Caesar & Vigenère, broken in your browser

A substitution cipher replaces each letter of the plaintext with a different letter, according to a fixed rule. The rule — the key — is what the sender and receiver share; everything else is public. That separation between the algorithm and the secret is one of the oldest and most important ideas in cryptography.

Caesar's cipher (used by Julius Caesar around 50 BC) is the simplest possible substitution: shift every letter by a fixed amount. The key is just one number from 0 to 25 — 25 keys total, so the entire keyspace fits in a sentence.

Vigenère's cipher (Bellaso 1553, misattributed to Blaise de Vigenère in 1586) makes the shift change with each letter, cycling through the letters of a keyword. For three centuries it was called le chiffre indéchiffrable — the indecipherable cipher — until Charles Babbage and Friedrich Kasiski independently broke it in the 1850s.

Both ciphers are completely broken today by tools that fit in a few hundred lines of code. We'll watch them break below — but the important takeaway isn't that they're weak. It's that the design failure that breaks them — leaking the statistical structure of the underlying language — is the same failure mode that haunts modern cryptography too. AES is engineered precisely to avoid this leak.

Even without trying every shift, you can spot the right one instantly: letter frequencies in English are wildly uneven. E is ~12.7%, T is ~9.1%, A is ~8.2%; while Z is 0.07%, Q is 0.10%, J is 0.15%. A Caesar shift just rotates the histogram — the shape stays identical.

So the attack is to compare the frequency histogram of the ciphertext to the expected English histogram, with each candidate shift applied. The shift that minimizes the difference (measured by chi-squared) is the right one.

Vigenère's clever idea: instead of one shift for every letter, use a repeating keyword. Each plaintext letter is shifted by the corresponding letter of the key (cycled to match plaintext length). Different positions get different shifts, so the same plaintext letter doesn't always become the same ciphertext letter.

That destroys the simple frequency histogram that breaks Caesar. The character "E" in plaintext might map to "M" in one position and "Q" in another, depending on which key letter is currently active. For a 5-letter key, every position uses one of 5 different Caesar shifts, cycling.

Friedrich Kasiski (1863) and Charles Babbage (~1854, unpublished) independently noticed that if you can recover the key length, Vigenère collapses into a stack of independent Caesar ciphers — one per key position — and each falls to plain frequency analysis.

The modern way to find the key length is the Index of Coincidence: the probability that two randomly-chosen letters of the text are the same. English text has IoC ≈ 0.067. Random uniform text has IoC ≈ 0.0385. If you split a Vigenère ciphertext into n streams (every nth letter into the same stream), the streams will have English-like IoC only when n is a multiple of the key length. Otherwise they'll look random.

Caesar and Vigenère are useless for hiding messages today, but two of their ideas survive verbatim in modern cryptography:

1. The plaintext-key separation. Caesar's attacker knew the algorithm — shift letters — but didn't know the shift. That framework is now Kerckhoffs's principle: a cryptosystem should be secure even if everything but the key is public. AES, RSA, ML-KEM all follow this; their algorithms are published in NIST documents and only the keys are secret.

2. The polyalphabetic idea. Vigenère's "different shift per position" matures into the stream cipher: a key-derived sequence of bytes XOR'd into the plaintext, where each byte's "shift" is essentially random. ChaCha20 and AES-CTR are 21st-century Vigenères, with key material indistinguishable from random — so the IoC trick can't find anything to grab onto.

What dies with Caesar and Vigenère is the assumption that small keyspaces or simple structures can hide plaintext from a determined adversary with statistical tools. Every modern primitive is tested by the same question: "could the ciphertext distribution be distinguished from random with any computational budget short of the keyspace size?" The answer for AES, after 25 years of attack, is still no. The answer for Caesar after about 5 minutes was yes.