Classical cipher analysis playbook. Use when encountering substitution ciphers, Vigenere, transposition, XOR, or encoded text in CTF challenges that requires frequency analysis, Kasiski examination, or known-plaintext cryptanalysis.

SKILL: Classical Cipher Analysis — Expert Cryptanalysis Playbook AI LOAD INSTRUCTION : Expert classical cipher identification and breaking techniques for CTF. Covers cipher identification methodology (frequency analysis, IC, Kasiski), monoalphabetic substitution, Caesar/ROT, Vigenere, Enigma, affine, Hill, transposition ciphers, Bacon/Polybius/Playfair, and XOR ciphers. Base models often skip the identification step and jump to the wrong cipher type, or fail to recognize encoded (base64/hex) ciphertext that needs decoding before analysis. 0. RELATED ROUTING [symmetric cipher attacks](../symmetric cipher attacks/SKILL.md) when dealing with modern symmetric ciphers (AES/DES) rather than classical [hash attack techniques](../hash attack techniques/SKILL.md) when the challenge involves hash based constructions [lattice crypto attacks](../lattice crypto attacks/SKILL.md) when knapsack based ciphers are encountered Quick identification guide Observation Likely Cipher First Action All uppercase letters, uneven frequency Monoalphabetic substitution Frequency analysis All uppercase, flat frequency distribution Polyalphabetic (Vigenere) IC + Kasiski Only A Z shifted uniformly Caesar/ROT Brute force 25 shifts Base64 alphabet (A Za z0 9+/=) Base64 encoded (decode first) Base64 decode Hex string (0 9a f) Hex encoded (decode first) Hex decode Binary (0s and 1s) Binary encoded Convert to ASCII Dots and dashes Morse code Morse decode Raised/normal text pattern Bacon cipher Map to A/B, decode 2 digit number pairs (11 55) Polybius square Grid lookup Text appears scrambled (right letters, wrong order) Transposition Anagram analysis Non printable bytes XOR like XOR cipher Single/repeating key XOR analysis 1. CIPHER IDENTIFICATION METHODOLOGY 1.1 Step 1: Character Set Analysis 1.2 Step 2: Frequency Analysis 1.3 Step 3: Index of Coincidence (IC) 1.4 Step 4: Kasiski Examination (for Polyalphabetic) 2. MONOALPHABETIC SUBSTITUTION 2.1 Frequency Analysis Attack 2.2 Known Plaintext (Crib Dragging) If part of the plaintext is known (e.g., "flag{" prefix): 3. CAESAR / ROT CIPHERS 3.1 Brute Force 3.2 ROT13 and ROT47 4. VIGENERE CIPHER 4.1 Full Attack Workflow 4.2 IC Based Key Length Detection 4.3 Per Position Frequency Attack 5. AFFINE CIPHER 5.1 Definition E(x) = (a·x + b) mod 26 where gcd(a, 26) = 1. Valid a values: 1, 3, 5, 7, 9, 11, 15, 17, 19, 21, 23, 25 (12 values). 5.2 Brute Force (312 combinations) 5.3 Known Plaintext 6. HILL CIPHER Matrix based cipher: C = K · P mod 26 where K is an n×n key matrix. 6.1 Known Plaintext Attack 7. TRANSPOSITION CIPHERS 7.1 Rail Fence 7.2 Columnar Transposition 8. XOR CIPHER 8.1 Single Byte XOR See [symmetric cipher attacks](../symmetric cipher attacks/SKILL.md) Section 4.2 for full implementation. 8.2 Multi Byte XOR (xortool) 8.3 Known Plaintext XOR 9. SPECIAL CIPHERS 9.1 Bacon Cipher Binary encoding using two typefaces (A=normal, B=bold/italic). 9.2 Polybius Square 9.3 Playfair 5×5 grid cipher encrypting digraphs. 10. DECISION TREE 11. TOOLS Tool Purpose URL/Usage CyberChef Universal encoding/cipher Swiss army knife gchq.github.io/CyberChef dcode.fr 200+ cipher solvers online dcode.fr quipqiup Automated substitution cipher solver quipqiup.com xortool XOR cipher analysis and cracking pip install xortool RsaCtfTool RSA + some classical cipher support GitHub Ciphey Automated cipher detection and decryption pip install ciphey hashID Identify hash types pip install hashid Python Custom frequency analysis and scripting All attacks above CyberChef Recipes (Common)

classical-cipher-analysis