Beale's Method of Cipher

Beale Treasure Story

This web page is a continuation of Chapter 6 and Appendix 14 in Volume 2 of Beale Treasure Story [1]. It describes a method of cipher that Beale likely used to encode his papers No. 1 and No. 3. The resulting cipher texts are referred to here as B1 and B3, respectively. The analysis and conclusions given here are based on an assumption that Beale's ciphers are genuine and that the Beale Treasure Story is factual.

Important Conclusions from Volume 2 of Beale Treasure Story.

1. B1 and B3 were encoded with the same cipher and key. This would make Beale's task simpler.

2. Observed patterns in the cipher text indicate that paper No. 3 was encoded first and paper No. 1 was encoded second. Beale probably concatenated Paper No. 1 to the end of Paper No. 3 and encoded the two as a single plain text to ensure that Mr. Morriss would not recover Paper No. 1 without first recovering Paper No. 3.

3. For practical purposes, cryptanalysis of B1 and B3 can be performed on a single cipher text consisting of the concatenation of B3 and B1, designated B3B1. Thus, B3 and B1 can be attacked as a single cipher with 1138 cipher numbers rather than as separate ciphers with 618 or 520 cipher numbers, respectively.

4. Cipher B3B1 has an "inner cipher" B3B1-I (Appendix A), which can be recovered by removing the upper one or two digits from all 3- and 4-digit cipher numbers in B3B1. The spurious digits were added by Beale to disguise the true cipher and make it look like a "book cipher." Beale's true cipher consists of one and two digit cipher numbers from B3B1-I (Appendix A).

5. Analysis specifically shows that there are too few repeated 2-grams in B3B1 and in B3B1-I for these cipher texts to have been encoded using a simple homophonic cipher, e.g., a "book cipher." For Beale's cipher to be genuine, these cipher texts (B3B1 and B3B1-I) must have been created with a cipher method that "flattens" the resulting 2-gram statistics. This could occur if the plain text were first scrambled using a transposition step and then encoded with a homophonic cipher. Other encoding operations, such as the use of a polyalphabetic cipher, could cause the same outcome.

At this point, the following can be said about Beale's method of cipher: Beale's plain texts No. 1 and No. 3 were concatenated by appending No. 1 to the end of No. 3. The plain text was then encoded with a method that produced cipher text B3B1-I. To disguise B3B1-I, Beale appended one or two leading digits to some of B3B1-I's cipher numbers, thus producing B3B1. B3B1 was then divided to obtain B3 (consisting of the first 618 cipher numbers in B3B1) and B1 (consisting of the remaining or last 520 cipher numbers in B3B1).

Additional Tests Showing Too Few Repeated 2-Grams in B3B1-I

The lack of repeated 2-grams in B3B1-I is an important bit of evidence. If B3B1-I is randomly mixed 10,000 times, and if each time a count is made of the number of repeated 2-grams, one observes that the number of repeated 2-grams in B3B1-I, namely 181, falls nicely within the distribution of these 10,000 computed values. The distribution ranges from 130 to 249 with an average value of 188.

It is also important to have an idea in mind of how many repeated 2-grams we would expect to find in B3B1-I if it had been encoded with a monoalphabetic-homophonic cipher with 100 homophones (00 to 99). A computer program was written to input and encipher 1,000 different plain text messages of length 1138 consisting of ordinary English text. A 100-element key consisting of single letters was used to encipher each plain text message. The assignment of homophones in the key was made proportional to the frequency of each letter in ordinary English text. The key consisted of seven homophones for letter "A," two homophones for letter "B," three homophones for letter "C," and so forth. For each of the 1,000 generated cipher texts, a count was made of the number of repeated 2-grams. The 1,000 values formed a distribution. Of these 1,000 values, 44% fell between 230 and 239; 91% fell between 220 and 249; 99% fell between 210 and 259; 100% fell between 200 and 269. The average value was 235.

A similar test was performed using 10,000 B3B1-I look-alike cipher texts, which were produced by encoding 10,000 look-alike plain texts. The same enciphering procedure and allocation of homophones was used. The distribution of repeated 2-gram statistics was slightly different, but the overall result was the same.

The way in which the distribution of repeated 2-gram statistics might be useful can be illustrated. Suppose that we learned that B3B1-I had been created by first performing a transposition on the plain text and then enciphering the transposed text using a homophonic cipher. Suppose further that we were able to reverse the transposition operation, to produce a transposed B3B1-I, which in theory could be broken if we were then able to reverse the homophonic cipher operation. Moreover, we would expect the transposed B3B1-I to have a repeated 2-gram statistic that falls, say, in the 91% range of the distribution (cited above), i.e., between 220 and 249 and with an average value of 235.

Beale's Letter String ABCDEFGHIIJKLMMNOOPPP

Several monotonic increasing letter strings occur in the recovered plain text when B1 is deciphered with the key to B2. In a monotonic increasing letter string, each letter is either one greater than the previous letter or equal to the previous letter. The longest letter string ABCDEFGHIIJKLMMNOOPPP is just too long to be accidental. It could only have been created by someone who knew the key to B2.

The letter strings have the appearance of being created via a process of double encipherment (see Double Encipherment Explained). Thus, if the letter strings are genuine it means that they were created by Beale as part of the process of creating B1. Moreover, it means that the cipher numbers corresponding to the letter strings can be deciphered with the key to B1 and the key to B2 to produce two different meaningful decodings. It also means that the string ABCDEFGHIIJKLMMNOOPPP was created for a purpose.

As a practical matter, because double encipherment introduces an extra degree of difficulty into the enciphering process, it is not unreasonable to expect that imperfect letter strings of the form ABCDEFGHIIJKLMMNOOPPP, with repeated II, MM, OO, and PPP, might be created with Beale's double encipherment method. It seems less likely that perfect letter strings of the form ABCDEFGHIJKLMNOPQRSTU would be created.

So why did Beale find it useful create the letter string ABCDEFGHIIJKLMMNOOPPP? Let us examine this issue.

In Beale's letter to Mr. Morriss of May 9, 1822, he says with respect to the box left in Mr. Morriss' charge "Should none of us ever return you will please preserve carefully the box for the period of ten years from the date of this letter, and if I, or no one with authority from me, during that time demands its restoration, you will open it, which can be done by removing the lock." Beale recognized that 10 years was a long time and that Mr. Morriss would be exposed to possible sickness or even death. Thus, as an extra safeguard, Beale instructed Mr. Morriss to "select from among his friends someone worthy, and to him hand this letter, and to him delegate your authority."Thus, in the event of Morriss' death, the box and its contents would pass to one of Morriss' friends.

Clearly, Beale wanted a way to recover the box left in Mr. Morriss' charge. That recovery might take place between Beale and Morriss themselves. But it could occur between a member in Beale's company (Party A) and a person to whom Mr. Morriss had delegated his authority (Party B).

The meeting between parties A and B might go like this: Party B is asked to open the box by first removing the lock. Party B is asked to locate and remove the unintelligible paper beginning with number 71, namely the cipher text that we call B1. Party B is asked to create a decoding key by consecutively numbering the words in a copy of the Declaration of Independence. The meeting might be delayed until a copy of the Declaration is located. Party A tells Party B to decode the 21 cipher numbers that begin at location 188 in B1. This is done by replacing each number with the first letter of the so-referenced word in the decoding key. If these instructions are followed, Party B is told that an alphabetic letter string beginning with letter A and ending with letter P will be produced. Party B decodes the 21 cipher numbers and sure enough he recovers the letter string ABCDEFGHIIFKLMMNOOPPP. Each party is satisfied. Party B is satisfied that Party A is genuine, since how could Party A know that such an alphabetic letter string would be decoded with a key produced by numbering the words in the Declaration unless he had authority from the creator of these unintelligible papers. Moreover, if the integrity of the box has not been compromised, party A knows that he has correctly identified and can recover the unintelligible paper of greatest importance, namely the paper that describes the location of the treasure vault.

How Did Beale Select His Methods of Cipher?

In Beale's letters to Mr. Morriss, Beale does not provide Morriss with any details about his methods of cipher methods. Nor does he say how his cipher methods were selected. These details are left to conjecture.

However, with respect to the cipher used to encode papers No. 1 and No. 3, it is possible to make an educated guess. It is possible, and perhaps likely that Beale learned about ciphers by reading a treatis on the subject in some book. Yet, I cannot rule out the possibility that he may have held a position in some military or diplomatic organization that made use of ciphers, and thus learned about ciphers by working them.

In Beale's day, the best treatise on the subject, was a 32-page article on "Cipher," written by Dr. William Blair, a surgeon, and printed in Rees' Cyclopaedia. This lengthy tutorial on cryptography could have provided Beale with all the information necessary to construct his ciphers.

What we know is this: The list of subscribers for Rees' Cyclopaedia shows that there were several Lynchburg families who purchased Rees' Cyclopaedia. Rees' Cyclopaedia was also offered for sale at a local bookstore in Lynchburg, coincidental with Beale's first visit to Lynchburg, in 1819. If Beale wanted to learn something about ciphers while in Lynchburg, he would have had the perfect opportunity to do so. Thus, it seems likely that Beale read and studied Blair's article on "Cipher," that he was influenced by what he read, and that his ciphers were based in part on information found in Blair's article.

William Blair’s Article on “Cipher” and its Possible Influence on Beale

Beale’s method of cipher was, for the most part, very likely based on William Blair’s noteworthy 32-page article on “Cipher” published in Rees’ Cyclopaedia. During Beale's day, it was the best treatise on the subject. It could have provided Beale with all the information necessary to construct his ciphers. David Kahn, author of The Codebreakers [2], says "for almost a century, or until Parker Hitt wrote his Manual for the Solution of Military Ciphers in 1916, it remained the finest treatis in English on cryptology."

Two editions were published—a London edition (1819) [3] and an American edition ([1806-1822]) [4]. Both editions were issued in parts, or numbers. Ward & Digges’ Lynchburg bookstore offered the Cyclopaedia for sale six months before Beale’s first visit to the city. The following advertisement was printed in The Lynchburg Press, June 10, 1819 (p.3, c. 2):

Rees’ Cyclopaedia

For Sale

At the Bookstore of Ward

& Diggs,

79 Numbers of Rees’

Cyclopaedia

For less than half the price. They run to win,

consequently a few numbers more will complete

the work, which the purchaser will be obliged

to take at the subscription price.

The Ward of Ward & Digges was none other than Giles Ward, father of James B. Ward who later copyrighted and published The Beale Papers.

Beale’s polyalphabetic/homophonic cipher appears to be based on a method of cipher devised by Dr. Blair himself—a description of which is given in the final three pages of his 33-page article. Blair begins by saying that

“He is confident, however, that ciphers may be constructed, of a much superior kind to any he has met with; more ready in execution; more simple in their principle; more intricate to disclose; and (in some examples) not liable to suspicion.”

And, he ends by saying (in reference to his new method of cipher) that

“In consequence of such a construction … all the rules for deciphering with which the author is acquainted, are easily and effectually frustrated.”

Blair declares his cipher method to be inscrutable and therefore gives it the strongest recommendation. No doubt, this influenced Beale to adopt Blair’s method, which he incorporated into his own cipher method. But Beale didn’t want someone to break his cipher by merely reading Blair’s article. So he modified the method somewhat. Beale would have had over two years to build on, improve, and adapt Blair's method of cipher to his own purpose before giving the box to Mr. Morriss in 1822.

Blair doesn’t actually explain how his method of cipher works. Instead, he provides four challenge ciphers, which he says have been created with his method of cipher, using the “alphabet and key” printed at the top of Plate III in volume IV of the plates. The reader is expected to deduce how the four ciphers were created with the alphabet and key. This may have forced Beale to think even deeper in order to understand and fully comprehend Blair's method of cipher.

Some of my readers may at first think that creating an outer cipher from an inner cipher, by appending digits to some of the cipher numbers, is just too much of a 'stretch.' But, there is evidence that may convince one otherwise.

