Vigenere's Chiffres à Double Entente

Ciphers that can produce two different plaintexts are described as Des chiffres carréz à double entente in Blaise de Vigenère, Traité des chiffres (Wikisource) (f.183v ff.).

Vigenere Cipher

The description (f.186r) of the table on f.96v appears to be about the common Vigenere cipher (though it should be noted that the arrangement of letters in the table is not regular). The intersection of the row specified by a key letter and the column specified by a plaintext letter gives a ciphertext letter.

The example given is:

Plaintext: Aimons Dieu qui nous a aimez le premier
Key: l'entree du ciel

It is noted that each cell contains a pair of letters. When the plaintext letter (taken from the top alphabet) is the second one in the pair, the ciphertext letter in red should be used ("la premiere à la premiere, & la seconde à la seconde").

The opposite can also be possible: when the plaintext letter is the first one in the pair (in red), the second letter in a cell (in red) should be used ("la rouge respondant à la rouge, & la noire à la noire").

(Whichever mode is used, it would be straightforward to rearrange the table into an ordinary square format with each cell containing one letter.)

Digraphic Cipher à la Vigenere

This (f.186v-187r) uses the table on f.50v, which is substantially a common Vigenere table, when used with the alphabets of capitals in red (on top and left). But it also provides alphabets of capitals in black. Vigenere says this provides "chiffre double".

The example given is:

First text: Les causes premieres meuuent les seconds; les secnodes les tierces
Second text: Il ne s'effectue rien en la terre, qu'il n'ait premier esté esbauché au ciel

The scheme explained is what we call a digraphic cipher today: two letters in the plaintext are translated into two letters in the ciphertext.

So, one may simply encipher the first text, taking letters two by two: le, sc, au, ....

Alternatively, one may pick one letter from each of the two plaintexts and encipher the pair (l/i, e/l, s/n, c/e, ...) into two letters in the ciphertext.

Whichever option is used, the process for enciphering/deciphering is the same. Given two letters of the plaintext(s), a row and a column are identified according to the alphabets in red and a ciphertext letter is found at their intersection. For example, a pair of two letters L/E is translated into f, which is at the intersection of the column headed by L and the row headed by E.

Of course, deciphering is not possible with f alone, because "f" occurs twenty times in the table. So, the ciphertext letter is associated with another letter from the black capital alphabet (on top or left) to identify which cell with "f" should be taken. If the top alphabet is used, the accompanying letter would be T; if the left alphabet is used, it would be O.

Enciphering two plaintexts works exactly the same way. Given L/I, the ciphertext letter is l. The indication letter would be T ("s" given by Vigenere seems to be a typo) if taken from top, or S if taken from the side.

(Vigenere seems to say Raymond Lulle employed this when he referred to Angulus contingentiae, but the meaning of this reference is not clear to me.)

Vigenere's Cipher à Double Entente

(Above) Vigenere's digraphic cipher (Below) Porta's digraphic cipher

The table between f.184 and f.185 works in a similar way (f.185rv, f.187rv) and the same example texts as above are used. Here, two letters representing two plaintext letters are explicitly written in each cell.

Again, two letters to be enciphered can be from the same text (L/E) or different texts (L/I). Using the black alphabets on top and on the side, L/E is enciphered into sg; L/I is enciphered into ag. If the red alphabets are used, L/E is enciphered into dm.

In the cell "ag", a small capital letter "A" is placed. Vigenere says this is equivalent to the two letters ("vallent le mesme que les deux lettres accouplees ensemble") and is placed to show that the two letters serve only for one character, but this is not clear to me. Cells with such a small capital are: LI(plaintext letters) ag(cell) A(small capital); SN mp B; CD ix D; AS xt E(I?); VE fr F; SF cp H; EF ob L; SC bp M; PT pm N; RV so R; and QE bn T.

When Vigenere says his scheme with ordinary 20 letters of the alphabet is better in avoiding suspicion than using 400 characters, he may be referring to Porta's digraphic cipher with 400 different graphic symbols.

Presenting a Fake Plaintext

This scheme allows disclosing one of the two plaintexts but not the other. Such a scheme may indeed be useful when one is pressed by a tyrannical government to disclose the plaintext.

In my understanding, this works as follows. When pressed to disclose the key by the authority, one can show the table but without the top (or left) alphabet. Suppose the top alphabet was used for the true message and the left alphabet was used for an ostensible plaintext, one can disclose the table but omit the top alphabet, pretending that the plaintext letter is found by looking horizontally. Then, a ciphertext "ob" can be uniquely deciphered to F from the left alphabet.

With such a scheme, the number of letters in the ciphertext is double the original, which may seem unnaturally redundant. An experienced cryptographer would readily suspect there has to be another alphabet on top. Once suspected, it may be difficult not to disclose the secret.

Variant with Arabic Figures

The table between f.192 and f.193 is a variant digraphic cipher in which 400 two-letter combinations are replaced with permutations of three Arabic figures from 1-8, with 0 and 9 reserved for nulls or delimiters (f.192-193) (The example on f.192 does not seem to fit the table: L/I represented by 517, E/L by 536, S/N by 576, C/E by 388.).

Three Ciphers Combined

Using alphabetical letters (a-z and &) instead of 1-8 allows an interesting adaptation. By using three sets of eight symbols (a-h, i-q, and r-z&), three ciphers can be combined in a single ciphertext. Instead of 111 representing RR ("r q" on f.193v seems to be a typo.), aaa, iii, or rrr may be used; instead of 728 (representing QQ), gbh, pkq, zs& may be used.

This can also be used for double (or triple) meaning. By alleging any of the three alphabets to be nulls, the true plaintext may be omitted in disclosure. (The idea of using nulls to convey a secret message may be found elsewhere.)

