The following presents several solutions (and one attempt) of ciphers in a continuous digit stream. When the ciphertext is written in digit without break, the first step is to parse the ciphertext into meaningful cipher elements (symbols). But the task is not straightforward when the cipher includes variable-length symbols. Various schemes are described in "Variable-Length Symbols in Italian Numerical Ciphers" and more complex ones are in "Variable-Length Numerical Code in Austrian Archives".
A cipher in a despatch from Cardinal Soglia, Pius IX's Secretary of State, to Michele Viale Prelà, nuncio to the Emperor, was solved by Daniel Bourdeau (see his write-up). The ciphertext, consisting of a series of digits without break, was posted on Klauss Schmeh's Cipherbrain in 2014 but has remained unsolved until now.
Michele Viale Prelà (Wikipedia), papal nuncio to Austria, followed the imperial entourage when the court left Vienna to Innsbruck amidst the wave of revolutionary movements in 1848 (Wikisource, Chronik von Innsbruck). Cardinal Soglia (Wikipedia), Pius IX’s Secretary of State, sent him a despatch in cipher. It was posted in Turin, capital of the Kingdom of Sardinia, presumably considered safer than a direct route to Austria through Lombardy/Venice. However, the despatch was intercepted and Mazzini's Milan paper, L'Italia del Popolo, published it with an offer of a prize for breaking the cipher (Wikisource). Mazzini (Wikipedia), supporting Italian independence from Austria, had been disappointed with the Pope's noncommitting attitude. The ciphertext was later reprinted in Rome as a broadsheet.
The ciphertext is as follows.
As is often the case with this kind of Italian ciphers, naive splitting, such as parsing into a sequence of two-digit groups, does not work.
In this case, the digit "5" is reserved as a delimiter (see the type described in "Nulls as Delimiters" in "Variable-Length Symbols in Italian Numerical Ciphers"). Bourdeau could see this before any symbol is read because splitting at every 5 digits yields 102 non-empty runs, of which most have an even number of digits.
However, his annealer got nowhere based on the assumption that each pair of digits corresponds to a letter. The next attempt assuming that each pair represents a letter or a syllable, except that a pattern 8XXX is a four-digit group for some word returned meaningful fragments. Then, the annealer was run again with those words fixed. After this, it was a usual process of recovering one symbol after another with manual help.
As Bourdeau notices, Kent Ramliden's comment in Cipherbrain came very close to the correct system. He considered that this may be similar to the system used between the Vatican and the nuncio in Vienna during the Congress of Vienna in 1814, whereby the cipher basically consisted of dinomes (two-digit groups) 00-99 but "5" and "7" were reserved, with a pattern 7XXX representing words/names. One might have broken the cipher earlier if "8" instead of "7" was tried.
The Vatican Challenge - Part 5 resisted even the powerful codebreaking agent of Bourdeau, who considers the scheme can be called "a polyphonic-syllabic cipher of the kind invented by Antonio Elio". The name Antonio Elio refers to the system described in Lasry, Simonetta, and Biermann, "Antonio Elio 'Cipher' and his Polyphonic-Syllabic Cipher" (HistoCrypto 2025), where multiple syllables may be represented by the same symbol with different diacritics but the diacritics are not used consistently. It is considered "nearly impossible" to break without prior knowledge of its principles.
Although his computational attack has been unsuccessful, Bourdeau drew some insights about the system (see his write-up). In particular, he considers "4" is a null to delimit cipher units. While visual inspection or trials and errors might suffice for the case of the Vatican cipher (1848) above or other instances in another article, a statistical method was used for this case.
Mutual information is a concept in probability theory, which in this case is, in my understanding, a measure of how predictable adjacent digits are from each other. Bourdeau found that mutual information when 4 is in the middle (e.g., A-4-B in my understanding) is 0.030, which is significantly lower than 0.08-0.17 for other cases but close to 0.028 for Italian at word boundaries. From this, he concludes "4" is a null delimiting cipher elements.
I wonder whether the mutual information makes sense when it is not known whether the digits are used individually or form groups of two (or three etc.) digits.
(NB. Soon after writing the above, the challenge was solved by Simon Klee. See below.)
"Vatican Challenge" was a by-product of a comprehensive study of Vatican ciphers (Lasry et al., "Deciphering papal ciphers from the 16th to the 18th Century" (Cryptologia)).
Using George Lasry's key, Daniel Bourdeau published his reading of some letters (DECODE R93-R102, R115). In these specimens, the figures are not only written in continuous streams of digits but they are polyphonic.
