classical-cipher-analysis

Start with character set analysis to detect encodings like Base64, hex, or Morse, then compute the Index of Coincidence on letter-only text. IC near 0.065 indicates monoalphabetic substitution, IC around 0.04-0.05 suggests polyalphabetic ciphers like Vigenere, and IC near 0.038 implies a long key or one-time pad.

First find the key length using Kasiski examination on repeated sequences or by computing average IC across candidate key lengths. Then split the ciphertext into columns by key position and solve each column as an individual Caesar cipher using chi-squared frequency scoring.

CyberChef handles encoding and common cipher operations, dcode.fr offers over 200 cipher solvers, quipqiup automates monoalphabetic substitution solving, xortool cracks XOR ciphers, and Ciphey attempts automated cipher detection and decryption.

No, transposition ciphers preserve the original letter frequencies, so frequency analysis shows normal English distribution but scrambled text. Detect them by normal IC with unreadable plaintext, then brute force rail fence rail counts or try columnar transposition with common key lengths.

Frequency analysis and IC only work on the raw cipher alphabet, not on encoded representations. Always decode Base64, hex, or binary encodings first, then re-run character set and frequency analysis on the decoded bytes.

Use known-plaintext attacks when you can guess part of the message, such as a flag prefix in CTF challenges. Crib dragging builds a partial substitution mapping, and for Hill ciphers two known plaintext-ciphertext matrix pairs allow full key recovery via modular matrix inversion.