classical-cipher-analysis

SKILL: Classical Cipher Analysis — Expert Cryptanalysis Playbook

AI LOAD INSTRUCTION: Expert classical cipher identification and breaking techniques for CTF. Covers cipher identification methodology (frequency analysis, IC, Kasiski), monoalphabetic substitution, Caesar/ROT, Vigenere, Enigma, affine, Hill, transposition ciphers, Bacon/Polybius/Playfair, and XOR ciphers. Base models often skip the identification step and jump to the wrong cipher type, or fail to recognize encoded (base64/hex) ciphertext that needs decoding before analysis.

0. RELATED ROUTING

• symmetric-cipher-attacks when dealing with modern symmetric ciphers (AES/DES) rather than classical
• hash-attack-techniques when the challenge involves hash-based constructions
• lattice-crypto-attacks when knapsack-based ciphers are encountered

Quick identification guide

Observation	Likely Cipher	First Action
All uppercase letters, uneven frequency	Monoalphabetic substitution	Frequency analysis
All uppercase, flat frequency distribution	Polyalphabetic (Vigenere)	IC + Kasiski
Only A-Z shifted uniformly	Caesar/ROT	Brute force 25 shifts
Base64 alphabet (A-Za-z0-9+/=)	Base64 encoded (decode first)	Base64 decode
Hex string (0-9a-f)	Hex encoded (decode first)	Hex decode
Binary (0s and 1s)	Binary encoded	Convert to ASCII
Dots and dashes	Morse code	Morse decode
Raised/normal text pattern	Bacon cipher	Map to A/B, decode
2-digit number pairs (11-55)	Polybius square	Grid lookup
Text appears scrambled (right letters, wrong order)	Transposition	Anagram analysis
Non-printable bytes XOR-like	XOR cipher	Single/repeating key XOR analysis

---

1. CIPHER IDENTIFICATION METHODOLOGY

1.1 Step 1: Character Set Analysis

def analyze_charset(ciphertext):
    """Identify encoding/cipher by character set."""
    chars = set(ciphertext.strip())

    if chars <= set('01 \n'):
        return "Binary encoding"
    if chars <= set('.-/ \n'):
        return "Morse code"
    if chars <= set('0123456789abcdef \n'):
        return "Hex encoding"
    if chars <= set('ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\n'):
        if '=' in ciphertext or len(ciphertext) % 4 == 0:
            return "Base64 encoding"
    if chars <= set('ABCDEFGHIJKLMNOPQRSTUVWXYZ \n'):
        return "Uppercase only — classical cipher"
    if all(c in '12345' for c in ciphertext.replace(' ', '').replace('\n', '')):
        return "Polybius square (digits 1-5)"

    return "Mixed charset — needs further analysis"