Daniel Bourdeau solved a cipher in DECDE R2159 (ÖStA_HHStA, Staatskanzlei Interiora, Chiffrenschlüssel, Kt.20. Fasc.27. f.18-19) described in another article.
I thought this was simple and those versed in Italian would readily complete my reading of the beginning: "Al principe di Trent", but my reading was wrong in places. Bourdeau's reading (which seems correct) is: "Al principe di Transilvania ...."
Parsing into one- or two-digit groups is straightforward because of dots in the original (except for "321", which is parsed into "3-21" (Bourdeau's key table retaining "32" must be his intermediate result)).
Bourdeau describes this as "polyphonic" because 17 stands for I or N and 19 stands for T or S, though he also points out a possibility of my transcription errors. I agree two instances for 17 may be an error for 14(=N). I further note the same correction may be made on one more instance close to the end:
5(F) 17(I) 14(N) 6(C) 10(H) 7(E) 17(N) 18(O) 17(I)[14(N)?] 11(L) 10(H) 3(A) 4(B) 17(I) 10(H) 25(V) 12(M) 17(I) 11(L) 15(I) 9(A) 19(T) 13(O) 18(O) 23(V) 15(I) 17(N) 22(T) 18(O)
This changes Bourdeau's reading: "fin che [io] l'habbi humiliat o vinto" to "fin che non l'habbi humiliat o vinto", thus eliminating the need of editorial intervention (Gemini says "non" is expletive and does not change the meaning; this is a possibility already pointed out by Bourdeau). This leaves only one instance for 17=N, with all the others consistent with 17=I.
Regarding 19=T (3 instances in my counting: Transilvania, rivoltare, humilitato)/19=S (6 instances), I cannot see the differences in the glyph. (Sometimes a dot is on 1 but the dotting does not seem to be consistent.)
I am aware that we should not jump to explaining these away as encryption errors (given that the ciphertext seems to have few other errors), but I cannot think the cipher was intentionally designed polyphonic.
Daniel Bourdeau solved the digit-stream cipher in DECODE R1408 (ÖStA_HHStA, Staatskanzlei Interiora, Chiffrenschlüssel, Kt.14. Fasc.20. f.176) described in another article. The only cleartext at the beginning "Di Varsouia 24 Xbre 1627" (From Warsaw, 24 December 1627) indicates the language is Italian.
Although the digits are written without spaces, splitting them into two- or three-digit groups is straightforward. Before detailed analysis, Bourdeau saw that the frequency of figures 12-33, which account for 265 of the 308 numeric tokens, is consistent with ordinary Italian text. (Given this much, I think manual codebreaking might have been possible.) The frequently occurring letters "a" and "m" in the ciphertext were considered to be nulls because the annealer assigned the same vowel to them, which yields improbable sequences in Italian.
As it turned out, odd figures 13-33 and even figures 14-33 correspond to a-m and n-z in alphabetical order. Figures out of this range are common words such as "si", "non", "ne", "de", "con", "al", .... Letter pairs in the ciphertext are meaningful: LL(t), TH(l), ....
Ilia Chirtulov, with the help of Claude (Anthropic), solved the cipher presented in another article (DECODE R2179) (ÖStA, HHStA, Staatskanzlei Interiora, Chiffrenschlüssel, Kt. 20, Fasc. 27, f. 54).
He found the key is R2176 (two-digit figures for letters and syllables) and R2177 (two-digit figures with dot(s) and other symbols for names and words). These keys appears to be notes of reconstructed symbols rather than the original key, but they include symbols not used in this letter. It appears he found R2176 after the deciphering is complete.
After all, digits are grouped in two-digit figures.
Dots are not separators but indicate that the two-digit group should be looked up from the key for names and words. In trying to parse the ciphertext into two-digit figures, I was troubled by "·7·9" (".7.9" in my transcription). As long as dots are taken to be separators, parsing would not succeed.
Although the vocabulary seems to be Italian and the little cleartext in the letter is also Italian, the plaintext turned out to be in German! (Attempts assuming Italian would not have worked.)
Group-by-group decoding of the beginning is shown below. (My original transcription missed many dots placed under the second digits.)
Below are the plaintext and translation provided by Chirtulov.