Blair States the Essential Properties of a Good Cipher

In no less than three places in his article on "Cipher," William Blair states the essential properties of a good cipher. This is advice that Beale is apt to have heeded. The three properties are these:

1st. That it be easy to write and read;

2d, That it be trusty and undecipherable;

3d, That it be clear of suspicion.

Blair was particularly keen on the 3d essential property of a cipher, namely "That it be clear of suspicion." He hammered on this idea by quoting the opinions of other experts who said that a good cipher

Should "insert a false design to cloak a true one,"

Should "prevent or divert suspicion,"

Should be designed so that an "examiner would fall upon the outward writing, and finding it probable, suspect nothing of the inner."

Sometime in the 1930’s, William F. Friedman studied Blair's cipher and managed to decode each of Blair’s challenge ciphers [5]. His analysis and findings are reprinted in Cryptography and Cryptanalysis Articles [5]. In particular, Figure 5 on page 251 shows a 9 x 9 key table filled with letters and with single row and column indexes 1, 2, ..., 9. This might be characterized as a 'simple' key and alphabet. Figure 6 on page 252 shows the same 9 x 9 key table, but with a more intricate indexing scheme consisting of three row indexes and three column indexes, such that each cell in the key table can be indexed in nine (3 x 3 = 9) different ways. This might be characterized as a 'complex' key and alphabet. These two examples may have suggested to Beale that he ought to make use of a comparable but different indexing scheme.

1 2 3

4 5 6

7 8 9

B C X

G M T

J P U

N T L

P U H

D A N

I E O

O I A

H O E

K D Y

Q F A

V L E

F E R

L I S

H O T

N S I

R T O

S U A

W H I

X N O

Z R .

N C U

R D A

S F E

T A E

U E I

A I O

Table 1. Blair’s Key and Alphabet

with rows and columns numbered

The first of the four challenge ciphers is a figure-cipher that looks like this:

152618035466693599507192735855362202836931217327

245920645394011183947056667685736342011439314394

706595077377993219296977788565806653544536151393

294785046353641935574079616392439375896198162891

963401283797466464393112515532259472106664630615

346495968670125532261892940717273752693373561630

111839470223534399324251116177507163064696146047

396196849394786382053824306637295903546799396818

814241505284652207565474849424546691116180271131

181215172736480949922450654401526391403546450585

938016351127572159689409599920342824626514355849

750765645670655704298943235151226059520112556686

749471813940832326185713035464507483150566895445

512171836151643044352858374468160666509554768588

035938598941227616384439371726374934581971417363

934937173772693947584872425162776569386776645475

849593693533642939977726384949353464593385293948

775729335036291525573993869407799931118017363534

144948678911546393959992032465312151775790458112

182458936847344546061634743933239122516173546075

738412872248587874759694930001118484942455693717

298756400667263932218363946355455774393839400748

924261846569335464500075651432544581938674850858

995445512251615937799071574958459398823246652465

847728373693585993152618174693987447572812357443

Figure 1. One of William Blair’s Four Challenge Ciphers

It is supposed that Beale studied this challenge cipher and eventually figured out how it could be deciphered. From this he was guided in the construction of his own cipher method.

If the zero digits in the challenge cipher are discarded and the remaining numbers are rearranged as pairs of digits, and if the key is then applied, one obtains the following:

15 26 18 (0) 35 46 66 93 59 95 (0) 71 92 73 58 55 36 22 etc. etc.

T H E A R T . O F W R I T I N M etc. etc.

The reader can see from this one example that Blair makes use of an outer cipher with the digits of the cipher numbers strung together and with spurious zero digits inserted and an inner or true cipher in which the zero digits have been removed and with the cipher digits separated and written as 2-digit cipher numbers.

Referring to the key (Table 1), number 15 is deciphered by locating the letter T in row 1 and column 5, number 26 is deciphered by locating the letter H in row 2 and column 6, and so forth.

In this short example, Blair has already made one simple clerical error. Number 22 (=M) should be the number 21 (=G). Blair misread the column number. Beale may have made similar clerical errors when using his key. (Keep this error in mind when reading near the end of this paper.)

Note also that Blair uses the digit 0 and the period as word separators. Beale probably did not use word separators; we do know that word separators were not used in cipher B2.

In developing a solution that satisfied his needs, it is apparent that Beale could not resist the temptation to invent a better method with his own “signature” on it.

Beale had almost two years, virtually all the time in the world, to construct his method of cipher. Unlike diplomatic and military ciphers, which would be used over and over again, Beale’s ciphers would be used only once. This was a “one shot” deal! Beale wanted a clever design that would keep his secrets absolutely safe, even if this required additional time and effort on his part to construct the ciphers.

After reading Blair's article, as well as other works on the subject, and learning what other researchers had to say about Blair's article, I have concluded that Beale likely used Blair's cipher as a starting point to create a new cipher. The new cipher was used to encode Papers No. 1 and No. 3.

Unlike Blair's 9 x 9 key table, Beale used a 10 x 10 key table. Like Blair's key table, Beale's key table was filled with English letters in proportion to their frequency of occurrence in ordinary English text. Thus, the common letters E, T, A, I, O, N, R and S would have more homophones than the less common letters B, C, D, F, G, H, L, M, P, U, V, W, and Y. The uncommon letters J, K, Q, X, and Z would have the fewest homophones.

Beale may have used an indexing scheme based on multiple indexes.

Whatever Beale's choices were, they produced a cipher text with a 'flattened' distribution of repeated 2-grams.

What sort of cipher would cause a 'flattened' distribution like the one found in inner cipher B3B1-I?

The flat distribution of cipher numbers in B3B1-I could be explained if Beale had used a transposition or mixing operation on the plain text prior to encoding with a homophonic cipher

A simple way to mix a string of letters and numbers is by making use of a table. The elements (letters or numbers) are written into the table in one way and then read out in another way. The elements could be written into the table row-by-row, left-to-right and top-to-bottom and then read out column-by-column, right-to-left, bottom-to-top. Elements could be written into or read out of the table in a variety of ways, e.g., in an alternating fashion (back-and-forth or down-and-up). Different table dimensions can be used as well. In his article, Blair described a transposition cipher in which elements were written along the diagonals of a table.

It is easy to test for the use of a transposition cipher. Basically, one tries different ways to un-mix the cipher text B3B1-I and each unmixed text is examined to see whether it contains a number of repeated 2-grams significantly greater than the 181 repeated 2-grams in B3B1-I. If so, then we might conclude that Beale used a transposition cipher to mix his plain text prior to encoding with a homophonic cipher. To this end, a computer program was written to un-mix B3B1-I and compute the number of repeated 2-grams in the unmixed text. Every imaginable write-in and read-out operation was examined and tried. No combination was found that produced a satisfactory number of repeat 2-grams in the unmixed text.

A Permutation Cipher is treated here as a special case of a Transposition Cipher. Permutations of the plain text with different periods "n" were investigated. For example, permutations with period n=5 was one period investigated. In this case, the plain text is divided into groups of five consecutive letters numbered 0, 1, 2, 3, 4. A permutation for n=5 might be 0, 2, 1, 3, 4. That is, prior to encipherment with a Homophonic Cipher, the letter at location 2 becomes the letter at location 1, the letter at location 1 becomes the letter at location 2, and so forth. The same permutation is applied to each consecutive group of five letters. A computer program was written to un-mix B3B1-I using different permutations. Nevertheless, I could not find a satisfactory un-mix permutation for any of the different periods, including period n=5. Analysis and testing indicated that Beale did not scramble his input plain text using a Transposition Cipher, nor did he scramble the plain text with a Permutation Cipher. The negative results obtained thus far seem to indicate that Beale most likely used a Polyalphabetic Cipher, in conjunction with a Homophonic Cipher, to encipher papers No. 1 and No. 3.

Published: Sept. 23, 2017

Enter content here

Polyalphabetic Ciphers

A polyalphabetic cipher is a cipher based on substitution using multiple alphabets—typically simple substitution alphabets. A polyalphabetic cipher is more complex than a simple transposition cipher. By 1819, several different polyalphabetic ciphers had been invented, e.g., by Porta , by Vigenere, and by Gronsfeld. Polyalphabetic ciphers have flat or very flat frequency counts, depending on the number of alphabets used by the cipher.

The polyalphabetic cipher described by Blair in his article on “Cipher” is commonly referred to as a Vigenere cipher, although Blair did not specifically refer to it as such. The Vigenere cipher makes use of shifted alphabets, as shown in The Vigenere Tableau (Table 2).

A B C D E F G H I J K L M N O P Q R S T U V W X Y Z

B C D E F G H I J K L M N O P Q R S T U V W X Y Z A

C D E F G H I J K L M N O P Q R S T U V W X Y Z A B

D E F G H I J K L M N O P Q R S T U V W X Y Z A B C

E F G H I J K L M N O P Q R S T U V W X Y Z A B C D

F G H I J K L M N O P Q R S T U V W X Y Z A B C D E

G H I J K L M N O P Q R S T U V W X Y Z A B C D E F

H I J K L M N O P Q R S T U V W X Y Z A B C D E F G

I J K L M N O P Q R S T U V W X Y Z A B C D E F G H

J K L M N O P Q R S T U V W X Y Z A B C D E F G H I

K L M N O P Q R S T U V W X Y Z A B C D E F G H I J

L M N O P Q R S T U V W X Y Z A B C D E F G H I J K

M N O P Q R S T U V W X Y Z A B C D E F G H I J K L

N O P Q R S T U V W X Y Z A B C D E F G H I J K L M

O P Q R S T U V W X Y Z A B C D E F G H I J K L M N

P Q R S T U V W X Y Z A B C D E F G H I J K L M N O

Q R S T U V W X Y Z A B C D E F G H I J K L M N O P

R S T U V W X Y Z A B C D E F G H I J K L M N O P Q

S T U V W X Y Z A B C D E F G H I J K L M N O P Q R

T U V W X Y Z A B C D E F G H I J K L M N O P Q R S

U V W X Y Z A B C D E F G H I J K L M N O P Q R S T

V W X Y Z A B C D E F G H I J K L M N O P Q R S T U

W X Y Z A B C D E F G H I J K L M N O P Q R S T U V

X Y Z A B C D E F G H I J K L M N O P Q R S T U V W

Y Z A B C D E F G H I J K L M N O P Q R S T U V W X

Z A B C D E F G H I J K L M N O P Q R S T U V W X Y

Table 2. The Vigenere Tableau

Referring to polyalphabetic ciphers, Gaines says “To know thoroughly any one of these ciphers is to understand the fundamental principles of all…” [6]. Referring to Table 2, the alphabet arranged horizontally across the top of the Tableau is the plain text alphabet. Below this, and parallel to it, are 26 alphabets, the first being a duplicate of the plain text alphabet, whereas the remaining 25 alphabets are shifted. Thus, the first alphabet begins with “A” and ends with “Z.” The second alphabet, just below the first, begins with “B” and ends with “A.” Each alphabet is named by its first letter, and is spoken of as its key. Thus, the key letter “A” points out the A-alphabet, the key letter “B” points out the B-alphabet, and so forth. The alphabet arranged vertically on the left side of the tableau is called the key-alphabet.

Generally speaking, encipherment with The Vigenere Tableau makes use of a subset of the 26 alphabets, say five alphabets, and the selection of the alphabets is typically based on a keyword, say “CANDY.” The length of the keyword is called the period of the cipher. Thus, the keyword “CANDY” defines an enciphering key with period = 5, as depicted in Table 3.

A B C D E F G H I J K L M N O P Q R S T U V W X Y Z

C D E F G H I J K L M N O P Q R S T U V W X Y Z A B

A B C D E F G H I J K L M N O P Q R S T U V W X Y Z

N O P Q R S T U V W X Y Z A B C D E F G H I J K L M

D E F G H I J K L M N O P Q R S T U V W X Y Z A B C

Y Z A B C D E F G H I J K L M N O P Q R S T U V W X

Table 3. A Polyalphabetic Key Based on Keyword “CANDY.”

The plain text “From Bufords, head....” would be enciphered by arranging the plain text in groups of five letters, writing the keyword letters above each letter in the plain text (pt), and then consulting the key to produce the cipher text (ct), viz.

