The affine cipher is the only classical cipher that requires modular arithmetic. With only 312 possible keys, brute force takes milliseconds. Here is the formula, the math, and why it fails.
The affine cipher is the only classical cipher that requires modular arithmetic. It is also one of the weakest, with only 312 possible keys. Brute force takes milliseconds on any modern computer.
Despite its weakness, the affine cipher is worth understanding because it introduces two concepts that appear throughout cryptography: modular arithmetic and the modular multiplicative inverse. If you have ever wondered why RSA requires the key generator to choose e such that gcd(e, phi(n)) = 1, the affine cipher is the simplest case of that same requirement.
You can encrypt and decrypt with the Affine Cipher tool to see the math in action.
The affine cipher encrypts each letter using the function:
``
C = (a * P + b) mod 26
``
Where P is the plaintext letter position (A=0, B=1, ..., Z=25), C is the ciphertext letter position, a is the multiplicative key, and b is the additive key. The pair (a, b) is the key.
Decryption uses the inverse function:
``
P = a^(-1) * (C - b) mod 26
``
Where a^(-1) is the modular multiplicative inverse of a modulo 26. This is the number that, when multiplied by a modulo 26, gives 1.
The Caesar cipher is a special case of the affine cipher where a = 1. The formula becomes C = (1 * P + b) mod 26, which is C = (P + b) mod 26, the standard Caesar shift. The multiplicative cipher is the other special case, where b = 0.
Not every value of a works. The multiplicative key a must be coprime with 26, meaning gcd(a, 26) = 1. If a shares a factor with 26, the encryption function is not injective: two different plaintext letters map to the same ciphertext letter, and decryption becomes impossible.
The number 26 factors as 2 * 13. So a must not be divisible by 2 or 13. The valid values of a are: 1, 3, 5, 7, 9, 11, 15, 17, 19, 21, 23, 25. That is 12 values.
The modular inverse of a modulo 26 is found using the extended Euclidean algorithm. For example, the inverse of 5 mod 26 is 21, because 5 21 = 105 = 4 26 + 1 = 1 mod 26. The modular arithmetic calculator can compute these inverses.
Why a = 2 fails: If a = 2, then C = (2P + b) mod 26. Both P=0 (A) and P=13 (N) map to the same ciphertext value (b mod 26). The function is two-to-one for half the alphabet. You cannot decrypt because you do not know which of two plaintext letters a ciphertext letter represents.
The additive key b can be any value from 0 to 25, giving 26 options. The total key space is 12 26 = 312 keys. Compare this to the Caesar cipher's 25 keys or a general substitution cipher's 26! (approximately 4 10^26) keys.
Let a = 5, b = 8. Encrypt the message "HELLO".
First, convert to numbers: H=7, E=4, L=11, L=11, O=14.
Apply C = (5P + 8) mod 26 to each letter:
- H: (5*7 + 8) mod 26 = 43 mod 26 = 17 = R - E: (5*4 + 8) mod 26 = 28 mod 26 = 2 = C - L: (5*11 + 8) mod 26 = 63 mod 26 = 11 = L - L: (5*11 + 8) mod 26 = 63 mod 26 = 11 = L - O: (5*14 + 8) mod 26 = 78 mod 26 = 0 = A
Ciphertext: RCLLA.
To decrypt, find the modular inverse of 5 mod 26. Using the extended Euclidean algorithm: 5 21 = 105 = 426 + 1, so a^(-1) = 21.
Apply P = 21 * (C - 8) mod 26:
- R: 21 (17 - 8) mod 26 = 21 9 mod 26 = 189 mod 26 = 7 = H - C: 21 (2 - 8) mod 26 = 21 (-6) mod 26 = 21 * 20 mod 26 = 420 mod 26 = 4 = E - L: 21 (11 - 8) mod 26 = 21 3 mod 26 = 63 mod 26 = 11 = L - L: same = L - A: 21 (0 - 8) mod 26 = 21 (-8) mod 26 = 21 * 18 mod 26 = 378 mod 26 = 14 = O
Plaintext recovered: HELLO.
Note that L maps to L in this example. This is a coincidence of the chosen key, not a general property. With a different key, L would map to a different letter.