Apart from the reading, Chirtulov provides his conjectures on the context. The key has names such as Cromwell, Lisola, Peñaranda, Don Luis, Curtz and Auersperg, which suggests c.1657-1659. He also points out that in view of the stamp of the Fürst Porcia'sches Familien-Archiv (Spittal an der Drau), "V. Ecc.za" in the plaintext may be Johann Ferdinand Porcia (Wikipedia), Obersthofmeister of Leopold I from 1657.
Andrew Aymeloglu solved the digit-stream cipher provided by Alexandre Pillon described in another article. Georg Adam Starhemberg was an Imperial envoy in Paris and worked with Count Kaunitz to bring about the rapprochment between Austria and France in 1756.
The scheme employed in this cipher is more complicated than others and, as expected, my tentative parsing was not right.
As an example, I tentatively parsed the first two lines as follows,
Here, "9,1" on the second line did not seem right. As it turned out, "9,1" is all right but there are other tricks in the scheme.
The parsing rule Aymeloglu found is as follows: the digit basically form two-digit groups, but when "3" occurs, the following four digits form a group (e.g., 31159). When "8" occurs singly, it is a null but, when marked, it can also start a three-digit group for punctuation, dates, and table changes. Applying this to the above yields the following:
Explicit punctuations in the ciphertext are all deceptive and should be ignored. Hence, what troubled me (the estimated unit spanning punctuation like "9,1") was no problem.
The beginning can be read as follows:
883(the Clavis Prima gives "august" but Aymeloglu treats this as "framing") 31159[so] 31217[stat?] 31214[lich] 69[als] 31420[ich] 31078[nun] 31047[den] 31126[in] 95[n] 31382[halt] 31109[der] 31226[selb] 31033[ge] 31452[fu] 31265[n] 31047[den] 31443[so] 31191[groß] 31306[hoff] 31078[nun] 99[[g]] 31080[mach] 31268[mir] 854[,] 00[das] 8[-] 31221[es] 31109[der] 31099[o] 31226[selb] 31005[an] 31019[noch] 31033[ge] 8[-] ...
*99 should be "man" according to the Clavis Prima but Aymeloglu finds "g" better fits here and elsewhere.
Aymeloglu found a 1752 key is in DECODE R1695 and R1698, with instructions and worked examples in R1696 and R1697 (the latter is cleaner). (I didn't look at these because they were buried in so many keys R1474-R1777.)
R1695: P3 and P4 (Secunda, alphabetical), P6 and P7 (Prima, alphabetical); P8 (Prima, numerical), P9 (Secunda, numerical)
R1698: P1 (Prima, numerical), P3 (Secunda, numerical)
The instructions in DECODE R1696 prescribes that punctuations can be made at will because the authorized recipient will know the splitting anyway (no.7).
One interesting spin is the switching between two tables, Clave Prima and Clave Secunda. The indicator ("indicans") "876" (occurring at position 662) switches Clave Prima to Clave Secunda, and "899" (occurring at 1349) switches back.
(I reported such table switching for French ciphers. See my articles for the time of Peace Negotiation at Ryswick and the American Revolutionary War).
After solving, Aymeloglu found the very scheme is described in Appendix C of "Development of obfuscation techniques in Vienna during the early modern era" (Cryptologia) (Figure C2 corresponds to DECDE R1697), though the above letter is not discussed. (The schemes I described in "Variable-Length Numerical Code in Austrian Archives" (September 2025) had also been covered in generic terms in this paper (published online in May 2025).)
A ciphered letter of Cardinal Alessandro Farnese (Wikipedia) from April 1542, publicized as "Vatican Challenge Part 5" in MTC3, has resisted the efforts of the most talented codebreakers. No wonder. It turned out to involve nondeterministic parsing.
In September 2026, Simon Klee published his solution, which was officially accepted by MTC3 and was also verified by Daniel Bourdeau (github).
In order to decipher this kind of ciphertext, the first step is to parse the continuous stream of digits into tokens (digit groups). Typically, there are some rules to allow the intended recipient to properly read the text. For example, a particular digit serves as a delimiter or indicates the beginning of a longer unit. In "Variable-Length Symbols in Italian Numerical Ciphers" (2017-2019), I gave instances for which there appear to be no definite rules for parsing ("Cipher between marquis of Vieuville and Duke of Nevers (1589)", op.cit., and 2019 blogpost, 2020 blogpost).
Such a system where parsing depends on context and cannot be determined by rules is aptly called "nondeterministic" in George Lasry, Beáta Megyesi, and Nils Kopal (2021) "Deciphering papal ciphers from the 16th to the 18th Century" (Cryptologia, first published online 23 June 2020), section 3.6. It seems they have broken some ciphers with nondeterministic parsing ("F22b", "S6").
