In the 1880s, Russian revolutionaries used a cipher that turns letters into numbers and adds them together. It is a Vigenere variant with a fatal flaw. Here is how it works.
In the 1880s, Russian revolutionaries used a cipher that turns letters into numbers and adds them together. It is a Vigenere variant with a fatal flaw: the addition is normal, not modular, which leaks information about the key length and plaintext.
The Nihilist cipher was used by the Russian Nihilist movement, a revolutionary faction that opposed the Tsarist regime. The cipher combines a Polybius square (which converts letters to two-digit coordinates) with additive encryption (which adds a numeric key to the coordinates). The result is a stream of two- and three-digit numbers that looks nothing like the original text.
You can encrypt and decrypt with the Nihilist Cipher tool to see the coordinate arithmetic in action.
The Nihilist cipher starts with a keyed Polybius square. A 5x5 grid is filled with the alphabet (I and J share a cell) using a keyword to determine the order.
For keyword "CIPHER", the grid is:
``
1 2 3 4 5
1 C I P H E
2 R A B D F
3 G K L M N
4 O Q S T U
5 V W X Y Z
``
Each letter is represented by its row and column. C = 11, I = 12, P = 13, H = 14, E = 15, R = 21, A = 22, and so on. The Polybius square tool demonstrates this mapping interactively.
The keyword fills the grid first (C, I, P, H, E, R), then the remaining letters follow in alphabetical order (A, B, D, F, G, K, L, M, N, O, Q, S, T, U, V, W, X, Y, Z), skipping letters already placed. I and J share position 12.
The Nihilist cipher uses a second keyword as an additive key. This key is also converted to Polybius coordinates. For additive key "SECRET":
S = 43, E = 15, C = 11, R = 21, E = 15, T = 44
The key repeats to match the length of the plaintext.
To encrypt "HELLO" with Polybius keyword "CIPHER" and additive key "SECRET":
1. Convert plaintext to coordinates: H = 14, E = 15, L = 33, L = 33, O = 41
2. Convert additive key to coordinates (repeating): S = 43, E = 15, C = 11, R = 21, E = 15
3. Add corresponding pairs: 14 + 43 = 57 15 + 15 = 30 33 + 11 = 44 33 + 21 = 54 41 + 15 = 56
Ciphertext: 57 30 44 54 56
Decryption subtracts the key coordinates from the ciphertext numbers:
57 - 43 = 14 = H 30 - 15 = 15 = E 44 - 11 = 33 = L 54 - 21 = 33 = L 56 - 15 = 41 = O
The Nihilist Cipher tool performs this arithmetic automatically.
The Nihilist cipher uses normal addition, not modular addition. This means the ciphertext values range from 22 (11 + 11, the minimum) to 110 (55 + 55, the maximum). The values are not bounded to two digits.
This creates an information leak. A ciphertext value of 57 tells you that the plaintext coordinate and key coordinate sum to 57. Since Polybius coordinates range from 11 to 55, a value of 57 constrains the possible plaintext-key pairs. A value of 100 or higher tells you both the plaintext and key letters are in the bottom rows of the grid.
The Vigenere cipher avoids this by using modular addition (mod 26). The result is always in the range 0-25, and no information about the key leaks from the ciphertext values alone. The Nihilist cipher's use of normal addition makes it weaker than Vigenere despite being structurally similar.
A cryptanalyst can exploit the non-modular addition by analyzing the distribution of ciphertext values. Values cluster around the sums of common plaintext and key letters. Since the key repeats, the same key letter produces a characteristic distribution of sums at each position. This is fundamentally a Vigenere break with extra information leakage.
CTF challenges: The Nihilist cipher appears in intermediate-level CTF crypto challenges, usually with a provided ciphertext and a hint about the Polybius keyword. The expected solution path is: identify the cipher from the numeric format, brute force or guess the Polybius keyword, then solve the additive key using frequency analysis on the coordinate sums.