Key: C A N D Y C A N D Y C A N D Y etc.

Pt: F R O M B U F O R D S H E A D etc.

Ct: H T B P Z W F B U B U H R D B etc.

Note that plain text letter “F” references cipher text letter “H” in the C-alphabet, plain text letter “R” references cipher text letter “T” in the A-alphabet, and so forth.

The key alphabet can also consist of numbers 1 through 26, in which case the key or key word is a string of numbers rather than a string of letters.

Mixed alphabets can also be used, in which case the letters in each alphabet are mixed or rearranged in some fashion, e.g., randomly mixed.

Polyalphabetic and Homophonic Ciphers Combined

Yes, it is possible to create a cipher that is both polyalphabetic and homophonnic. This can be demonstrated.

Let Pt be an alphabet consisting of 100 letters, where the letters in Pt are in proportion to their freqency of occurrence in English text. For example, let Pt be defined as follows:

Pt = AAAAA EEEEE OOOOO NNNNN TTTTT DDDDD HHHHH IIIII RRRRR SSSSS CCCC LLLL MMMM UUUU WWWW BBBB FFFF GGGG PPPP YYY JJ KK QQ VV XX Z

and let the cipher text numbers Ct be defined as follows:

Ct = 00 01 02 03 04 05 06 07 08 09 10 11 12 13 14 15 16 17 18 19 ... 90 91 92 93 94 95 96 97 98 99

The 100 numbers in Ct are scrambled, say five times, in some unpredictable manner to create five different strings of cipher numbers Ct0, Ct1, Ct2, Ct3, and Ct4. The key table looks like this:

Pt	E	E	E	E	E	T	T	T	T	T	...	J	J	K	K	Q	Q	V	V	X	X	Z
Ct0	18	33	95	84	57	.	.	.	.	.	...	.	.	.	.	.	.	.	.	.	.	.
Ct1	63	17	95	43	33	.	.	.	.	.	...	.	.	.	.	.	.	.	.	.	.	.
Ct2	42	.	.	.	.	.	.	.	.	.	...	.	.	.	.	.	.	.	.	.	.	.
Ct3	05	.	.	.	.	.	.	.	.	.	...	.	.	.	.	.	.	.	.	.	.	.
Ct4	29	.	.	.	.	.	.	.	.	.	...	.	.	.	.	.	.	.	.	.	.	.

Table 4. A Polyalphabetic/Homophonic Key

Each row Ct0 through Ct4 is comprised of numbers 00 through 99 in some mixed order. A plain text to be enciphered is first divided into consecutive groups of five letters each, and for convenience the numbers 0, 1, 2, 3, and 4 are written about each of the letters of each 5-letter group. Letters that have the number 0 written above are enciphered with the numbers in row Ct0 in the key table; letters with number 1 written above are enciphered with the numbers in row ct1, and so forth. For example, letter E with zero written above it can be enciphered with homophones 18, 33, 95, 84 and 57. letter E with 1 written above it can be enciphered with homophones 63, 17, 95, 43, and 33.

Basically, the cipher method is one in which five different homophonic ciphers are used to encipher the plain text. Each group of five letters is enciphered using five different homophonic keys.

However, the reader will note that the method lacks elegance and compactness: In the example, five separate homophonic ciphers are created and a 6 x 100 key table is utilized. In effect, it requires the creation and use of five separate homophonic ciphers, and a 6 x 100 key table is required.

In contrast, a 10 x 10 key table, a 5 x 10 set of column indexes, and a 1 x 10 row index are sufficient to construct a Polyalphabetic/Homophonic cipher with five indexes based on Blair's cipher method. However, before discussing this method, a cryptanalytic test know as a Kasiski Test is discussed.

The Kasiski Test

For 300 years, Vigenere-like ciphers were regarded by many as practically unbreakable. But in 1863 a Prussian cryptanalyst, Friedrich W. Kasiski, published a paper entitled Die Geheimschriften und die Dechiffrir-kunst (Secret Writing and the Art of Deciphering), in which Kasiski showed how polyalphabetic ciphers with repeating keywords could be successfully attacked. Kasiski had discovered a way to break the Vigenere cipher. It was based on a test for determining the number of alphabets or period associated with a polyalphabetic cipher, commonly referred to as a Kasiski Test.

Once the period of the cipher has been deduced, methods of cryptanalysis can be used to attack the cipher. For example, the cipher text can be lined up in columns, one column per alphabet, so that the cipher text in each column is based on a separate alphabet. The cipher text in each column can then be attacked using frequency analysis, although this is easier said than done.

Kasiski's test was meant too be performed on a cipher text whose alphabet is equivalant to the plain text alphabet, generally speaking containing 24, 25 or 26 letters. But, cipher B3B1-I has 100 different cipher numbers. If Beale used a polyalphabetic cipher to create B3B1-I, then polyalphabetic encipherment may have been performed as one step in a two-step operation. That is, B3B1-I may have been created using a hybrid cipher consisting of polyalphabetic encipherment followed by homophonic encipherment. In theory, the Kasiski test should tell us the period of the polyalphabetic cipher, even if a hybrid cipher were used.

Ordinarily the Kasiski Test makes use of 3-gram statistical data, or higher order repeated strings of letters or numbers that may occur in the cipher text. But, in our case, B3B1-I has only one repeated 3-gram, and so our Kasiski Test must be based solely on 2-gram repetitions in B3B1-I.

A separate Kasiski Test statistic is computed for each possible period (in our case periods n=2 through n=49). The cipher text is written row-by-row into a table with n columns and as many rows as necessary. The Kasiski Test is based on a count of the number of repeated 2-grams in each adjacent pair of columns (referred to as Kasiski 2-grams). The test statistic (denoted f) for period n is calculated as follows:

f = f<1,2> + f<2,3> + f<3,4> + …, f<n-1, n> + f<n, 1> Equation 1

where f<1,2> denotes the number of repeated 2-grams overlapping columns 1 and 2, f<2,3> denotes the number of repeated 2-grams overlapping columns 2 and 3, and so forth.

Note that f also includes the number of repeated 2-grams overlapping columns n and 1, (f<n,1>). The first and second cipher numbers in each 2-gram must occur in the same row in the table except for 2-grams that occur in columns n and 1. In that case, if the first cipher number in the 2-gram occurs in row “i” of column “n” then the second cipher number in the 2-gram must occur in row “i+1” of column “1” (don’t forget that the cipher text wraps to the next row).

For example, the Kasiski Test statistic for period=3 is computed as follows: Cipher B3B1-I is first written into a table with three columns and as many rows as needed. A count is made of the number of repeated 2-grams in columns one and two, and this count is represented as f<1,2>. A count is made of the number of repeated 2-grams in columns two and three, and this count is represented as f<2,3>. Finally, a count is made of the number of repeated 2-grams in columns three and one (column three wrapping to column 1 in the next row), and the result is represented as f<3,1>. The Kasiski Test statistic f is then computed as the sum of f<1,2>, f<2,3>, and f<3,1>. A Kasiski Test statistic is computed for different periods (in our case for periods 2 through 49). Note also that the Kasiski Test is selective with respect to the 2-grams that are counted. The cipher text B3B1-I contains other repeated 2-grams (non-Kasiski 2-grams), e.g. a 2-gram in columns one and two may match a 2-gram in columns two and three, but the repeat is not counted, as the repeated cipher numbers do not serve as an indication that the corresponding plain text letters are the same.

A computer program was written to calculate the Kasiski test statistic on B3B1-I for periods ranging from n=2 though n=49. The results are given in Table 8 below:

Cipher B3B1-I

Kasiski

Table 5. Kasiski Test Results for Cipher B3B1-I and Periods n=2 through n=49.

Referring to Table 5, the first pair (2:96) specifies two columns (period n=2) and 96 repeated Kasiski 2-grams. The second pair (3:73) specifies three columns (period n=3) and 73 repeated Kasiski 2-grams. The results of the Kasiski Test are visually examined, looking for instances where the number of repeated Kasiski 2-grams seems unusually large. In our case, the number of repeated Kasiski 2-grams 71, 32, and 28, for periods n=5, n=10, and n=15, seem unusually large. They are highlighted in boldface. Next, these values are examined, looking for a common divisor that occurs most often. In our case, we have 5, 10=2×5, and 15=3×5. The number “5” occurs as a common divisor three times, thus indicating that the period of Beale’s polyalphabetic cipher is “5.”

The Kasiski Test does have a shortcoming: It does not give a positive indication of how significant (strong or weak) the result actually is. It provides no way to judge the significance of the Kasiski Test result. We shall attempt to fix this problem.

How Significant is the Kasiski Test Result?

If a polyalphabetic cipher text with, say period=5, is written row-by-row into a table with five columns, the occurrence of a repeated Kasiski 2-gram in a pair of adjacent columns implies that the plain text 2-grams corresponding to the repeated Kasiski 2-gram are also equal. But if the same cipher text with period=5 is written row-by-row into a table with “n” columns, where “n” is not equal to “5” and “n” does not contain a factor of “5”, then conversely the occurrence of a repeated Kasiski 2-gram in a pair of adjacent columns implies (provided that the alphabets are not the same) that the plain text 2-grams corresponding to the repeated Kasiski 2-gram are not equal (except by chance). In the first case, cipher numbers align properly in the columns. In the second case, cipher numbers do not align property in the columns; instead one may think of them as occurring in the columns more of less at random.

In effect, a set of Kasiski Test values—one for each period being evaluated—is produced by counting the number of repeated Kasiski 2-grams when a cipher text in question is written into a table with “n” columns (n = 2, 3, …, etc.). As a consequence of writing the cipher text into the table, the elements themselves are either aligned correctly or not aligned correctly; they occur either in a correct order or in an incorrect order.

Thus, a Kasiski Test value computed on a cipher text whose elements are not properly aligned is similar to that of computing a Kasiski Test value on a cipher text properly aligned in the table’s columns, but randomly mixed prior to being written into the table. This observation is the basis for extending the Kasiski test.

Instead of comparing each computed Kasiski Test value with its neighboring Kasiski Test values (Table 5), each Kasiski Test value is compared against a distribution of computed Kasiski Test values.

For each period “n” under evaluation, cipher B3B1-I is randomly mixed 10,000 times. Each mixed copy is adjusted so that the resulting mixed cipher text has exactly 181 repeated 2-grams, equal to the number of repeated 2-grams in B3B1-I, and the mixed cipher text is adjusted so the cipher numbers in close proximity of the form “**” and “*.*” are prevented from occurring. These two corrections help make each randomly mixed copy look similar to B3B1-I.

A computer program was written to calculate the Kasiski Test statistic on B3B1-I and on 10,000 randomly mixed and adjusted copies of B3B1-I, for periods ranging from n=2 though n=24. The results are given in Table 6 below:

B3B1-I		Kasiski on Randomly Mixed B3B1-I
Period “n”	Kasiski	LO	MED	HI	LESS	EQ	MORE
2	96	60	96	128	4759	418	4823
3	73	32	66	99	7677	294	2029
4	43	24	50	86	1965	223	7812
5	71	10	40	71	9998	2	0
6	33	8	34	66	4666	225	5109
7	38	6	29	60	8752	363	885
8	20	4	25	55	1736	886	7378
9	28	2	22	49	7680	711	1609
10	32	2	20	48	9576	182	242
11	24	0	18	42	7908	706	1386
12	20	2	16	42	6681	1001	2318
13	24	0	16	42	9088	362	550
14	18	0	14	42	7066	1062	1872
15	28	0	14	38	9942	33	25
16	8	0	12	32	1205	1107	7688
17	16	0	12	32	7556	960	1484
18	12	0	10	32	5116	1525	3359
19	13	0	10	32	7146	46	2808
20	10	0	10	32	4325	1726	3949
21	12	0	10	28	6444	1420	2136
22	8	0	8	31	3197	1920	4883
23	10	2	8	28	5512	1693	2795
24	10	0	8	28	5868	1573	2559

Table 6. Kasiski Test Values computed on B3B1-I for Periods

2 through 24 and Compared With a Distribution of Kasiski Test

Values Computed on 10,000 Randomly Mixed and Adjusted

Copies of B3B1-I.