The cipher in the Farnese letter also involves nondeterministic parsing. After trying some schemes, Klee arrived at the idea that tokens are one or two digits and "the reader tells them apart by context". He seems to have been inspired by observing ciphers printed in Meister (1906) such as
Although I thought "6=null" served as a delimiter (op.cit.), after all, it is up to the user how consistently the null is used to indicate token boundaries. So it may be justified to view this as an example of a cipher with nondeterministic parsing.
Then, what should be done is optimization of letter assignment and token division at the samte time. Specifically, an outer search sought to optimize assignment of letters to one- or two-digit codes and an inner search looked for the best division of the ciphertext into tokens.
For ordinary ciphers (deterministic in that the ciphertext can be definitely parsed into tokens), there is no need of the inner loop. Starting from random assignment of letters, a score is calculated, a small change is made in the assignment, and the change is kept if the score improves and discarded otherwise. (In simulated annealing Klee used, a worse candidate is accepted with a small probability in order to avoid being stuck at a local optimum.)
In this case, for each letter assignment, the inner loop is run to find out the best division for that assignment.
After checking the same key is reproduced, he presents his alphabet as follows.
Klee gives an example showing a difficulty of nondeterministic parsing even for those who have the key. A sequence 057805 can be either parsed as 0(s)5(a)7(n)80(t)5(a), i.e., santa (holy) or 0(s)57(p)8(e)0(s)5(a), i.e., spesa (expense).
Klee observes the null "9" is sometimes used at word boundaries as well as within words. We may say it was used (albeit sparingly) to mark token boundaries. (A null within a token, what I call "intercalary null", is also documented, but I have seen few instances.)
In the first search of this letter key, Klee set aside the digits with a dot or comma above them and started with a fresh language-model context at those places.
When the single letter symbols are revealed, Klee could identify the reading of tokens with dots. For example, 27, 72, 57 are C, B, P, but with a dot over the first digit, they mean QUA, QUE, QUI and with a dot over the second digit, they mean CHE, CHI, NON.
AI can also handle this kind of cipher. Paolo Rosson, working with Claude (Anthropic), running as Claude Code with subagents, notified me (12 October 2026) of his solutions of BnF fr.4700 f. 72 (Duke of Nevers to Tommaso Bozio, 1 May 1593) and BnF fr.4700 f.80, 85, 65 (Nevers's agent in Rome, Vincenzo Badalocchio, December 1592 to January 1593). According to him, the cipher used in Badalocchio's letter is a replacement of no.56 in what I call the Nevers Collection, whose endorsement says that it was replaced in September 1592.
He found 0 (null) as well as 3, 5, 6, and 7 (vowels) stand alone; 4x, 8x, and 9x form two-digit groups t represent letters; and 1 and 2 start a three-digit group. (In three instances of 2, he finds it should be taken alone.) "A dotted stroke [like "i"] + 1xy" represent a name.
Regarding how this "cut" was found, I suppose he (with AI) tried various possibilities. He records as part of verification "The cut rule against rival rules" (here). If applying a cut rule leaves many digits unaccounted for, the rule may not be good. He records the "new cut" improves much over the "old cut". The "old cut" took 2 as well as 0 for a null. Reinterpreting it to be part of three-digit groups improved the results significantly.)
Once the digit stream is split into tokens, I believe the cipher is not difficult.
Héder, M ; Megyesi, B. The DECODE Database of Historical Ciphers and Keys: Version 2. In: Dahlke, C; Megyesi, B (eds.) Proceedings of the 5th International Conference on Historical Cryptology HistoCrypt 2022. Linkoping, Sweden : LiU E-Press (2022) pp. 111-114. , 4 p. [pdf]
Megyesi Beáta, Esslinger Bernhard, Fornés Alicia, Kopal Nils, Láng Benedek, Lasry George, Leeuw Karl de, Pettersson Eva, Wacker Arno, Waldispühl Michelle. Decryption of historical manuscripts: the DECRYPT project. CRYPTOLOGIA 44 : 6 pp. 545-559. , 15 p. (2020) [link]
Megyesi, B., Blomqvist, N., and Pettersson, E. (2019) The DECODE Database: Collection of Historical Ciphers and Keys. In Proceedings of the 2nd International Conference on Historical Cryptology. HistoCrypt 2019, June 23-25, 2019, Mons, Belgium. NEALT Proceedings Series 37, Linköping Electronic Press. [pdf]