Historical study: The Nihilist cipher is one of the few ciphers documented as being used by a specific revolutionary group for operational communications. The Russian Nihilists used it in the 1880s to coordinate assassinations and bombings. The cipher was eventually broken by Okhrana (the Tsarist secret police) cryptanalysts, who used the information leak from non-modular addition to recover keys.
Educational value: The Nihilist cipher is a good teaching example for two concepts: the Polybius square (fractionation, the basis of ADFGVX and other WWI ciphers) and the difference between modular and non-modular addition. The ADFGVX cipher extends the Polybius square concept with transposition for a much stronger construction.
The cipher identifier can detect Nihilist ciphers by recognizing the numeric format (two- and three-digit numbers in the range 22-110) and checking whether the distribution matches additive encryption of Polybius coordinates.
The Nihilist cipher has two structural weaknesses. First, the non-modular addition leaks information about both the plaintext and key at each position. Second, the key repeats, creating the same Kasiski-examination vulnerability as the Vigenere cipher. Combined, these weaknesses mean the cipher is breakable with less ciphertext than Vigenere requires.
The Polybius square reduces the alphabet to 25 symbols (I/J share a cell), which means the cipher cannot distinguish I from J in the plaintext. This is a minor limitation inherited from the Polybius square's Greek origins, but it means the decrypted text may require manual disambiguation.
The frequency analysis post covers the statistical techniques that break the Nihilist cipher. The Kasiski examination tool can determine the key length, and the Index of Coincidence calculator can confirm whether the ciphertext is polyalphabetic.
The Nihilist cipher is a numerical cipher used by Russian revolutionaries in the 1880s. It converts letters to Polybius square coordinates (two-digit numbers) and then adds a repeating numeric key to the coordinates. The result is a sequence of two- and three-digit numbers. It is a variant of the Vigenere cipher that uses normal addition instead of modular addition.
The Nihilist cipher uses normal addition of Polybius coordinates, while the Vigenere cipher uses modular addition (mod 26) of letter positions. The Nihilist cipher's non-modular addition leaks information because ciphertext values are not bounded, revealing constraints on the plaintext and key at each position. The Vigenere cipher's modular addition produces uniformly bounded output with no such leak.
The fatal flaw is the use of normal (non-modular) addition. Polybius coordinates range from 11 to 55, so ciphertext values range from 22 to 110. A high ciphertext value reveals that both the plaintext and key letters are in the lower rows of the Polybius grid. This information leak makes the cipher easier to break than the Vigenere cipher, which uses modular addition to prevent such leaks.
Russian Nihilists used the cipher in the 1880s to coordinate revolutionary activities against the Tsarist regime. The Okhrana (Tsarist secret police) cryptanalysts broke the cipher by exploiting the non-modular addition leak. The cipher's weakness contributed to the arrest of several Nihilist operatives.
No. The Nihilist cipher uses a 5x5 Polybius square where I and J share a single cell (position 12). This means both I and J encrypt to the same coordinate and cannot be distinguished in the ciphertext. The decrypted text requires manual disambiguation based on context.
Nihilist Cipher
Russian revolutionary cipher combining a keyed Polybius square with numeric key addition for coordinate-based encryption.
Polybius Square
Ancient Greek coordinate system converting letters to numerical positions for signaling.
Vigenère Cipher
Polyalphabetic substitution cipher using a keyword for enhanced encryption.
Kasiski Examination
Find repeated sequences to determine cipher key length for polyalphabetic ciphers.
Index of Coincidence Calculator
Statistical tool for cipher analysis to determine if text is encrypted and likely cipher type.
Frequency Analysis Explained: How to Break Any Substitution Cipher
Al-Kindi discovered frequency analysis in 9th-century Baghdad. The technique still breaks CTF substitution ciphers today. Here is how it works and how to apply it.
How the Vigenere Cipher Works, and Why It Was Called Unbreakable
Understand how the Vigenere cipher uses a repeating key to defeat simple frequency analysis, and learn why the Kasiski examination breaks it anyway.
