M	O	Q	S	U
V	W	X	Y	Z

Key grid from PANTHER.

Same Row

ER RB

Move each letter 1 cell right.

Same Column

WA AR

Move each letter 1 cell down.

Rectangle

KA GT

Take the other corner on the same row.

Pair encryption in the PANTHER key grid.

Positions are $(\text{row}, \text{column})$ with both starting at $0$ .

wakandaforever has 14 letters. No bigram repeats a letter, and the length is already even, so no filler is needed.

WA KA ND AF OR EV ER

Encrypt each bigram by its rule.

Bigram	Positions	Rule	Mapping	Result
`WA`	$W(4,1)$ , $A(0,1)$	Same column	$W \to (0,1) = A$ , $A \to (1,1) = R$	`AR`
`KA`	$K(2,3)$ , $A(0,1)$	Rectangle	$K \to (2,1) = G$ , $A \to (0,3) = T$	`GT`
`ND`	$N(0,2)$ , $D(1,4)$	Rectangle	$N \to (0,4) = H$ , $D \to (1,2) = B$	`HB`
`AF`	$A(0,1)$ , $F(2,0)$	Rectangle	$A \to (0,0) = P$ , $F \to (2,1) = G$	`PG`
`OR`	$O(3,1)$ , $R(1,1)$	Same column	$O \to (4,1) = W$ , $R \to (2,1) = G$	`WG`
`EV`	$E(1,0)$ , $V(4,0)$	Same column	$E \to (2,0) = F$ , $V \to (0,0) = P$	`FP`
`ER`	$E(1,0)$ , $R(1,1)$	Same row	$E \to (1,1) = R$ , $R \to (1,2) = B$	`RB`

Ciphertext is ARGTHBPGWGFPRB.

Decryption reverses each rule under the same grid.

Bigram	Positions	Rule	Mapping	Result
`AR`	$A(0,1)$ , $R(1,1)$	Same column, shift up	$A \to (4,1) = W$ , $R \to (0,1) = A$	`WA`
`GT`	$G(2,1)$ , $T(0,3)$	Rectangle	$G \to (2,3) = K$ , $T \to (0,1) = A$	`KA`
`HB`	$H(0,4)$ , $B(1,2)$	Rectangle	$H \to (0,2) = N$ , $B \to (1,4) = D$	`ND`
`PG`	$P(0,0)$ , $G(2,1)$	Rectangle	$P \to (0,1) = A$ , $G \to (2,0) = F$	`AF`
`WG`	$W(4,1)$ , $G(2,1)$	Same column, shift up	$W \to (3,1) = O$ , $G \to (1,1) = R$	`OR`
`FP`	$F(2,0)$ , $P(0,0)$	Same column, shift up	$F \to (1,0) = E$ , $P \to (4,0) = V$	`EV`
`RB`	$R(1,1)$ , $B(1,2)$	Same row, shift left	$R \to (1,0) = E$ , $B \to (1,1) = R$	`ER`

Recovered text is wakandaforever.

A known-plaintext attack uses 3 matched bigrams from the run above, with the grid unknown.

Plaintext	w	a	o	r	k	a
Ciphertext	A	R	W	G	G	T

Matched bigrams are WA/AR, OR/WG, and KA/GT.

wa to AR. Testing the same-row rule for w,a fails to reproduce AR, but the same-column rule holds: shifting each letter 1 row down (wrapping) turns w into a and a into r. So w, a, r sit in the same column, in that cyclic order.
or to WG. The same-column rule holds again: shifting o and r 1 row down (wrapping) gives w and g. Since w was already placed in the shared column from the previous bigram, this extends it to o, w, a, r, g, in cyclic order.
ka to GT. Testing the same-row and same-column rules both fail, so the bigram is a rectangle: the cell sharing k’s row and a’s column is g, and the cell sharing a’s row and k’s column is t. Since g was already placed in the shared column above, this confirms a’s column is the same one.

More matched bigrams pin the remaining letters the same way. Once most cells are known, the alphabetical order of the trailing letters exposes the keyword, and the full grid follows.