courses

A History of Cryptography

Why the history is worth your time

Every cipher on this page was, in its day, believed to be secure — and every one of them fell. That is not a coincidence; it is the single most important lesson in the field. The cryptography reference tells you which primitives to use today (AES-GCM, X25519, Argon2id); this page tells you why the profession is so insistent that you never roll your own and always prefer standard, publicly-vetted algorithms. The history is a two-thousand-year record of confident designers being outsmarted by patient analysts, and the modern discipline — Kerckhoffs’s principle, open standards, public review — is the scar tissue left behind.

The story runs through four great shifts:

  1. Substitution and transposition — hiding a message by scrambling its letters (antiquity → ~1900).
  2. Cryptanalysis as a science — frequency analysis turns codebreaking from art into method (9th century onward).
  3. Mechanization — rotor machines industrialize encryption, and mathematics industrializes breaking them (WWI–WWII).
  4. The mathematical era — Shannon proves what “secure” even means, and public-key cryptography solves the key-distribution problem that had shackled everyone before (1949 → today).

⚠️ “Unbreakable” is a marketing claim, not a security property. The Vigenère cipher was sold as le chiffre indéchiffrable for three centuries before Babbage and Kasiski dismantled it; the Enigma was trusted absolutely by an entire military while it was being read daily. When you see “unbreakable” in a product pitch, read it as “not yet analyzed by anyone who published.”

Antiquity: substitution and transposition

The two mechanical ideas underneath almost all pre-modern ciphers appear very early:

Technique Idea Ancient example
Transposition Keep the letters, change their order The Spartan scytale (c. 7th–5th c. BCE): a strip of parchment wound around a rod of a specific diameter; the message reads correctly only when re-wound on a rod of the same size
Substitution Keep the order, change the letters The Caesar cipher (1st c. BCE): shift each letter a fixed number of places down the alphabet

The Caesar cipher — reportedly used by Julius Caesar with a shift of three — is the canonical monoalphabetic substitution cipher: one fixed alphabet maps plaintext letters to ciphertext letters. It is trivial today, but it establishes the vocabulary (plaintext, ciphertext, key) the whole field still uses.

Worked example: the Caesar cipher

def caesar(text: str, shift: int) -> str:
    out = []
    for ch in text:
        if ch.isalpha():
            base = ord('A') if ch.isupper() else ord('a')
            out.append(chr((ord(ch) - base + shift) % 26 + base))
        else:
            out.append(ch)               # punctuation/spaces pass through
    return ''.join(out)

print(caesar("Veni, vidi, vici", 3))     # -> "Yhql, ylgl, ylfl"
print(caesar("Yhql, ylgl, ylfl", -3))    # -> "Veni, vidi, vici"

The same shift-by-13 (ROT13) is a one-liner with tr — still used today not for secrecy but to lightly obscure spoilers and hints:

echo "The answer is behind the door" | tr 'A-Za-z' 'N-ZA-Mn-za-m'
# -> Gur nafjre vf oruvaq gur qbbe
#  ROT13 is its own inverse: run it again to decode.

A Caesar cipher has only 25 useful keys, so you break it by trying them all — a brute-force search, the same idea (at vastly larger scale) behind modern hash cracking. Even a full monoalphabetic substitution, with its 26! ≈ 4×10²⁶ possible key mappings, feels unbreakable by brute force. It isn’t — and the reason why is the first great idea in cryptanalysis.

The Arab breakthrough: frequency analysis

Around 850 CE in Baghdad, the polymath al-Kindī wrote Risālah fī Istikhrāj al-Muʿammā (“A Manuscript on Deciphering Cryptographic Messages”), the earliest known text on cryptanalysis — and the earliest known use of statistical inference of any kind. His insight: in any language, letters occur with characteristic, stable frequencies. A monoalphabetic cipher hides which letter is which, but not how often each appears. Count the ciphertext symbols, line up the most common ones against the language’s known frequency profile (in English: E, T, A, O, I, N, …), and the key falls out — no matter how many billions of keys the cipher nominally has.

This is the moment codebreaking became a science. It also set the template for the entire adversarial relationship at the heart of security: a design that looks strong by one measure (key count) collapses under an attack that measures something else entirely (statistics). (Al-Kindī’s manuscript itself was lost for a millennium, rediscovered in the Sülemaniye Ottoman archive in Istanbul and finally published in 1987.)

