The Keyword Cipher: How a Single Word Builds a Substitution Alphabet

The keyword cipher uses a memorable word to scramble the entire alphabet. It is more secure than the Caesar cipher, with a larger key space, but frequency analysis still breaks it in minutes. The cipher is a monoalphabetic substitution, which means every plaintext letter maps to exactly one ciphertext letter, consistently throughout the message.

The keyword cipher appears frequently in CTF challenges and puzzle hunts because it is easy to implement by hand and easy to recognize once you know what to look for. You can encrypt and decrypt with the Keyword Cipher tool to see the substitution alphabet it produces.

The keyword cipher builds a substitution alphabet from a keyword. The process has three steps:

1. Clean the keyword: Remove duplicate letters from the keyword. For example, "ZEBRAS" becomes "ZEBRAS" (no duplicates). "BANANA" becomes "BAN" (duplicates removed).

2. Build the cipher alphabet: Write the cleaned keyword first, then append the remaining letters of the standard alphabet in order, skipping any letters already in the keyword. For "ZEBRAS":

`` Plain: ABCDEFGHIJKLMNOPQRSTUVWXYZ Cipher: ZEBRASCDFGHIJKLMNOPQTUVWXY ``

Z, E, B, R, A, S come from the keyword. Then C, D, F, G, H, I, J, K, L, M, N, O, P, Q, T, U, V, W, X, Y fill in the rest, skipping letters already placed.

3. Substitute: Each plaintext letter is replaced by the corresponding cipher alphabet letter. A becomes Z, B becomes E, C becomes B, and so on.

To encrypt "HELLO" with keyword "ZEBRAS":

- H -> D (position 7 in cipher alphabet) - E -> R (position 4) - L -> K (position 11) - L -> K - O -> N (position 14)

Ciphertext: DRKKN.

Decryption reverses the process: find each ciphertext letter in the cipher alphabet and replace it with the corresponding plaintext letter.

The keyword cipher is often confused with the Vigenere cipher, but they are fundamentally different.

Keyword cipher: The keyword builds a single substitution alphabet. The same alphabet is used for every letter in the message. It is a monoalphabetic substitution cipher. The keyword "ZEBRAS" produces one fixed mapping: A=Z, B=E, C=B, D=R, E=A, F=S, G=C, and so on.

Vigenere cipher: The keyword is used as a repeating keystream. Each letter of the keyword shifts the corresponding plaintext letter by its position in the alphabet. "ZEBRAS" means the first letter is shifted by 25 (Z), the second by 4 (E), the third by 1 (B), and so on, repeating. It is a polyalphabetic substitution cipher.

Caesar cipher: The Caesar cipher is a keyword cipher with an empty keyword. The cipher alphabet is just the standard alphabet shifted by a fixed amount. The Caesar cipher has 25 keys (shifts 1-25). The keyword cipher has as many keys as there are possible keywords, which is effectively unlimited but constrained by the fact that the output is still a monoalphabetic substitution.

The key distinction is monoalphabetic vs. polyalphabetic. The keyword cipher uses one alphabet for the entire message. The Vigenere cipher uses multiple alphabets, one for each key letter, cycling through the keyword. This is why frequency analysis breaks the keyword cipher but requires the Kasiski examination to break Vigenere.

Encrypt "ATTACK AT DAWN" with keyword "CIPHER".

Clean keyword: CIPHER (no duplicates).

Build cipher alphabet:

`` Plain: ABCDEFGHIJKLMNOPQRSTUVWXYZ Cipher: CIPHERABDFGJKLMNOQSTUVWXYZ ``

C, I, P, H, E, R from the keyword. Then A, B, D, F, G, J, K, L, M, N, O, Q, S, T, U, V, W, X, Y, Z fill the rest.

Encrypt each letter:

- A -> C - T -> S - T -> S - A -> C - C -> I - K -> K

"ATTACK" -> CSSCIK

- A -> C - T -> S

"AT" -> CS

- D -> F - A -> C - W -> W - N -> O

"DAWN" -> FCWO

Full ciphertext: CSSCIK CS FCWO

The Keyword Cipher tool performs this automatically and shows the full substitution alphabet for any keyword.

The keyword cipher is a monoalphabetic substitution cipher. Frequency analysis breaks it the same way it breaks any monoalphabetic substitution, as described in the frequency analysis post.

The attack does not require knowing the keyword. The keyword only determines which of the 26! possible substitution alphabets is used. Frequency analysis recovers the alphabet directly, and from the recovered alphabet, you can often deduce the keyword by looking at which letters appear first in the cipher alphabet.

For example, if the recovered cipher alphabet starts with "CIPHERABDFG...", the keyword is clearly "CIPHER". This is a weakness unique to the keyword cipher: the key is embedded in the substitution alphabet and can be recovered after the alphabet is broken.

The letter frequency analyzer shows the frequency distribution of the ciphertext. If the distribution matches English letter frequencies but with shifted labels, the cipher is monoalphabetic and the keyword cipher is a likely candidate. The cryptogram solver can automate the full attack.

The cipher identifier can detect keyword ciphers by checking whether the ciphertext's frequency distribution is monoalphabetic and whether the recovered alphabet matches a keyword pattern.

The keyword cipher offers no meaningful security. Its only advantage over the Caesar cipher is a larger key space, but since both are monoalphabetic, frequency analysis breaks both equally fast. A 100-character ciphertext is enough for frequency analysis to succeed reliably.

The keyword itself is a weakness. Short keywords produce predictable alphabet patterns (the first few letters of the cipher alphabet are the keyword, followed by the remaining letters in order). An attacker who recovers the substitution alphabet can read the keyword directly, which may reveal the user's password scheme or naming convention.

The keyword cipher is sometimes used in puzzle hunts and escape rooms because it is easy to implement by hand and the keyword can be a thematic clue. For any actual security application, use the Vigenere cipher at minimum, or better, a modern encryption algorithm like AES-GCM via the block cipher tool.