With only 312 keys, the affine cipher is trivially broken by brute force. A computer can try all 312 keys in microseconds. Even by hand, trying 12 multiplicative keys with frequency analysis to identify the correct one takes minutes.
The affine cipher is a monoalphabetic substitution cipher, which means it preserves letter frequencies. The most common letter in the ciphertext corresponds to the most common letter in the plaintext (E in English). Frequency analysis breaks it just as it breaks any monoalphabetic substitution, as described in the frequency analysis post.
The letter frequency analyzer will show the distribution, and the cryptogram solver can automate the attack. The cipher identifier tool can also detect affine ciphers by checking whether the frequency distribution matches an affine transformation of English letter frequencies.
Abraham Sinkov described the affine cipher and its cryptanalysis in Elementary Cryptanalysis: A Mathematical Approach (1968), which remains a standard reference for classical cipher mathematics. The book covers the modular arithmetic foundations that the affine cipher relies on and shows how the same principles extend to the Hill cipher (matrix-based encryption) and RSA.
The affine cipher has no practical security value. Its 312-key space is smaller than the Caesar cipher's key space multiplied by 12, and both are broken instantly by brute force. The cipher exists as a teaching tool for modular arithmetic and modular inverses.
The affine cipher cannot handle digits or special characters without extending the modulus. If you use mod 26, only uppercase letters work. Extending to mod 36 adds digits but changes the coprime requirement (36 = 4 * 9, so a must be coprime with both 2 and 3). Extending to full ASCII requires mod 128 or mod 256, which changes the valid values of a.
The Caesar cipher](/tools/caesar-cipher) and the Vigenere cipher are more commonly encountered in CTF challenges. The affine cipher appears occasionally in beginner crypto challenges on [CryptoHack and picoCTF, usually as a warmup before more complex modular arithmetic problems like RSA.
The affine cipher encrypts using C = (a P + b) mod 26, where P is the plaintext letter position (A=0), a is the multiplicative key, and b is the additive key. Decryption uses P = a^(-1) (C - b) mod 26, where a^(-1) is the modular inverse of a modulo 26.
The affine cipher has 312 possible keys. The multiplicative key a has 12 valid values (numbers coprime with 26: 1, 3, 5, 7, 9, 11, 15, 17, 19, 21, 23, 25) and the additive key b has 26 values (0-25). The total is 12 * 26 = 312.
The multiplicative key a must be coprime with 26 (gcd(a, 26) = 1) for the encryption function to be invertible. If a shares a factor with 26, two different plaintext letters map to the same ciphertext letter, making decryption impossible. For example, a=2 maps both A and N to the same ciphertext value.
No. With only 312 possible keys, brute force takes milliseconds. The cipher is also monoalphabetic, so frequency analysis breaks it just as it breaks any substitution cipher. The affine cipher is a teaching tool for modular arithmetic, not a practical encryption method.
The Caesar cipher is a special case of the affine cipher where a = 1. The formula C = (1 * P + b) mod 26 simplifies to C = (P + b) mod 26, which is the standard Caesar shift. The multiplicative cipher is the other special case where b = 0.
Affine Cipher
Mathematical cipher using linear functions ax + b for letter substitution.
Caesar Cipher
Encrypt or decrypt messages by shifting letters through the alphabet.
Modular Arithmetic Calculator
Compute modulo operations, modular inverses, and modular exponentiation for cryptography and mathematics.
Letter Frequency Analyzer
Count and analyze letter frequencies in text for cryptogram solving.
Cryptogram Solver
Automated solving of substitution ciphers using frequency analysis and pattern recognition.
Frequency Analysis Explained: How to Break Any Substitution Cipher
Al-Kindi discovered frequency analysis in 9th-century Baghdad. The technique still breaks CTF substitution ciphers today. Here is how it works and how to apply it.
The Caesar Cipher: History, Math, and Two Ways to Break It
Julius Caesar shifted letters by 3. Suetonius documented it around 121 CE. Learn the exact math, the ROT13 self-inverse property, and how brute force and frequency analysis break it in seconds.
How the Vigenere Cipher Works, and Why It Was Called Unbreakable
Understand how the Vigenere cipher uses a repeating key to defeat simple frequency analysis, and learn why the Kasiski examination breaks it anyway.