Worked example: breaking substitution with a letter count

from collections import Counter

ciphertext = """Wkh txlfn eurzq ira mxpsv ryhu wkh odcb grj.
Wkh txlfn eurzq ira mxpsv ryhu wkh odcb grj djdlq."""

counts = Counter(c for c in ciphertext.lower() if c.isalpha())
total = sum(counts.values())
for ch, n in counts.most_common(6):
    print(f"{ch}: {n:2d}  ({100*n/total:.1f}%)")

# The ciphertext letter that dominates almost certainly maps to plaintext 'e'
# or 't'; from there you bootstrap the rest against English frequencies.
# (This text is a Caesar shift of 3 — 'wkh' is 'the'.)

The Wkh → the giveaway is why short, repeated, high-frequency words (the, and, of) are the analyst’s first foothold. Frequency analysis is why every classical single-alphabet cipher is, for practical purposes, already broken.

The polyalphabetic era: le chiffre indéchiffrable

The defense against frequency analysis is to stop using one alphabet. The Vigenère cipher (popularized in the 16th century and long misattributed to Blaise de Vigenère) uses a keyword to switch among 26 different Caesar shifts as you move through the message. The same plaintext letter now encrypts to different ciphertext letters depending on its position, which flattens the frequency distribution and defeats al-Kindī’s attack head-on.

It worked so well that for roughly three centuries it was called le chiffre indéchiffrable — “the indecipherable cipher.”

Worked example: the Vigenère cipher

def vigenere(text: str, key: str, decrypt: bool = False) -> str:
    out, ki = [], 0
    for ch in text:
        if ch.isalpha():
            base = ord('A') if ch.isupper() else ord('a')
            k = ord(key[ki % len(key)].lower()) - ord('a')
            if decrypt:
                k = -k
            out.append(chr((ord(ch) - base + k) % 26 + base))
            ki += 1                      # key advances only on letters
        else:
            out.append(ch)
    return ''.join(out)

ct = vigenere("ATTACKATDAWN", "LEMON")
print(ct)                                # -> LXFOPVEFRNHR
print(vigenere(ct, "LEMON", decrypt=True))   # -> ATTACKATDAWN

How the unbreakable cipher broke

The keyword is also the weakness: because it repeats, so does the cipher. Two breakthroughs in the mid-19th century exploited that repetition:

⚠️ Reuse is the enemy. Vigenère fell because the keystream repeated. This is the same failure mode as reusing a one-time pad, reusing an AES-GCM nonce, or reusing a Diffie–Hellman key across sessions. “Never reuse keystream/nonces/keys” is one continuous lesson stretching from 1863 to your last code review.

Mechanization: rotor machines and Enigma

Manual polyalphabetic ciphers are slow and error-prone. In the early 20th century, engineers automated them with rotor machines: wired wheels that advance after each keystroke, producing an enormous, ever-changing sequence of substitution alphabets. The German Enigma — with its rotors, reflector, and (crucially) a rewireable plugboard — offered on the order of 10²³ possible settings and was trusted as unbreakable by the German military through World War II.

It was read anyway. The story is a landmark in the history of computing as much as cryptography:

The lesson repeats with a new twist: Enigma’s operators believed the sheer size of the keyspace was protection. But operational mistakes (repeated message keys, stereotyped openings, a letter never mapping to itself) gave analysts the statistical footholds a machine could then exploit at scale. Key size is necessary, never sufficient.

The mathematical turn: Shannon and perfect secrecy

Two developments turned cryptography from craft into mathematics.

So why don’t we use one-time pads everywhere? Because their strength is their impracticality: you need as much perfectly-random, secret key material as you have data to send, delivered in advance over a secure channel — which is the very key-distribution problem you were trying to solve. Break any of the four conditions — reuse the pad, use a non-random “pad,” reveal it — and perfect secrecy evaporates instantly. (The reused-pad mistake is exactly how the U.S. VENONA project read Soviet traffic.) Shannon’s real gift was the framework: from here on, ciphers would be judged against defined attacker models, not reputation.

The public standards era: DES and AES

Shannon’s mathematics met the computer, and by the 1970s commerce and government needed a standard cipher anyone could implement interoperably.

The arc from DES to AES is the professionalization of the field: from a closed process with unexplained parameters to fully public design, review, and standardization. It is Kerckhoffs’s principle — the security must rest in the key, not the secrecy of the algorithm — vindicated as policy.

The shrinking gap: introduction vs. brute force

The 20th century’s defining pressure on symmetric ciphers was Moore’s law: a key size that was comfortably beyond brute force at introduction can become searchable on ordinary hardware a couple of decades later. The timeline below shows, for four 20th-century ciphers, the span from when each entered service to when it could be exhaustively brute-forced on commodity hardware — the machines a hobbyist or a volunteer computing project could actually field.