Variant with Monosyllables

Vigenere goes on to describe a further variant in which two letters are represented by monosyllables (f.198rv). The two plaintexts are:

Le Pape à l'appetit d'autruy a entrepris une chose
dont peult estre il ne mettra guere a se repentir

A letter from the first plaintext is found on the top alphabet (in red) and a letter from the second is found on the side alphabet. For example, the first letters from the two plaintexts L/D are enciphered as poing. The rest proceeds like:

Superencipherment

Moreover, the resulting ciphertext words undergo superencipherment ("surchiffé" by using "enuelouppe") by using a Porta-like reciprocal substitution table on f.46. It is an autokey cipher with an initial key letter P (whereby the ciphertext letter obtained is used as the key letter to encipher the next plaintext letter). First, the reciprocal table identified with the initial key letter P is consulted, which translates the initial plaintext letter p (in the ciphertext from the first step, "poing") into l. Thus, the reciprocal table for L is used to encipher the next letter (Vigenere seems to be mistaken in using the P table again on f.198v).

(The superencipherment is too tedious to be used in manual encryption, especially given that the simple Vigenere cipher as understood today was already considered undecipherable until the nineteenth century.)

Fake Message to Mock Papal Codebreaker (1551)

It is in this context that Vigenere tells an episode about a papal codebreaker tricked into deciphering a fake message (f.197r-199r).

It was in 1551, when Vigenere was in Rome and Therme (Wikipedia) (later marshal of France) was imperial ambassador; the Pope Julius III was allied with the Emperor against France (Wikipedia).

Paulo Pancatuccio de Volterre, who served the Pope in cryptanalysis, was talented enough to perform some "petits miracles". One day, certain "bons compagnons" of the French party, seeking to humble his pride, forged a letter in cipher addressed to "Monsieur le Baron de Grissemenisse, grand superintendant, etc." and marked as important. When the courier arrived at Espolette (?Spoleto (Wikipedia)), pretending to look for something in his suitcase, he deliberately left the despatch and the postmaster delivered it to the Chief Secretary of the Pope.

Pancatuccio readily deciphered the opening words, which was not surprising because it was only "vne bien simple transposition de lettres". While f.11 referenced here deals with scytale and the Caesar cipher, I believe the latter is meant. The scytale Vigenere describes is not a transposition cipher (see my blog post and my article about the scytale), while the Caesar cipher is described as "transpositions, mettant les lettres l'vne pour l'autre".

Seeing that the deciphered text suggested the importance of the letter involving "Monseigneur l'Illustrissime DINERO qui commande" (the pseudonym was enciphered in capital), he reported it to the Secretary.

Upon returning to work on the rest, however, it turned out to be a mocking message to the codebreaker:

0 poor wretched slave that you are to your decipherments, on which you waste all your oil and your pains, what does it profit you to eat out your heart in the quest of these vain curiosities, presuming by your laborious researches to be able to attain to the discovery of the secrets of others, which are reserved to God alone? Come, use your leisure and your work in the future for things more fruitful, and stop uselessly frittering away your time, one lone minute of which cannot be bought back by all the treasures of this world. (translation by Mendelsohn)

This episode is told by Mendelsohn and repeated by Kahn and Pesic, but the relation with the chiffre à double sens has not been clear.

Parallel with an Ancient Anecdote

As an aside, Vigenere compares this to an episode told by Herodotus. The tomb of the Babylonian queen Nitocris (Wikipedia) (one of the two queen regnants in the history of Babylon, with the other being Semiramis) had an inscription:

If one of the rulers of Babylon after me is in need of money, let him open my tomb and take however much he likes. But if he is not in need may he under no circumstances open it: otherwise it will not be well for him. (translation by Dillery)

Darius the Great opened the tomb only to find a mocking inscription inside:

If you had not been greedy for money and shamelessly interested in gain, you would not have opened the graves of the dead. (translation by Dillery)

Challenge

Anyway, the text above deciphered by Pancatuccio ends with a challenge:

Put matters to the test now, and see if you can get at the meaning of one little letter of what follows here. (translation by Mendelsohn),

This is immediately followed by an explanation, "C'estoit vn chiffrement à double sens, tout formé de monosyllabes" with superencipherment. I believe this does not mean that the ciphertext that gave the above decipherment could be deciphered in another way. This must refer to the challenge cipher following it.

Vigenere's explanation of the scheme is what is described in the previous section above.

Considering that Vigenere clearly says a chiffre à double sens is involved in this episode, he may have learned this in Rome rather than invented it himself.

References to this section

Assessment

In my understanding, Vigenere's chiffre à double entente or double sens works in a manner similar to a running key cipher, in which a first plaintext is combined with a second plaintext instead of a key text. Since the key text is not given for deciphering, each cell of the square table provides two letters instead of one. (Instead of two-letter combinations, figures, monosyllables, or graphic symbols may also be used as long as necessary patterns are covered.) So, seen end-to-end, it is effectively a digraphic cipher.

Originally, I was looking for a scheme that allows disclosing an ostensible plaintext while keeping another plaintext secret. Suppose one is caught with a ciphertext for "Down with Putin". Pressured to reveal its decipherment, one may want to show it is deciphered as "Long Live Putin" (an example used in a blog post).

With Vigenere's scheme, however, once the deciphering table is disclosed, the omission of the horizontal (or vertical) alphabet is likely to be noticed by a codebreaker.

It may not provide effective protection against pressure from the authority. Still, I find this interesting enough to be used in a detective story or film.

My Related Blog Posts

"Deriving a Fake Message from Ciphertext: 16th-century Venetian Example"

"A Cipher Disk and Treatise on Cipher from ca.1590-1650 "

"Double Reading Caused by Omission of Breaks"

"J.F.W. Herschel's Cipher Puzzle "