Referring to Table 6, the data in column two is a repeat of the Kasiski Test values in Table 5 for periods n=2 through n=24. The data in columns three through eight is information about the distribution of the Kasiski Test values computed on 10,000 randomly mixed and adjusted copies of B3B1-I for periods n=2 though n=24.

For example (referring to Table 6), the distribution of Kasiski Test values computed on 10,000 randomly mixed and adjusted copies of B3B1-I for period n=5 has the following identifying features: the smallest value (LO) is 10, the median value (MED) is 40 and the largest value (HI) is 71. The median value is the value for which half of the computed values in the distribution are less than the median value and half are more than the median value. In our case, of the 10,000 values, 9998 are smaller (LESS) than the Kasiski test value (71) computed on B3B1-I, two are equal (EQ) to 71, and none are greater (MORE) than 71.

Thus, Kasiski test value 71 computed on B3B1-I for period n=5 is significant; it is unlikely to have occurred by accident or chance. The Kasiski test value 28 for period n=15 is also significant. The Kasiski test value 32 for period n=10 is borderline: large, but not large enough to be called "significant."

As for the Kasiski test values computed on B3B1-I for periods other than 5, 10, and 15, each has the appearance of a Kasiski test value computed on misaligned or randomly mixed cipher numbers as a consequence of writing a cipher text with period “n” into a table whose number of columns is not equal to “n” or a multiple of “n.”

If a cipher is known to be polyalphabetic, a Kasiski Test can be used to tell the period n of the cipher. But if the cipher is of unknown origin, the matter is more difficult. A homophonic cipher combined and used together with a Transposition Cipher or Permutation Cipher could likewise produce a positive Kasiski Test result, similar to that produced by a homophonic cipher combined with a polyalphabetic cipher. With this in mind, I examined every conceivable method of homophonic cipher combined with transposition and permutation that I could think of. But, I found no combination that could be used successfully to decode Beale's ciphers or that produced cipher text consistent with B3B1-I. I also examined different methods of homophonic cipher combined with polyalphabetic ciphers. But, none of these methods produced a cipher text consistent with B3B1-I, except for a method based on a 10x10 key with multiple indexes.

Conclusion: The analysis took months. Many C computer programs were written to compute statistics, encode and decode data, create data files, and perform simulations. The analysis indicated that Beale had used a homophonic cipher based on a 10x10 key table with multiple indexes. The multiple indexes caused the homophonic cipher to become a polyalphabetic cipher with period n=5. The analysis also indicated that the indexing scheme consisted of one row index and two, three or five column indexes (most likely five).

It's only a 'gut' feel, but I don't think that Beale's original intention was to create a polyalphabetic cipher. I think it more likely that he settled on a homophonic cipher and then 'stumbled' onto an indexing scheme that turned the homophonic cipher into a polyalphabetic/homophonic cipher. I think Beale either knew of or learned about Blair's article on "Cipher," obtained a copy of the article, liked what he read, and selected Blair's method of cipher as his starting point, intending to extend the key table and its indexes to ensure that his key was different from Blair's key.

It was mentioned above that it is possible to create a period n=5 polyalphabetic cipher with as few as 1 row index and 2 column indexes marked A and B, e.g., by using a repeating pattern of column indexes such as AAABB. The letters AAABB are written above each group of five letters in the plain text. The index marked A is used to encipher the first three letters in each group and the index marked B is used to encipher the last two letters in each group. Other patterns are possible. Three column indexes marked A, B and C could also be used, e.g., using a repeating pattern of column indexes such as ABCBA. In this case, letters ABCBA are written above each group of five letters and the column indexes A, B, and C are then used to encipher each group of letters. Other patterns are possible. In each of these examples, one row index is used to encipher each letter in each group of five letters. More than one row index could also be used, but it is unnecessary.

Beale’s Cipher Text B3B1-I

If our assumption is correct, namely that Beale's cipher text B3B1-I was produced with a polyalphabetic/homophonic cipher with period n=5, then the ciphertext can be divided into five separate groups, designated G0, G1, G2, G3, and G4, such that the cipher numbers in each group are created with different polyalphabetic/homophonic keys, designated key0, key1, key2, key3, and key4. If B3B1-I is written into a table with five columns and 228 rows (row by row, left to right, top to bottom), then group G0 consists of the cipher numbers in the first column, group G1 consists of the cipher numbers in the second column, and so forth. Referring to Table 7, the cipher numbers (CNs) in G0 are 17, 89, 07, ..., 84, 11, the CNs in G1 are 08, 67, 41, ..., 21, 60, and so forth.

G0 G1 G2 G3 G4

1 thru 230

G0 G1 G2 G3 G4

231 thru 460

G0 G1 G2 G3 G4

461 thru 690

G0 G1 G2 G3 G4

691 thru 920

G0 G1 G2 G3 G4

921 thru 1138

17 08 92 73 12

89 67 18 28 96

07 41 31 78 46

97 18 98 14 46

48 16 74 88 12

65 32 14 81 19

76 21 16 85 33

66 15 08 68 77

43 24 22 96 17

36 11 01 15 44

11 46 89 18 36

68 17 28 90 82

04 71 43 21 98

76 10 19 81 99

64 80 56 37 19

02 44 53 28 44

75 98 02 37 85

07 17 64 88 36

48 54 99 75 89

15 26 78 96 14

18 11 43 89 51

90 75 28 96 33

28 03 84 65 26

41 46 84 70 98

16 32 59 74 66

69 40 15 08 21

20 77 89 31 11

06 81 91 24 28

18 75 52 82 17

01 39 23 17 27

21 84 35 54 09

28 49 77 88 01

81 17 64 55 83

16 51 69 11 96

54 32 20 18 32

02 19 11 84 50

19 75 12 64 10

06 87 75 47 21

29 37 81 44 18

26 15 32 60 81

03 76 81 99 14

37 51 96 11 28

97 18 38 06 24

93 03 19 17 26

60 73 88 14 26

38 34 86 97 21

65 64 19 22 84

56 07 98 23 11

14 36 07 33 45

40 13 28 46 42

07 96 27 44 98

03 47 16 19 08

12 30 31 06 28

65 48 52 59 41

22 33 17 11 18

25 71 36 45 83

76 89 92 31 65

70 83 96 27 33

44 50 61 24 12

36 49 76 80 94

43 71 05 96 87

12 44 51 89 98

34 41 08 73 66

09 35 16 95 08

13 75 90 56 03

19 77 83 06 57

00 18 60 91 05

18 51 20 18 24

78 65 19 32 24

48 53 57 84 96

07 44 66 82 19

71 11 86 77 13

54 82 16 45 03

86 97 06 12 18

37 15 81 89 16

07 81 39 96 14

43 16 18 29 55

09 36 72 13 64

08 27 04 11 21

64 19 75 28 96

01 18 53 76 10

15 23 19 71 84

20 34 66 73 89

96 30 48 77 26

01 27 36 18 39

78 71 61 26 13

15 02 18 67 62

14 18 66 59 48

27 19 13 82 48

62 19 34 27 39

34 28 29 74 63

20 11 54 61 73

92 80 66 75 01

24 65 89 96 26

74 96 17 34 61

35 90 12 13 28

81 96 05 17 66

18 22 77 64 42

12 07 55 24 83

67 97 09 21 35

81 03 19 28 56

21 34 77 19 74

82 75 84 17 64

03 04 18 92 16

63 82 22 46 55

69 74 12 34 86

75 19 13 16 12

43 64 19 86 18

43 17 45 51 24

09 49 17 56 24

36 72 19 28 11

35 42 40 66 85

94 12 65 82 15

19 36 44 86 72

12 85 06 56 38

44 85 72 32 47

63 96 24 17 14

19 21 44 17 21

34 22 16 75 10

22 18 46 37 81

01 39 86 03 16

38 64 12 18 96

15 80 12 60 95

75 20 52 71 94

38 01 89 76 11

83 29 48 94 63

32 16 11 95 84

41 75 14 40 64

27 81 39 13 63

90 20 08 15 03

26 18 40 74 58

85 04 30 36 64

82 50 51 84 08

31 24 11 86 25

01 70 11 01 05

39 89 17 33 88

08 93 45 01 94

73 16 18 63 28

00 38 56 17 36

19 27 76 30 10

60 25 85 18 36

65 84 00 83 18

20 38 36 16 80

15 71 24 61 44

16 01 39 88 61

04 12 21 24 83

34 92 63 46 86

82 07 19 84 60

80 18 64 63 74

31 60 79 73 40

95 18 64 81 34

69 28 67 60 17

81 12 03 20 62

16 97 03 62 70

60 17 71 40 08

21 90 46 36 50

59 68 14 13 20

63 19 12 60 80

99 35 18 21 36

72 15 28 70 88

04 30 44 12 18

47 36 95 20 37

22 13 06 40 08

20 05 42 58 61

44 06 01 13 08

80 93 86 16 30

82 68 09 02 38

16 89 71 16 28

65 18 02 38 21

95 14 26 48 34

18 55 31 34 61

24 05 81 23 48

61 19 26 33 10

01 65 92 88 81

75 46 01 06 86

36 19 24 29 40

64 26 19 48 22

85 16 84 19 61

26 85 33 64 68

32 31 60 50 29

81 16 21 03 14

12 81 60 36 51

62 94 78 60 00

14 76 12 04 28

18 61 36 47 19

21 60 64 95 10

06 66 19 38 41

49 02 23 62 02

94 75 78 14 23

11 09 62 31 01

23 16 80 34 24

50 00 62 86 19

21 17 40 19 42

31 86 34 40 07

15 33 91 67 04

86 52 88 16 80

21 67 95 22 16

48 96 11 01 77

64 18 65 67 90

36 54 11 10 98

34 19 56 16 19

71 18 64 96 17

51 39 10 36 03

19 40 32 22 41

17 84 90 80 46

07 11 50 29 38

46 72 85 94 39

61 43 97 24 18

12 16 27 31 19

04 63 96 12 01

18 16 40 30 60

38 19 27 88 12

31 90 16 75 74

83 11 26 89 72

84 00 06 14 21

32 40 02 34 68

75 01 84 16 79

23 16 81 22 24

03 12 27 36 47

55 86 34 43 12

07 96 14 64 65

23 28 01 03 24

95 16 14 06 54

20 02 01 12 76

13 71 87 96 02

35 10 02 41 17

84 21 36 20 14

11 60 60

Table 7. Cipher B3B1-I written as five groups of cipher numbers, each group

being enciphered with a different homophonic key.