The striking part is that the gap is not a smooth downward trend. Export-grade crypto was deliberately crippled and fell in weeks; DES had a long, useful life before Moore’s law caught it; and AES was designed with enough key-length margin that brute force never becomes the threat at all — its bar runs off the right edge and does not stop.

Cipher Key strength Introduced Brute-forced on commodity hardware Gap
Enigma mechanical (huge, but reducible) ~1930 (military service) Never by pure brute force — read 1939–45 by cryptanalysis exploiting operator error and the no-letter-maps-to-itself flaw n/a*
RC4-40 (export SSL) 40-bit 1995 (SSL 2.0) 1995 — Doligez brute-forced the Netscape 40-bit challenge in ~8 days on ~120 workstations weeks
DES 56-bit 1977 (FIPS 46) 1999 — distributed.net + EFF “Deep Crack” recovered a key in 22h15m (Deep Crack itself was purpose-built ASIC; distributed.net was volunteer commodity PCs) ~22 years
AES 128-bit 2001 (FIPS 197) Not feasible — 2¹²⁸ ≈ 3.4×10³⁸ keys; no foreseeable commodity (or non-commodity) hardware brute-forces it unbounded

* Enigma is included for scale, but it is the exception that proves the rule: it was never beaten by brute force. Its ~10²³-key space was too large for 1940s brute force, so the Allies won by cryptanalysis — attacking the machine’s structure and its operators’ habits, exactly as al-Kindī attacked substitution ciphers with statistics. Today a laptop trivially searches Enigma’s rotor settings; it is the plugboard that keeps naive brute force expensive, which is why modern Enigma attacks are still cryptanalytic rather than exhaustive.

⚠️ The lesson for choosing key sizes. “Secure against brute force today” is a statement with an expiry date unless you build in margin. 56-bit DES looked fine in 1977 and was a liability by the late 1990s; this is precisely why AES starts at 128 bits and offers 256, and why guidance like NIST SP 800-131A formally retires algorithms and key lengths on a schedule. When you pick a cipher, pick one whose brute-force bar runs off the edge of your data’s lifetime.

The public-key revolution

Every cipher so far, from Caesar to AES, is symmetric: sender and receiver share the same secret key. That leaves the ancient, unsolved problem — how do two parties who have never met agree on a key over a channel someone is watching? For all of history, the answer was “meet in advance, or trust a courier.”

In the 1970s that problem was solved, twice, secretly and then publicly:

The secret prehistory

The twist: GCHQ, Britain’s signals-intelligence agency, got there first — and told no one. James Ellis described “non-secret encryption” in 1970; Clifford Cocks worked out the RSA algorithm in essentially its final form in 1973; and Malcolm Williamson derived Diffie–Hellman key exchange shortly after. All three were classified. The work stayed secret until GCHQ declassified it in 1997 — Ellis died a month before the announcement, never publicly credited in his lifetime.

There are two lessons here, and both matter for how you think about security:

  1. Priority of publication is how the public field assigns credit — and, more importantly, public disclosure is what let the rest of the world use, review, and trust these ideas. Cocks’s algorithm sat useless in a vault for two decades; Rivest, Shamir, and Adleman’s identical idea, published, became the foundation of internet commerce.
  2. Kept-secret cryptography benefits only its keeper. The open ecosystem — TLS, PKI, signed software updates, encrypted messaging — exists because these primitives were published and scrutinized in the open.

Where the story is going

The pattern hasn’t stopped. The public-key schemes that secure the modern internet rest on problems (factoring, discrete logarithms) that a large quantum computer would break — so “harvest now, decrypt later” makes traffic captured today a future liability. NIST ran another open, AES-style competition and standardized the first post-quantum replacements in 2024. That transition — and the specifics of how to deploy it — is covered at the end of the cryptography reference. If the history teaches anything, it is that today’s “unbreakable” is tomorrow’s worked example.

Key takeaways

References

Related course pages: Cryptography · Security Principles and Approaches · Hash Cracking with Hashcat and John · Access Control and Authorization

🛠️ Maintenance note: the historical facts here are stable, but the forward-looking pointer to the post-quantum transition is a moving target — keep it as a link to the cryptography page rather than duplicating algorithm names/dates here, so there is only one place to update. Re-verify the external history links (several are Wikipedia) resolve at the start of each term.