Schneier on Security

Sami Liedes • October 2, 2026 2:07 PM

To be clear, that’s one of the Truppenschlüssel messages, not one of the Enigma ones. It’s a hand cipher, a kind of double Playfair, but an easier version than what you often see because the letters are not reordered in any way before encrypting. You encrypt each digram separately, so it becomes a monoalphabetic substitution for 625 digrams. I’ve been looking into the unbroken TS messages, but the rest still defy me. I have some ideas and, to be honest, I’m running a bit out of steam after staring at this for a few days:

• A lot of the messages repeat place names and similar. If they repeat at an even offset, we just get repeated ciphertext. If they repeat at an odd offset, we get a digram relationship:

BI RM IN GH AM XB IR MI NG HA M?

Assume a ciphertext contains that text. Furthermore, assume we have a candidate plaintext that we want to score. I think we have here an underexplored metric: Index of coincidence between the plaintext digrams starting at even positions and the plaintext digrams starting at odd positions. This attacks the structure without taking a position on the actual letter identities.

• In all messages encrypted with the same (usually daily) key, we see similar digrams because the German plaintext is not random and because the digrams encrypt identically. This actually makes it quite easy to determine which ciphertexts share a key. If you look at, for example, the July 8 messages, other than the unbroken VHRNE, in the broken messages a lot of the ciphertext digrams appear in other messages of the day, whereas for the unbroken VHRNE it’s much less (intact or after shifting by one letter), close to random. This I think is pretty strong evidence it’s not encrypted with the same key (or cipher). The same is visible in leave-one-out cosine similarity to the remaining pool.
• This can also be used to detect likely one-letter insertions/deletions in ciphertexts.
• There are also statistics that the ciphertexts share even when the key differs. Consider, for example, the sorted histogram of the 625 digram frequencies (throwing away the digram identities). For correctly encrypted messages, they’re exactly identical regardless of the key, and also the exactly identical to that of the plaintext. I would expect Enigma messages, for example, to look much more random.
• As a wild idea, you could use the frequencies, and the frequencies of transitions between (unlabeled) digrams (i.e. a Markov process). Labeling the digrams with their plaintext digrams, ignoring for now the extra constraints to digram substitution that Truppenschlüssel gives us, is a noisy weighted graph-matching problem. This is akin to humans looking at repetitions and other structure in the ciphertext and making guesses.