Frequency Values in Groups G0, G1, G2, G3, G4

The frequency values associated with the cipher numbers in B3B1-I carry important information. But as B3B1-I is a polyalphabetic cipher of period n=5, we need to look at the frequency values for each of the five groups, G0 through G4 (Table 7). The frequency values for each of these five groups can be arranged and provided in a 10×10 table (see Figure 2 below):

Frequencies for group G0

	0	1	2	3	4	5	6	7	8	9

0	2	6	2	4	4	0	3	7	2	3	33
1	0	3	6	2	3	6	5	2	7	6	40
2	6	6	3	3	2	1	3	2	2	1	29
3	0	4	3	0	5	3	5	2	4	1	27
4	1	2	0	5	3	0	1	1	4	1	18
5	1	1	0	0	2	1	1	0	0	1	7
6	3	2	2	3	4	5	1	1	1	3	25
7	1	2	1	1	1	5	3	0	2	0	16
8	2	5	4	2	2	2	2	0	0	1	20
9	2	0	1	1	2	3	1	2	0	1	13

	18	31	22	21	28	26	25	17	22	18	228

Frequencies for group G1

	0	1	2	3	4	5	6	7	8	9

0	2	3	3	3	2	2	1	3	1	1	21
1	2	6	4	2	1	4	11	6	12	10	58
2	2	3	2	1	2	1	2	3	3	1	20
3	3	1	3	2	3	2	4	1	2	3	24
4	3	2	1	1	3	0	3	1	1	3	18
5	2	3	1	1	2	1	0	0	0	0	10
6	3	1	0	1	3	3	1	2	2	0	16
7	1	6	2	1	1	7	2	2	0	0	22
8	3	4	2	1	3	3	2	1	0	3	22
9	3	0	1	2	1	0	6	3	1	0	17

	24	29	19	15	21	23	32	22	22	21	228

Frequencies for group G2

	0	1	2	3	4	5	6	7	8	9

0	1	5	4	2	1	2	4	1	3	2	25
1	1	6	7	2	5	1	6	4	6	11	49
2	2	2	2	2	3	0	3	4	4	1	23
3	1	3	2	1	3	1	5	0	1	3	20
4	4	0	1	2	3	2	2	0	2	0	16
5	1	2	3	2	1	1	3	1	0	1	15
6	4	2	2	1	6	2	4	1	0	1	23
7	0	2	2	0	1	2	2	3	3	1	16
8	1	5	0	1	5	2	4	1	2	4	25
9	2	2	3	0	0	2	3	1	2	1	16

	17	29	26	13	28	15	36	16	23	25	228

Frequencies for group G3

	0	1	2	3	4	5	6	7	8	9

0	0	3	1	3	1	0	5	0	1	0	14
1	1	4	4	5	4	2	7	7	6	4	44
2	3	3	4	2	5	0	1	2	5	3	28
3	2	4	2	3	5	0	5	3	2	0	26
4	4	1	0	1	2	2	3	2	2	0	17
5	1	1	0	0	1	1	3	0	1	2	10
6	5	2	2	2	4	1	1	3	1	0	21
7	2	2	0	4	3	4	2	2	1	0	20
8	2	3	4	1	4	1	4	0	6	4	29
9	1	1	1	0	2	3	8	1	0	1	18

	21	24	18	21	31	14	39	20	25	14	227

Frequencies for group G4

	0	1	2	3	4	5	6	7	8	9

0	1	4	2	4	1	2	0	1	6	1	22
1	6	4	6	2	6	1	4	5	7	7	48
2	1	7	1	1	8	1	5	1	7	1	33
3	1	0	1	3	2	1	5	1	3	3	20
4	2	3	3	0	3	1	3	2	3	0	20
5	2	2	0	0	1	2	1	1	1	0	10
6	2	5	2	3	4	2	3	0	2	0	23
7	1	0	2	1	3	0	1	2	0	1	11
8	3	3	1	4	3	2	3	1	2	2	24
9	1	0	0	0	3	1	5	0	5	1	16

	20	28	18	18	34	13	30	14	36	16	227

Cumulative Column Sums: 100 140 103 88 142 90 162 90 129 94

Cumulative Row Sums: 117 239 133 117 89 52 108 84 119 80

Figure 2. Frequency values computed on cipher B3B1-I

for groups G0, G1, G2, G3, and G4, arranged in 10×10

tables, with row and column indexes, and row and column

sums.

An Example of a 5 x 10 Column Index

Beale's 5 x 10 column index might have looked something like the example in Figure 3. The five indexes correspond to groups G0, G1, G2, G3, and G4. Index 0 1 2 3 4 5 6 7 8 9 would be used to encipher letters in group G0, Index 1 3 5 7 9 0 2 4 6 8 would be used to encipher letters in group G1, and so forth. For information about groups G0 through G4, see Table 7 and Figure 2.

Each index consists of the ten different digits 0 1 2 3 4 5 6 7 8 9 arranged in any arbitrary or preferred order. The digits in each row do not repeat, whereas the digits in each column are allowed to repeat, although they need not repeat. Figure 3 is an example of a 5 x 10 index, which is assumed here to be a column index. Referring to Figure 3, there are 25 repeats in the columns. For example, the digits in the second column are 1 1 2 3 7. The digit 1 repeats; it occurs twice in column two. Digits in the third column are 2 2 8 2 9. The digit 2 repeats; it occurs three times in column three.

The reader will take note that in the situation where we attempt to solve for Beale's 5x10 column index, one may start by assigning arbitrary digits to any one of the rows and then solve for the digits in the remaining four rows of the index. For instance, we could assign digits 0 1 2 3 4 5 6 7 8 9 to group G0 and solve for the digits in groups G1, G2, G3, and G4. If successful, we will have recovered a 5x10 column index that can be used to map POLY B3B1-I to MONO B3B1-I, even though the recovered index is not be equal to Beale's index unless the initial assignment of digits in G0 happens by accident to be the same as Beale's assignment of index values in G0.

GROUP

INDEX

0 1 2 3 4 5 6 7 8 9

7 1 2 0 4 6 8 3 9 5

3 2 8 0 6 1 4 7 9 5

1 3 2 5 0 6 8 9 4 7

4 7 9 1 0 8 6 3 5 2

Figure 3. Example of a 5 x 10 Column Index (index344)

If Beale's cipher utilized a 5 x 10 column index, it might look like the index in Figure 3.

An Observed Pattern in the Row Sums

It might be possible to reconstruct Beale's indexes for groups G0 through G4 by using the row sums and column sums given in Figure 2. If there is enough statistical information available (i.e., B3B1-I is long enough), there should exist a one-to-one correspondence between the sum values and the index values. Thus, one should be able to predict the index values for each group (G0 through G4) on the basis of the sum values. If there isn't enough statistical information, it may still be possible to predict some of the index values.

It should be obvious, yet perhaps worth stating that a 5 x 10 index with the same index digits in each row is equivalent to a 1 x 10 index with a single row of like index digits. See Figure 4 below.

GROUP

INDEX

0 1 2 3 4 5 6 7 8 9

GROUP	INDEX
G0 G1 G2 G3 G4	0 1 2 3 4 5 6 7 8 9

Figure 4. Equivalent 5 x 10 and 1 x 10 Indexes.

We start by considering a way to reconstruct Beale's 5 x 10 row index. We assume that Beale used a 5 x 10 row index, and then argue that this seems unlikely. Thus, by ruling out the 5 x 10 index, it means that Beale most likely used a single row index.

The steps in the procedure are as follows: Sort the 10 row sums for each group (G0 through G4) into descending sequence. If there is enough statistical information, then there will be a one-to-one correspondence between the sorted row sums in each group. And, there will be a one-to-one correspondence between the index values in each group. Thus, for each group, the 10 sorted row sums will have 10 corresponding index digits. Write the corresponding 10 index digits for each group into a 5 x 10 table (left to right, top to bottom). If there is enough statistical information available, then the index digits in the constructed table will be identical to the index digits in Beale's 5 x 10 row index.

The results are given in Table 8.

Group	Sorted Row Sums (S) and Row Index Digits (D)
Group	0		1		2		3		4		5		6		7		8		9
	S	D	S	D	S	D	S	D	S	D	S	D	S	D	S	D	S	D	S	D
G0	40	1	33	0	29	2	27	3	25	6	20	8	18	4	16	7	13	9	7	5
G1	58	1	24	3	22	7	22	8	21	0	20	2	18	4	17	9	16	6	10	5
G2	49	1	25	0	25	8	23	2	23	6	20	3	16	4	16	7	16	9	15	5
G3	44	1	29	8	28	2	26	3	21	6	20	7	18	9	17	4	14	0	19	5
G4	48	1	33	2	24	8	23	6	22	0	20	3	20	4	16	9	11	7	10	5

Table 8. Sorted Row Sums and Accompanying Row Index Digits for groups G0 through G4.

Referring to Table 8, note that the sorted row sums for G0 are 40, 33, 29, 27, 25, 20, 18, 16, 13, 7. The corresponding index digits are 1 0 2 3 6 8 4 7 9 5. Note also that index digit 1 is associated with the largest row sum (40, 58, 49, 44, 48) in each group (G0 through G4); index digit 5 is associated with the smallest row sum (7, 10, 15, 10, 10) in each group. To see just how unlikely it would be for repeats of this kind to occur by chance, a computer program was written to demonstrate this. A 5 x 10 table with five rows and 10 columns was used. Each row was initialized with digits 0 through 9. At each iteration, the digits in each row were randomly mixed and the digits in each of the 10 columns were examined to see if 5 like digits happened to occur in a column. The digits were randomly mixed 100 million times and a count was made of the number of occurrences of five like digits in any of the 10 columns. The results were as follows: five like digits occurred in exactly one column 106,329 times, five like digits occurred in exactly two columns 77 times, and five like digits occurred in more than two columns zero times.

The pattern and quantity of repeated index digits in the columns of Table 8 is indicative of a strong correlation among the sorted row sums for the five groups (G0 through G4). The correlation is not perfect; each row of digits does not exactly match each other row of digits. This is probably due to insufficient statistical information, thus preventing the row sums to be sorted into their proper order. Nevertheless, the computer analysis shows that the pattern and quantity of repeated index digits could not have occurred by chance, which (more or less) would be the case if Beale's column index had significantly less (not more) repeated index digits.

Another test also confirms the same conclusion. Referring to Table 8, the digits that repeat are printed in boldface. Altogether, there are 35 such digits that repeat. The computer was used to determine how likely it would be for 35 such digits to repeat strictly by chance. At each iteration, the 10 digits in each row of a 5 x 10 table were randomly mixed and a count of the number of repeated digits was made. The result was this: In 100,000 trials, 35 repeated digits occurred just two times, i.e., roughly once in 50,000 attempts. More than 35 digits did not occur at all.

The 10 rows in Beale's 10x10 key table (top to bottom) have index values 1 2 <8 0 3> 4 5 7 9 6. The order of the digits can be determined by sorting the row sums in Figure 2 into descending sequence, viz. 239 133 119 117 117 108 89 84 80 52, and then replacing each row sum by the position of that row in the 10x10 key table (top to bottom). For example, row sum 239 occurs in row 1 of the key table, row 133 occurs in row 2, and so forth. However, index 1 2 8 0 3 4 5 7 9 6 is only one of six possible or likely indexes. Note that 117 117 and 119 are to close to call, and these three rows can be arranged in six different ways.

CONCLUSION: Beale’s 10x10 key has one row index. The rows in Beale's 10x10 key table have row index values 1 2 <8 0 3> 4 5 7 9 6 (top to bottom), where digits 8 0 3 can be in any order.

Is There a Pattern in the Column Sums?

Could there be a similar pattern in Beale's 5 x 10 column index? To answer this question, a table similar to Table 9 was constructed using the 10 column sums in Figure 2, instead of the 10 row sums (see Table 9).

Group	Sorted Column Sums (S) and Column Index Digits (D)
Group	0		1		2		3		4		5		6		7		8		9
	S	D	S	D	S	D	S	D	S	D	S	D	S	D	S	D	S	D	S	D
G0	31	1	28	4	26	5	25	6	22	2	22	8	21	3	18	0	18	9	17	7
G1	32	6	29	1	24	0	23	5	22	7	22	8	21	4	21	9	19	2	15	3
G2	36	6	29	1	28	4	26	2	25	9	23	8	17	0	16	7	15	5	13	3
G3	39	6	31	4	25	8	24	1	21	0	21	3	20	7	18	2	14	5	14	9
G4	36	8	34	4	30	6	28	1	20	0	18	2	18	3	16	9	14	7	13	5

Table 9. Sorted Column Sums and Accompanying Column Index Digits for groups G0 through G4.

Referring to Table 9, the index digits do not appear to be randomly distributed: three sixes in column 0, three fours and two ones in column 1, three eights in column 5, and so on.

Table 9 has 23 repeated digits (printed in boldface). A computer program was written to determine how likely or unlikely it would be for 23 repeated digits of this sort to have occurred by mere chance. The test consisted of 100,000 trials in which each row in the 5 x 10 index (digits 0 through 9) was randomly mixed. A column-by-column count was then made of the number of repeated digits. Of the 100,000 trials, 11,012 of these had 23 or more repeated digits (roughly 11 percent). Strictly speaking, the 89-11 split does not permit us to draw any certain conclusion, except to say: The result indicates that there is a greater likelihood that the 23 repeated digits did not occur by chance. There is an 89 percent chance that the 23 repeated digits did not occur by chance and an 11 percent chance that they did occur by chance.

