002 | Caesar Cipher

“When the Key Was Three”

That is the Caesar cipher: one of the simplest and most famous ciphers in history, and one of the most useful failures ever given to students, puzzle books and introductory security courses. Not because it is strong, but because it is weak in such an educationally generous way.

The scytale, our first artefact, hid meaning by changing where letters sat. The Caesar cipher hides meaning by changing which letters appear. The key is no longer a stick. The key is a number.

In the version associated with Julius Caesar, each letter is replaced by the letter three places later in the alphabet. In modern English terms, ATTACK becomes DWWDFN. The receiver reverses the process, shifting each letter back three places. There is no machinery, no parchment wrapped round a staff, no visible apparatus. Just a rule shared between sender and receiver.

A rule, of course, is a dangerous little creature. Once someone else knows it, it stops being magic and starts being a problem.

The main ancient source usually cited is Suetonius, writing long after Caesar’s death. In his Life of Julius Caesar, Suetonius says that Caesar used ciphered writing for confidential matters in letters to his intimates, and explains the method as substituting D for A and doing the same with the rest of the alphabet. In Roman counting, D is the fourth letter if A is counted as the first; in modern cryptographic language, that is a shift of three.^[1]

Aulus Gellius gives another glimpse of the same world. He refers to books of Caesar’s letters to Gaius Oppius and Cornelius Balbus, men who handled Caesar’s affairs while he was absent. In parts of those letters, Gellius says, individual letters appeared unjoined into syllables and no words could be made from them. He describes a prior secret agreement about changing the positions of letters so that reading restored the proper meaning.^[2]

Cassius Dio adds a military flavour. He describes Caesar sending a message to Quintus Cicero during a dangerous campaign situation, writing in Greek so that, if intercepted, it would be meaningless to the Gauls. Dio then says Caesar’s usual practice for secret messages was to substitute the fourth letter beyond the proper letter, making the writing unintelligible to most people.^[3]

That “most” matters.

The Caesar cipher was not designed to withstand a modern cryptanalyst with coffee, a laptop and an alarming affection for statistics. It was a practical method for a world of messengers, wax tablets, elite literacy, multilingual empires, military urgency and interception by people who might not have the language, time or habit needed to attack the text systematically.

This is one of the oldest lessons in security: a control can be weak in theory and still useful in a particular operational context. That does not make it strong. It makes it contextual. Security is annoyingly fond of context, but context is often overlooked.

Ancient writing also helped the defender a little. Texts were commonly written without the neat word spacing modern readers expect. If you cannot see where one word ends and the next begins, spotting familiar words becomes harder. Add short messages, unfamiliar names, abbreviations, damaged media and the pressure of campaign conditions, and a simple shift cipher might be enough to delay comprehension. Sometimes delay is the point. If a message is only useful for the next hour, delaying the enemy’s understanding until tomorrow can be adequate.

But once the method is suspected, the Caesar cipher starts to look less like secrecy and more like a locked door with the key under a labelled flowerpot.

With a modern 26-letter alphabet, there are only 25 useful non-zero shifts. Try them all and one will produce readable text. Even if Caesar’s alphabet was not exactly our tidy modern one, the conclusion does not change: the keyspace is tiny. A determined interceptor does not need genius. They need patience, literacy and perhaps a wax tablet.

The weakness goes deeper. A Caesar cipher shifts letters, but it does not change the underlying habits of the language. Common letters remain common, just under new names. Word shapes survive in disguised form. If an attacker guesses even one likely word, name or phrase, the shift can fall out immediately. A message to Cicero may contain names. A military message may contain places, units, orders, dates or predictable openings. Human communication leaks structure like an old roof leaks rain.

This is why the Caesar cipher belongs in a cybersecurity history rather than merely in a “fun with ancient codes” corner. It makes the difference between an algorithm and a key painfully visible. The algorithm is “shift every letter”. The key is “by how much”. If the algorithm is known and the key has only a handful of possibilities, the system is not secure in any serious sense.