The 10 columns in Beale's 10x10 key table (left to right) have index values 6 <4 1> 8 <2 0> 9 <5 7 3>. The order of the digits can be determined by sorting the column sums in Figure 2 into descending sequence, viz. This which are obtained by sorting the column sums in Figure 6 into descending sequence, viz. 162, 142, 140, 129, 103, 100, 94, 90, 90, 88, and then replacing each column sum by the position of that column in the 10x10 key table. For example, column sum 162 occurs in column 6 of the key table, column 142 occurs in column 4, and so forth. However, index 6 <4 1> 8 <2 0> 9 <5 7 3> is only one of 24 possible or likely indexes. Note that 142 and 140 are too close to "call." They could be switched. 103 and 100 could be switched. 90 90 and 88 could be arranged in six different ways. Thus, 2 x 2 x 6 = 24 different ways.

Conclusion: There is a correlation between the sorted column sums and the column index digits in Beale's key. However, the repeated index values in the columns do not appear to be frequent enough to conclude that the 5x10 index can be collapsed to a 3x10 or 2x10 index.

Method of Attack

A method of attack with the possibility of actually working is this:

(1) Devise a method that permits Beale's 5x10 column index to be recovered.

(2) Use this 5x10 column index to map cipher text POLY B3B1-I (500 CNs) to cipher text MONO B3B1-I (100 CNs).

(3) Attack cipher text MONO B3B1-I (100 different CNs) using different homophonic decoding techniques.

There are several cryptanalytic methods that might be used or attempted to reconstruct a 5x10 index equivalent to Beale's 5x10 index. However, I shall describe the first approach that I took and the results I obtained.

When I first looked at this problem, I reasoned this way: If I had enough compute power, I would write a computer program that calculates every one of the (10 factorial)⁴possible 5x10 column indexes, and for each index I would map POLY B3B1-I to MONO B3B1-I and count the number of repeated 2-grams in MONO B3B1-I. The 5x10 index producing the MONO B3B1-I with the greatest number of repeated 2-grams should be the index equivalent to, or isomorphic with, Beale's 5x10 index, provided there was enough cipher text available, and enough compute power. However, the number (10 factorial)⁴is far too large and there is too little cipher text to "push" things through.

Nevertheless, not wanting to surrender, I instead devised a "hill climbing" algorithm, of sorts, that succeeded in finding a 5x10 index that mapped POLY B3B1-I to MONO B3B1-I with 344 repeat 2-grams. That 5x10 index is the one shown in Figure 3 above. No doubt the recovered index has errors, as the number of repeat 2-grams in MONO B3B1-I index344 seems too large. I have no feel for whether switching a few index values in the index might correct things or not. On the other hand, if enough of the 5x10 index is correct and, in turn, enough of MONO B3B1-I index344 is correct, then perhaps some of the cipher text can be correctly decoded and encountered errors can be found and corrected as the decoding process moves forward.

The MONO B3B1-I recovered with index344 is given in Figure 5 below:

17 06 91 71 19 89 60 12 26 96 07 41 35 76 46 97 16 92 18 46
48 15 76 86 19 65 32 16 80 12 76 21 14 83 37 66 19 02 66 71
43 24 21 95 11 36 11 05 13 40 11 45 88 16 36 68 10 22 94 89
04 71 40 20 95 76 13 18 80 92 64 83 54 39 12 02 44 50 26 40
75 96 01 39 88 07 10 66 86 36 48 54 98 73 82 15 25 72 95 10
18 11 40 87 53 90 79 22 95 37 28 07 86 63 26 41 45 86 74 95
16 32 58 78 66 69 43 19 06 23 20 70 88 30 13 06 81 95 28 25
18 79 51 82 11 01 38 20 19 21 21 84 39 58 02 28 48 77 86 03
81 10 66 53 87 16 51 68 10 96 54 32 23 16 39 02 18 15 88 54
19 79 11 68 14 06 80 79 49 23 29 30 85 48 15 26 19 31 64 83

03 75 85 97 10 37 51 94 10 25 97 16 32 05 20 93 07 18 19 26
60 77 82 18 26 38 34 84 99 23 65 64 18 22 80 56 00 92 21 13
14 35 07 31 48 40 17 22 45 49 07 95 27 48 95 03 40 14 17 05
12 33 35 05 25 65 46 51 57 43 22 37 17 10 15 25 71 34 43 87
76 88 91 30 68 70 87 94 29 37 44 53 65 28 19 36 48 74 84 90

43 71 09 95 81 12 44 55 87 95 34 41 02 71 66 09 39 14 93 05

13 79 93 55 07 19 70 80 05 51 00 16 63 90 08 18 51 23 16 20
78 69 18 32 20 48 57 57 88 96 07 44 64 82 12 71 11 84 79 17
54 82 14 43 07 86 90 04 12 15 37 19 85 87 16 07 81 38 95 10
43 15 12 27 58 09 35 71 11 60 08 20 06 10 23 64 18 79 26 96
  01 16 50 75 14 15 27 18 70 80 20 34 64 71 82 96 33 42 79 26
  01 20 34 16 32 78 71 65 25 17 15 02 12 69 69 14 16 64 57 45
27 18 10 82 45 62 18 36 29 32 34 26 28 78 67 20 11 56 60 77
92 83 64 73 03 24 69 88 95 26 74 95 17 38 63 35 93 11 11 25
81 95 09 19 66 18 22 77 68 49 12 00 59 28 87 67 90 08 20 38
81 07 18 26 56 21 34 77 17 70 82 79 86 19 60 03 04 12 92 16
63 82 21 45 58 69 74 11 38 86 75 18 10 15 19 43 64 18 85 15
43 10 49 50 20 09 48 17 55 20 36 72 18 26 13 35 42 43 65 88
94 12 69 82 18 19 35 46 85 79 12 89 04 55 35 44 89 71 32 41
63 95 26 19 10 19 21 46 19 23 34 22 14 73 14 22 16 44 39 83
  01 38 84 01 16 38 64 11 16 96 15 83 11 64 98 75 23 51 70 90
38 01 88 75 13 83 28 42 98 67 32 15 15 93 80 41 79 16 44 60
27 81 38 11 67 90 23 02 13 07 26 16 43 78 55 85 04 33 35 60
82 53 55 88 05 31 24 15 85 28 01 73 15 00 08 39 88 17 31 85
  08 97 49 00 90 73 15 12 61 25 00 36 54 19 36 19 20 74 34 14
60 29 89 16 36 65 84 03 81 15 20 36 34 15 84 15 71 26 60 40
16 01 38 86 63 04 12 25 28 87 34 92 60 45 86 82 00 18 88 64
80 16 66 61 70 31 63 78 71 44 95 16 66 80 30 69 26 67 64 11
81 12 00 24 69 16 90 00 62 74 60 10 75 44 05 21 93 44 35 54
59 66 16 11 24 63 18 11 64 84 99 39 12 20 36 72 19 22 74 85
  04 33 46 12 15 47 35 99 24 31 22 17 04 44 05 20 09 41 56 63
44 05 05 11 05 80 97 84 15 34 82 66 08 02 35 16 88 75 15 25
65 16 01 36 23 95 14 24 46 30 18 59 35 38 63 24 09 85 21 45
61 18 24 31 14 01 69 91 86 83 75 45 05 05 86 36 18 26 27 44
64 25 18 46 29 85 15 86 17 63 26 89 30 68 65 32 31 63 54 22
81 15 25 01 10 12 81 63 35 53 62 94 72 64 04 14 75 11 08 25
18 61 34 49 12 21 63 66 93 14 06 65 18 36 43 49 02 20 62 09
94 79 72 18 27 11 08 61 30 03 23 15 83 38 20 50 03 61 85 12
21 10 43 17 49 31 85 36 44 01 15 37 95 69 00 86 52 82 15 84
21 60 99 22 16 48 95 15 00 71 64 16 69 69 94 36 54 15 14 95
34 18 54 15 12 71 16 66 95 11 51 38 13 35 07 19 43 31 22 43
17 84 93 84 46 07 11 53 27 35 46 72 89 98 32 61 47 97 28 15
12 15 27 30 12 04 67 94 12 03 18 15 43 34 64 38 18 27 86 19
31 93 14 73 70 83 11 24 87 79 84 03 04 18 23 32 43 01 38 65
75 01 86 15 72 23 15 85 22 20 03 12 27 35 41 55 85 36 41 19
  07 95 16 68 68 23 26 05 01 20 95 15 16 05 50 20 02 05 12 76
13 71 87 95 09 35 13 01 40 11 84 21 34 24 10 11 63 63

Figure 5. MONO B3B1-I Index 344 (POLY B3B1-I mapped with Index344 in Figure 3).

After recovering MONO B3B1-I with index344, I examined the numbers to see if there were any patterns or possible statistics that would support a conclusion that the cipher text was worth further investigation. The findlings were mixed.

MONO B3B1-I index344 has several doubletons, which may help in identifying letters in English text that form doubletons, the most notable being the doubleton 63 63 at the end of MONO B3B1-I index344. I also found an odd pattern of repeats in the righthand digits of the cipher numbers: The most noteworthy being the strings 355556, 55556, and 355556 (highlighted in boldface) which are located at positions 281, 837, and 879 in MONO B3B1-I index344. The string of CNs 05 05 11 05 at position 821 is also of interest. I was happy to find that there were sufficient low frequency cipher numbers that could be used to represent or stand for the uncommon letters Z, Q, X, J and K. The frequency of each cipher number in MONO B3B1-I index344 is given in Tables 10 and 11 below:

Table 10. Single Cipher Number Frequencies for MONO B3B1-I created with index344.

freq=1 : 52

freq=2 : 47

freq=3 : 42 59 91

freq=4 : 33 56 57 58 62 98 99

freq=5 : 29 50 77

freq=6 : 6 53 67 73 76 78 92 97

freq=7 : 37 55 61 72 74 89 96

freq=8 : 8 30 39 40 41 49 51 68 70 94

freq=9 : 9 45 90 93

freq=10 : 2 28 46 48 54 80 83 87

freq=11 : 0 3 4 13 24 27 31 65 75 81

freq=12 : 32 60

freq=13 : 25 66 69 79 88

freq=14 : 17 21 22 23 44 82 84

freq=15 : 7 85

freq=16 : 34 38 63 71 86

freq=17 : 1 5 14 36 43

freq=18 : 10 35 64

freq=19 : 26

freq=22 : 20

freq=24 : 19 95

freq=26 : 11

freq=27 : 12

freq=32 : 16

freq=33 : 18

freq=37 : 15

Table 11. List of Cipher Numbers with identical frequencies in MONO B3B1-I created with index344.

Referring to Table 10, note that CN=0 occurs 11 times, CN=1 occurs 17 times, and so forth. Referring to Table 11, cipher number 52 occurs 1 time, cipher number 47 occurs 2 times, cipher numbers 42, 59 and 91 occur 3 times each, and so forth.

After studying MONO B3B1-I index344 for a time, I decided that a possible way to make headway would be to attack the B3 portion of the cipher. The B3 portion consists of the cipher numbers in locations 0 through 617; the B1 portion consists of the cipher numbers in locations 618 through 1137. With only 618 CNs, the B3 portion is short. But the cipher's short length can be exploited--we can turn the situation to our advantage.

Because B3 is 'short'--only 618 cipher numbers--the format of B3 can be anticipated and predicted. In order to encode the names of the 30 members in Beale's party, the names of the designated heirs, and their addresses, Beale must have recognized that much of the information in the addresses and in some cases the names themselves was repeated. Thus, by organizing and arranging the information appropriately and making use of the abbreviation "DO" for ditto, the information could be represented conveniently in 618 letters of plain text.