The same mistake never really went away. It returns whenever someone says “nobody will know how this works” as if obscurity were a security architecture rather than hopeless optimism. It returns in proprietary protocols that collapse under inspection, hidden admin interfaces, home-brew cryptography^[4], undocumented access paths and “clever” encoding schemes that turn out to be base64 in sunglasses.^[5]

The Caesar cipher also teaches a smaller but delightful humiliation: layering the same weak idea may not help. Apply a shift of two and then a shift of three, and you have not created a cryptographic onion^[6]. You have created a shift of five, just inefficiently implemented.

The attribution story also needs care. The cipher is named after Caesar because famous men are historical gravity wells: everything nearby falls into orbit around them. The ancient accounts give us Caesar, Cicero, Oppius, Balbus, Suetonius, Gellius and Dio. They do not give us the names of the people who prepared the writing materials, copied letters, carried messages, managed archives, checked wording, handled replies, or perhaps performed the actual encoding and decoding under instruction.

That silence is not neutral.

Roman elite households and public life depended heavily on enslaved and freed labour. Wealthy households used slaves and freedmen as secretaries, accountants and managers, and literate service was part of the machinery by which aristocratic power communicated with itself. We cannot say which unnamed people touched Caesar’s ciphered letters.

The Caesar cipher therefore gives us two histories at once. One is the familiar history of cryptography: substitution, keys, brute force, frequency, and the eventual collapse of secret methods before systematic analysis. The other is the history of communication as labour: people writing, carrying, copying, concealing, delivering and remembering, most of them denied the dignity of being named.

It is tempting to laugh at the Caesar cipher because it is so breakable. We should, a little. Twenty-five possible modern shifts is not exactly a fortress.

But its simplicity is why it endures. In a few strokes it introduces the questions that still matter. What is the secret? Who has it? How large is the space of possibilities? What does the attacker know? How long does the protection need to last? Does the message leak structure even when transformed? Are we protecting against a casual reader, a rival commander, a trained analyst or someone with all weekend and a grudge?

The Caesar cipher did not give us strong cryptography.

It gave us a wonderfully compact failure mode.

The message moves three places sideways. The adversary follows.

References

[1] Suetonius, Life of Julius Caesar 56, for the classic D-for-A description of Caesar’s confidential ciphered letters. (perseus.tufts.edu)

[2] Aulus Gellius, Attic Nights 17.9, for Caesar’s letters to Oppius and Balbus and the idea of a prior agreement about changing letter positions. (perseus.tufts.edu)

[3] Cassius Dio, Roman History 40.9, for the campaign-message context and the “fourth letter beyond” description. (penelope.uchicago.edu)

[4] The classic “Well I couldn’t break it”. Bruce Schneier, eminent cryptographer, wrote “Anyone, from the most clueless amateur to the best cryptographer, can create an algorithm that [they themselves] can’t break. It’s not even hard. What is hard is creating an algorithm that no one else can break, even after years of analysis.” (Schneier’s Crypto-Gram newsletter, 15 October 1998)

[5] Colleagues of mine from the early 2000s may remember when we discovered exactly this in a product; “encryption” that was actually just base64 encoding.

[6] This gets us into the joys of group theory, something I studied for Further Maths A-Level without knowing I would later find a practical use for it in cryptography. Caesar shift ciphers form a group under composition, so applying multiple Caesar shifts sequentially is equivalent to applying one Caesar shift. DES does not have this property: the permutations induced by DES keys are not closed under composition, which is why multiple encryption can add real strength rather than collapsing into a single DES operation. This was proved publicly by Keith W. Campbell and Michael J. Wiener in “DES is not a Group”, presented at CRYPTO ’92 and published in 1993. Triple DES was proposed around 1978/1979, and its first major public standardised use was in financial-sector key management (ANSI X9.17-1985). This was long before 1992/1993, suggesting that before 1985 the NSA cryptographers had already internally proven this property of DES.