Before looking at what can be done, let us prepare a table of single letter probabilities based on a sample of 10,000 plain texts especially constructed to look similar to Beale's papers No. 1 and No. 3. The statistics are computed on the simulated texts for paper No. 3 (taking into account the number of "DO" abbreviations) and No. 1, taken separately, and also taken together. The computed statistics are given in Table 12 below:

Letter

No. 3

No. 1

No. 3 &

No. 1

0.100345

0.024264

0.030545

0.077939

0.094081

0.012716

0.019308

0.039563

0.042050

0.010504

0.011312

0.061371

0.035503

0.062157

0.098730

0.016218

0.000759

0.073225

0.062171

0.042980

0.021937

0.020041

0.016643

0.003870

0.018662

0.003102

0.083792

0.014662

0.024113

0.046885

0.124538

0.023523

0.021072

0.060017

0.066121

0.001672

0.008321

0.039184

0.025600

0.071910

0.076641

0.016230

0.000910

0.059062

0.058124

0.094617

0.027635

0.009448

0.025738

0.001662

0.017885

0.000639

0.092781

0.019877

0.027606

0.063749

0.107998

0.017654

0.020114

0.048909

0.053049

0.006468

0.009946

0.051233

0.030978

0.066614

0.088637

0.016223

0.000828

0.066753

0.060321

0.066575

0.024541

0.015201

0.020799

0.002861

0.018307

0.001977

Table 12. Single letter probabilities based on 10,000 No. 1 and No. 3 look-alike plain texts.

The expected number of letters D and O in B3 and B1 is this:

	No. 3	No. 1
Letter D	48	24
Letter O	61	40

Table 13. Expected number of letters D and O in Papers No. 3 and No. 1.

So let us look at what can be done. We start with an assumption that Beale's Paper No. 3 contains numerous occurrences of the abbreviation "DO" for the word "ditto." In turn, this will cause a disproportionately greater number of letters "D" and "O" to occur in Paper No. 3 and likewise a disproportionately greater number of cipher numbers in part B3 of the cipher text that represent or stand for the letters "D" and "O" in Paper No. 3. This observation can be used to identify cipher numbers in MONO B3B1-I inner344 that have the best chance of representing the abbreviation "DO" and in turn the letters "D" and "O." The frequency of each cipher number in the B3 and B1 portions of MONO B3B1-I inner344 is given in Table 14 below:

Fq B3

Fq B1

Fq B3

Fq B1

Fq B3

Fq B1

Fq B3

Fq B1

Table 14. Frequency of CNs in the B3 and B1 portions of MONO B3B1-I index344.

Referring to Table 14, cipher numbers that are candidates for letters "D" and "O" are highlighted in boldface. These 21 candidates are 07, 10, 17, 19, 26, 32, 37, 39, 40, 48, 51, 56, 57, 58, 71, 76, 77, 79, 82, 95, and 96. By starting with these 21 candidates, it helps in finding a small subset of CNs that stand for letter "D" and a small subset of CNs that stand for letter "O" and such that the CNs contact each other to form 2-grams "DO" but few or no 2-grams "DD", "OO" and "OD". Letter "O" can occur as a doubleton; letter "D" can also occur as a doubleton, but less frequently.

Using the 21 candidates, three cipher numbers were identified to represent letter "D" and two cipher numbers were identified to represent letter "O," as follows:

D : 07, 79 and 95

O : 10, and 26

Letters "D" and "O" were substituted for their respective cipher numbers in MONO B3B1-I index344, and the instances of "DO" "OD" "DD" and "OO in the B3 portion and the B1 portion were counted. The result was this:

DO OD DD OO

Portion B3 7 0 1 0

Portion B1 1 0 1 0

The seven instances of "DO" were then used to define smaller strings in the B3 portion of cipher text. The smaller strings were long enough to hold the information for one member (name of member, name of heir, address of heir) or for multiple members. The resulting cipher text was this:

B3 Portion:

When “D” is substituted for CNs 07, 79, and 95, and “O” is substituted for CNs 10 and 26, then cipher text MONO B3B1-I index344 looks like this: seven “DO” in B3 portion, one “DO” in B1 portion, one “DD” in B3 portion and in B1 portion. No “OO” or “OD”. The “DO” are nicely spaced. There are 52 “D” and 37 “O” in the text. There should be about 72 “D” and 100 “O”. I could pick candidates for “D” and “O” but I would rather wait and assign “D” and “O” after some decoding has taken place and we find out CNs that MUST be “D” or “O”.

Number

of CNs

17 06 91 71 19 89 60 12 O 96 D 41 35 76 46 97 16 92 18 46 48 15 76 86 19 65 32 16 80 12 76 21 14 83 37 66 19 02 66 71 43 24 21 D 11 36 11 05 13 40 11 45 88 16 36 68 O 22 94 89 04 71 40 20 D 76 13 18 80 92 64 83 54 39 12 02 44 50 O 40 75 96 01 39 88 D O

66 86 36 48 54 98 73 82 15 25 72 D O

18 11 40 87 53 90 D 22 D 37 28 D 86 63 O 41 45 86 74 D 16 32 58 78 66 69 43 19 06 23 20 70 88 30 13 06 81 D 28 25 18 D 51 82 11 01 38 20 19 21 21 84 39 58 02 28 48 77 86 03 81 O 66 53 87 16 51 68 O 96 54 32 23 16 39 02 18 15 88 54 19 D 11 68 14 06 80 D 49 23 29 30 85 48 15 O 19 31 64 83 03 75 85 97 O 37 51 94 O 25 97 16 32 05 20 93 D 18 19 O 60 77 82 18 O 38 34 84 99 23 65 64 18 22 80 56 00 92 21 13 14 35 D 31 48 40 17 22 45 49 D D 27 48 D 03 40 14 17 05 12 33 35 05 25 65 46 51 57 43 22 37 17 O 15 25 71 34 43 87 76 88 91 30 68 70 87 94 29 37 44 53 65 28 19 36 48 74 84 90 43 71 09 D 81 12 44 55 87 D 34 41 02 71 66 09 39 14 93 05 13 D 93 55 D 19 70 80 05 51 00 16 63 90 08 18 51 23 16 20 78 69 18 32 20 48 57 57 88 96 D 44 64 82 12 71 11 84 D 17 54 82 14 43 D 86 90 04 12 15 37 19 85 87 16 D 81 38 D O

43 15 12 27 58 09 35 71 11 60 08 20 06 O 23 64 18 D O

96 01 16 50 75 14 15 27 18 70 80 20 34 64 71 82 96 33 42 D O

01 20 34 16 32 78 71 65 25 17 15 02 12 69 69 14 16 64 57 45 27 18 O 82 45 62 18 36 29 32 34 O 28 78 67 20 11 56 60 77 92 83 64 73 03 24 69 88 D O

74 D 17 38 63 35 93 11 11 25 81 D 09 19 66 18 22 77 68 49 12 00 59 28 87 67 90 08 20 38 81 D 18 O 56 21 34 77 17 70 82 D 86 19 60 03 04 12 92 16 63 82 21 45 58 69 74 11 38 86 75 18 O 15 19 43 64 18 85 15 43 O 49 50 20 09 48 17 55 20 36 72 18 O 13 35 42 43 65 88 94 12 69 82 18 19 35 46 85 D 12 89 04 55 35 44 89 71 32 41 63 D O

19 O 19 21 46 19 23 34 22 14 73 14 22 16 44 39 83 01 38 84 01 16 38 64 11 16 96 15 83 11 64 98 75 23 51

280

113

B1 Portion:

70 90
38 01 88 75 13 83 28 42 98 67 32 15 15 93 80 41 D 16 44 60
27 81 38 11 67 90 23 02 13 D O 16 43 78 55 85 04 33 35 60
82 53 55 88 05 31 24 15 85 28 01 73 15 00 08 39 88 17 31 85
  08 97 49 00 90 73 15 12 61 25 00 36 54 19 36 19 20 74 34 14
60 29 89 16 36 65 84 03 81 15 20 36 34 15 84 15 71 O 60 40
16 01 38 86 63 04 12 25 28 87 34 92 60 45 86 82 00 18 88 64
80 16 66 61 70 31 63 78 71 44 D 16 66 80 30 69 O 67 64 11
81 12 00 24 69 16 90 00 62 74 60 O 75 44 05 21 93 44 35 54
59 66 16 11 24 63 18 11 64 84 99 39 12 20 36 72 19 22 74 85
  04 33 46 12 15 47 35 99 24 31 22 17 04 44 05 20 09 41 56 63
44 05 05 11 05 80 97 84 15 34 82 66 08 02 35 16 88 75 15 25
65 16 01 36 23 D 14 24 46 30 18 59 35 38 63 24 09 85 21 45
61 18 24 31 14 01 69 91 86 83 75 45 05 05 86 36 18 O 27 44
64 25 18 46 29 85 15 86 17 63 O 89 30 68 65 32 31 63 54 22
81 15 25 01 O 12 81 63 35 53 62 94 72 64 04 14 75 11 08 25
18 61 34 49 12 21 63 66 93 14 06 65 18 36 43 49 02 20 62 09
94 D 72 18 27 11 08 61 30 03 23 15 83 38 20 50 03 61 85 12
21 O 43 17 49 31 85 36 44 01 15 37 D 69 00 86 52 82 15 84
21 60 99 22 16 48 D 15 00 71 64 16 69 69 94 36 54 15 14 D
34 18 54 15 12 71 16 66 D 11 51 38 13 35 D 19 43 31 22 43
17 84 93 84 46 D 11 53 27 35 46 72 89 98 32 61 47 97 28 15
12 15 27 30 12 04 67 94 12 03 18 15 43 34 64 38 18 27 86 19
31 93 14 73 70 83 11 24 87 D 84 03 04 18 23 32 43 01 38 65
75 01 86 15 72 23 15 85 22 20 03 12 27 35 41 55 85 36 41 19
  D D 16 68 68 23 O 05 01 20 D 15 16 05 50 20 02 05 12 76
13 71 87 D 09 35 13 01 40 11 84 21 34 24 O 11 63 63

Figure 6. Cipher Text MONO B3B1-I index344 with Letter "D" substitiuted

for CNs 07, 79, 95 and Letter "O" substituted for CNs 10, 26.

Referring to Figure 6, note that the first substring runs from the beginning of the B3 portion to the end of the first DO and contains 87 CNs. The first substring is a candidate to be further separated, probably into three substrings. The second substring runs from the end of the first substring to the end of the second DO and contains 13 CNs. The substring is short, but long enough to hold the information (names or abbreviated names) for one member. The third substring runs from the end of the second DO to the end of the third DO and contains 280 CNs. It can be divided into smaller substrings to accommodate the information for a dozen or more members. Undoubtedly, we will find additional DO that will divide the long strings into shorter strings. The fourth and fifth substrings (lengths 19 and 20 ) can accommodate one member each. The sixth and seventh substrings (lengths 89 and 74) will be divided. The eighth substring will probably not be further divided.

What I hoped for was that by identifying the instances of DO, I would be able to learn enough about the structure of Paper No. 3 that I could launch a probable word attack against the cipher. If my conclusions about Paper No. 3 were correct and if the decoded DOs in MONO B3B1-I index344 were correct and represented post office addresses, then I knew that when a DO was found: (1) he surname of an heir would be found to the left of the DO and (2) a first name or abbreviated first name of one of the members in Beale's party would be found to the right of the DO. I hoped to exploit this knowledge. Thus, I wrote a computer program capable of performing a fairly sofisticated word search algorithm. By feeding the program information about the cipher numbers, as well as any decoded letters O and D immediately preceeding or immediatedly following in close proximity to the decoded DO (representing a PO address), the program would search one or more especially prepared dictionaries for words that matched. I searched the Internet and located information that was used to construct these dictionaries. These dictionaries consisted of male first names, male abbreviated first names, female first names, female abbreviated first names, surnames or last names, names of all Virginia counties, and names of all circa 1820 Virginia post offices. These dictionaries could be searched individually.

With this in mind, I searched through the text in the B3 portion of Figure 6, looking for a spot where the word search algorithm might have the best chance of succeeding. I chose the string of 30 characters to the right of the second DO, viz.

18 11 40 87 53 90 D 22 D 37 28 D 86 63 O 41 45 86 74 D 16 32 58 78 66 69 43 19 06 23

I tried different combinations of substrings. I got a hit in the surnames dictionary. The program printed out the name "DOWDY," as a possible decoding for D 37 28 D 86. The program may have found one other decoding--a longer name that didn't work for one reason or the other. I was not familiar with the name DOWDY. And so, at first I as skeptical. But when I had a look at a copy of "Index to the 1820 Census of Virginia." [7] I found 18 households with the surname DOWDY: Allen G., Claiborne, and Elijah residing in Campbell County, Hundly, John, Wiett, and William in Bedford County, and eleven others in the counties of Cumberland, Franklin, Lunenburg, Halifax, and Nottoway. Since DOWDY was a surname, my next step was to scan the text to the right of the string D 37 28 D 86, viz.

63 O 41 45 86 74 D 16 32 58 78 66 69 43 19 06 23

for the name of a post office address. I got a "hit"--the name CONCORD. In fact, I think it was the only match. Wow! After investigating the Beale treasure story for roughly 50 years, now to see two words in Beale's Paper No. 3. This was GREAT. But, the jubilation I felt was cut short when I realized that the "Y" in Dowdy was cipher number 86 and the second "O" in Concord was cipher number 86. CN=86 can stand for only one letter, either "Y" or "O." I knew it probable that index344 would have errors in it. Could this explain how the two 86s could decode to two different letters. The locations of the two 86s were 112 and 117, and 112 mod 5 = 2 and 117 mod 5 = 2. Hence, the two 86s are in the same group G2, which means that no change to Beale's 5x10 column index could correct the error. It must be an encoding error. Perhaps CN 68 stood for letter "Y" and suppose when letter "Y" was encoded that Beale switched the digits and wrote 86 instead of 68. The error could also occur if Beale misread the row number or column number, thus causing one of the digits to be off by +1 or -1. It seems reasonable to expect that Beale would make encoding errors, in kind and quantity, consistent with others responsible for encoding messages, e.g., eighteenth century U.S. diplomats who encoded their secret messages sent to the State Department. For example, Nicholas Trist made so many encoding errors while preparing his encoded messages that the clerks at the State Department could hardly cope with the errors and read his messages.

In any case, if the decoded words DOWDY and CONCORD are correct, then 86 must stand for letter "Y" or letter "O." CN 86 occurs 16 times in MONO B3B1-I index344. Thus, its frequency is of little help in deciding whether 86=Y or 86=O. However, if we assign 86=O, then two additional DO are created in acceptable locations in the B3 portion. Moreover, there are no DO created in the B1 portion, nor are there any OD, OO, or DD created in either the B3 portion or B1 portion. Thus, I have elected to assign 86=O, keeping in mind that the assignment could be changed later if necessary.

If the words DOWDY and CONCORD are correct, then the partial decoding looks like this:

Locations 100 through 119

0 1 2 3 4 0 1 2 3 4 0 1 2 3 4 0 1 2 3 4

18 11 40 87 53 90 79 22 95 37 28 07 86 63 26 41 45 86 74 95

.. .. .. .. .. .. D .. D O W D Y C O N C O R D

Figure 7. Partial Decoding (Locations mod 5, CNs, CNs with Decoded Letters).

Referring to Figure 7, line one specifies the Group that each CN is in (G0, G1, G2, G3, G4 or 0 1 2 3 4 for short). Thus, the numbers run from 0 to 4 and repeat. The locations in MONO B3B1-I index344 run from 0 to 1137; the locations in the partial decoding run from 100 through 119. CN 18 is at location 100, and therefore line one has a recorded value of 100 mod 5 = 0 (100 divided by 5 has a remainder of 0). Line two has the cipher numbers at locations 100 through 119. Line three has the partial decoding.

If the words DOWDY and CONCORD are correct, then the CNs in line two that decode to a Letter in line three can be substituted elsewhere in MONO B3B1-I index344--everywhere that the CNs are repeated. But not so fast. Actually, what we know is that 95 is a D in groups 3 and 4, 37 is an O in group 4, 28 is a W in group 0, 07 is a D in group 1, 86 is an O in group 2, 63 is a C in group 3, 26 is an O in group 4, 41 is an N in group 0, 45 is a C in group 1, 74 is an R in group 3. These would be correct assignments even if the 10x5 column index had errors in it, which we can be pretty certain of.

Using these seven CNs, I was able to enlarge the subsets by letting CN 77 represent letter "D" and letting CNs 76 and 86 represent letter "O." These two subsets of CNs produced 14 "DO," two "OO," one "DD" and zero "OD" in the B3 portion of MONO B3B1-I inner344 and two "DO," one "OO," one "DD," and zero "OD" in the B1 portion. The fact that we were able to produce 14 "DO" in the B3 portion and only two "DO" in the B1 portion, and so few "OO," "DD," and "OD" in both the B3 and B1 portions could be taken as a "signal" that we're on the right track.

Concluding Remarks: After working along these lines for several months, without success, I came to the conclusion that index344 isn't a productive line of attack likely to lead to a decoding of Beale's ciphers. The reason is this: MONO B3B1-I index344 has 344 repeat 2-grams. But this conflicts with prior evidence, which I neglected to heed, showing that MONO B3B1-I should have on average 235 repeat 2-grams, and moreover very unlikely to have less than 210 or more than 259 repeat 2-grams--see "Additional Tests Showing Too Few Repeated 2-Grams in B3B1-I" near the beginning of this web page.

I do have a few additional ideas for reconstructing Beale's 5x10 column index, which I will publish on this web page as time allows.

References

[1] Stephen M. Matyas, Jr. Beale Treasure Story, Vols. 1 and 2, Haymarket, Virginia, 2011.

[2] David Kahn, The Codebreakers, The Macmillan Company, New York, NY, 1967.

[3] William Blair, article on "Cipher." In volume eight of Abraham Rees' The Cyclopaedia; or Universal Dictionary of Arts, Sciences, and Literature, London: 1819.

[4] William Blair, article on "Cipher." In volume eight of Abraham Rees' The Cyclopaedia; or Universal Dictionary of Arts, Sciences, and Literature, Philadelphia: Samuel Bradford, [1806-1822].

[5] William F. Friedman. Cryptography and Cryptanalysis Articles, Vol. 2, Edited by William F. Friedman, Aegean Park Press, Laguna Hills, A, 1976, pp. 212-218, 249-254.

[6] Helen Fouche Gaines. Elementary cryptanalysis, a study of ciphers and their solution, 1941, p. 108.

[7] Jeanne Robey Felldin. Index to the 120 Census of Virginia, Genealogical Publishing Co., Inc., 1981, p. 125.

Appendix A

17 8 92 73 12 89 67 18 28 96
7 41 31 78 46 97 18 98 14 46
48 16 74 88 12 65 32 14 81 19
76 21 16 85 33 66 15 8 68 77
43 24 22 96 17 36 11 1 15 44
11 46 89 18 36 68 17 28 90 82
4 71 43 21 98 76 10 19 81 99
64 80 56 37 19 2 44 53 28 44
75 98 2 37 85 7 17 64 88 36
48 54 99 75 89 15 26 78 96 14
18 11 43 89 51 90 75 28 96 33
28 3 84 65 26 41 46 84 70 98
16 32 59 74 66 69 40 15 8 21
20 77 89 31 11 6 81 91 24 28
18 75 52 82 17 1 39 23 17 27
21 84 35 54 9 28 49 77 88 1
81 17 64 55 83 16 51 69 11 96
54 32 20 18 32 2 19 11 84 50
19 75 12 64 10 6 87 75 47 21
29 37 81 44 18 26 15 32 60 81
3 76 81 99 14 37 51 96 11 28
97 18 38 6 24 93 3 19 17 26
60 73 88 14 26 38 34 86 97 21
65 64 19 22 84 56 7 98 23 11
14 36 7 33 45 40 13 28 46 42
7 96 27 44 98 3 47 16 19 8
12 30 31 6 28 65 48 52 59 41
22 33 17 11 18 25 71 36 45 83
76 89 92 31 65 70 83 96 27 33
44 50 61 24 12 36 49 76 80 94
43 71 5 96 87 12 44 51 89 98
34 41 8 73 66 9 35 16 95 8
13 75 90 56 3 19 77 83 6 57
0 18 60 91 5 18 51 20 18 24
78 65 19 32 24 48 53 57 84 96
7 44 66 82 19 71 11 86 77 13
54 82 16 45 3 86 97 6 12 18
37 15 81 89 16 7 81 39 96 14
43 16 18 29 55 9 36 72 13 64
8 27 4 11 21 64 19 75 28 96
1 18 53 76 10 15 23 19 71 84
20 34 66 73 89 96 30 48 77 26
1 27 36 18 39 78 71 61 26 13
15 2 18 67 62 14 18 66 59 48
27 19 13 82 48 62 19 34 27 39
34 28 29 74 63 20 11 54 61 73
92 80 66 75 1 24 65 89 96 26
74 96 17 34 61 35 90 12 13 28
81 96 5 17 66 18 22 77 64 42
12 7 55 24 83 67 97 9 21 35
81 3 19 28 56 21 34 77 19 74
82 75 84 17 64 3 4 18 92 16
63 82 22 46 55 69 74 12 34 86
75 19 13 16 12 43 64 19 86 18
43 17 45 51 24 9 49 17 56 24
36 72 19 28 11 35 42 40 66 85
94 12 65 82 15 19 36 44 86 72
12 85 6 56 38 44 85 72 32 47
63 96 24 17 14 19 21 44 17 21
34 22 16 75 10 22 18 46 37 81
1 39 86 3 16 38 64 12 18 96
15 80 12 60 95 75 20 52
71 94

38 1 89 76 11 83 29 48 94 63

32 16 11 95 84 41 75 14 40 64

27 81 39 13 63 90 20 8 15 3

26 18 40 74 58 85 4 30 36 64

82 50 51 84 8 31 24 11 86 25

1 70 11 1 5 39 89 17 33 88

8 93 45 1 94 73 16 18 63 28

0 38 56 17 36 19 27 76 30 10

60 25 85 18 36 65 84 0 83 18

20 38 36 16 80 15 71 24 61 44

16 1 39 88 61 4 12 21 24 83

34 92 63 46 86 82 7 19 84 60

80 18 64 63 74 31 60 79 73 40

95 18 64 81 34 69 28 67 60 17

81 12 3 20 62 16 97 3 62 70

60 17 71 40 8 21 90 46 36 50

59 68 14 13 20 63 19 12 60 80

99 35 18 21 36 72 15 28 70 88

4 30 44 12 18 47 36 95 20 37

22 13 6 40 8 20 5 42 58 61

44 6 1 13 8 80 93 86 16 30

82 68 9 2 38 16 89 71 16 28

65 18 2 38 21 95 14 26 48 34

18 55 31 34 61 24 5 81 23 48

61 19 26 33 10 1 65 92 88 81

75 46 1 6 86 36 19 24 29 40

64 26 19 48 22 85 16 84 19 61

26 85 33 64 68 32 31 60 50 29

81 16 21 3 14 12 81 60 36 51

62 94 78 60 0 14 76 12 4 28

18 61 36 47 19 21 60 64 95 10

6 66 19 38 41 49 2 23 62 2

94 75 78 14 23 11 9 62 31 1

23 16 80 34 24 50 0 62 86 19

21 17 40 19 42 31 86 34 40 7

15 33 91 67 4 86 52 88 16 80

21 67 95 22 16 48 96 11 1 77

64 18 65 67 90 36 54 11 10 98

34 19 56 16 19 71 18 64 96 17

51 39 10 36 3 19 40 32 22 41

17 84 90 80 46 7 11 50 29 38

46 72 85 94 39 61 43 97 24 18

12 16 27 31 19 4 63 96 12 1

18 16 40 30 60 38 19 27 88 12

31 90 16 75 74 83 11 26 89 72

84 0 6 14 21 32 40 2 34 68

75 1 84 16 79 23 16 81 22 24

3 12 27 36 47 55 86 34 43 12

7 96 14 64 65 23 28 1 3 24

95 16 14 6 54 20 2 1 12 76

13 71 87 96 2 35 10 2 41 17

84 21 36 20 14 11 60 60