The Autokey Cipher

The Autokey Cipher: Letting the Message Encrypt Itself

Introduction

Every weakness of the Vigenère cipher traces back to one design choice: its key repeats. A short keyword cycling over a long message creates a detectable periodic pattern. That’s exactly what Kasiski examination exploits to recover the key length and crack the whole cipher. The Autokey cipher, devised in the 16th century and refined by Blaise de Vigenère himself, fixes this at the root. Instead of repeating a short keyword, it extends the key using the plaintext (or ciphertext) itself, so the key stream never cycles at all. For a message long enough, no two full periods ever repeat. (A historical aside worth knowing: the repeating-key system this series calls “Vigenère,” per long-standing convention, is more accurately credited to Giovan Battista Bellaso; Vigenère’s own most significant original contribution was closer to the autokey idea covered in this article.)

Table of Contents

• How the Autokey Cipher Works
• A Worked Example: Encryption
• Decryption: Unrolling the Key One Step at a Time
• Why Autokey Beats Kasiski Examination
• Pros and Cons Analysis
• The Catch: Autokey’s Real Weaknesses
• Plaintext Autokey vs. Ciphertext Autokey
• Modern Relevance
• Python Implementation
• Limitations
• Conclusion
• FAQ
• References

How the Autokey Cipher Works

Autokey starts with a short priming key (sometimes just a single letter), exactly like a Vigenère keyword. But instead of repeating that keyword to cover the whole message, the key stream is extended by appending the plaintext itself, shifted after the priming key:

Plaintext:  A T T A C K A T D A W N
Key stream: K E Y A T T A C K A T D

Notice the key stream after the first three letters (“KEY”) is just the plaintext, shifted three positions to the right. Each ciphertext letter is still computed with ordinary Vigenère addition, C = (P + K) mod 26. The only thing that changed is where the key comes from.

Interactive Visualizer

Try it above with priming key “KEY”. Watch the key stream row grow as each plaintext (or, in decryption, newly-recovered plaintext) letter gets folded into future key positions.

A Worked Example: Encryption

Encrypting “ATTACKATDAWN” with priming key “KEY”:

Plain (P)	A	T	T	A	C	K	A	T	D	A	W	N
Key (K)	K	E	Y	A	T	T	A	C	K	A	T	D
Result	K	X	R	A	V	D	A	V	N	A	P	Q

For the first letter: P=A (0), K=K (10), so C = (0 + 10) mod 26 = 10 → K. The key for position 3 onward is just the plaintext itself: position 3’s key letter is A (plaintext position 0), position 4’s key letter is T (plaintext position 1), and so on.

Working through the next two letters the same way: P=T (19), K=E (4), so C = (19 + 4) mod 26 = 23 → X. Then P=T (19), K=Y (24), so C = (19 + 24) mod 26 = 43 mod 26 = 17 → R, matching the “X” and “R” already shown in the table.

“ATTACKATDAWN” → “KXRAVDAVNAPQ”

As with every cipher in this series, non-letter characters (spaces, punctuation, digits) are conventionally stripped from the message before encryption begins. The key stream is built purely from letters, so there’s nothing meaningful for punctuation to contribute to it.

Decryption: Unrolling the Key One Step at a Time

Encryption can compute the entire key stream upfront, because the whole plaintext is already known. Decryption can’t. The recipient only has the ciphertext and the short priming key, and the rest of the key stream is made of plaintext that doesn’t exist yet. So decryption has to proceed strictly one letter at a time:

1. Decrypt position i using whatever key letter is currently known at that position (P_i = (C_i - K_i) mod 26).
2. That newly-recovered plaintext letter immediately becomes the key letter for position i + (priming key length).
3. Repeat, extending the known key stream by exactly one letter every time a new plaintext letter is recovered.

Applying this to “KXRAVDAVNAPQ” with priming key “KEY”:

• Position 0: C=K (10), K=K (10), so P = (10 - 10) mod 26 = 0 → A.
• Position 1: C=X (23), K=E (4), so P = (23 - 4) mod 26 = 19 → T.
• Position 2: C=R (17), K=Y (24), so P = (17 - 24) mod 26 = -7 mod 26 = 19 → T.

That recovered T from position 2 immediately becomes the key letter for position 2 + 3 = 5 (three positions later, since the priming key is three letters long). It wasn’t available a moment ago, but now it is. The process cascades forward exactly like this, one freshly-decrypted letter unlocking the next key position, until the full plaintext “ATTACKATDAWN” is recovered.

Why Autokey Beats Kasiski Examination

Kasiski examination works by finding repeated sequences in the ciphertext and measuring the distances between them. Those distances tend to be multiples of the key length, because a repeating key produces the same ciphertext whenever the same plaintext sequence lines up with the same key alignment. Put concretely: under a repeating Vigenère key, if the trigraph “THE” appears twice in the plaintext and both occurrences happen to line up with the same three key letters, both will encrypt to the identical ciphertext trigraph. That repetition, and the distance between the two occurrences, is exactly what Kasiski examination goes looking for. Autokey removes the repeating key entirely, so no plaintext sequence can ever line up with the same key material twice within one message. Since the key stream is derived from the (effectively random-looking, from a statistical standpoint) plaintext itself, it never cycles back to a previous state for a message shorter than the plaintext’s own length. There is no periodicity for Kasiski examination to detect, and no fixed set of “key columns” to frequency-analyze independently the way a Vigenère attack requires.

Pros and Cons Analysis

Advantages	Disadvantages
Immune to Kasiski Examination: No repeating key means no periodic structure to detect	Errors Cascade: A single transmission error or typo in the ciphertext corrupts not just one letter, but every subsequent letter that depends on it through the key chain
Effectively Unbounded Key Length: The key stream is as long as the message itself, unlike Vigenère’s fixed-length repeating key	Still Vulnerable to Known-Plaintext Attacks: Since the key partly is the plaintext, an attacker who guesses even a short plaintext fragment can potentially unravel large stretches of the message
A Real Historical Improvement: A genuine, documented advance over simple repeating-key Vigenère, motivated by exactly the weakness Kasiski later formalized	Weak Priming Key Still Matters: A short, guessable, or previously-seen priming key remains a single point of failure. Once it’s known, the rest cascades open
Foreshadows Stream Cipher Design: The idea of deriving key material from the message itself is a conceptual ancestor of modern keystream-generation techniques	Not Immune to Statistical Attacks: Language-model-based cryptanalysis (exploiting the fact that plaintext letters aren’t uniformly random, unlike a true one-time pad) can still recover Autokey ciphertexts with enough effort

The Catch: Autokey’s Real Weaknesses

Autokey solves Vigenère’s periodicity problem, but it introduces a different one: the key is not random. English plaintext has strong statistical structure (some letters and letter-pairs are far more common than others). Because most of the Autokey key stream is English plaintext, that same structure leaks into the key. Specialized cryptanalysis techniques exist that exploit this: they check candidate priming keys against the fact that both the recovered plaintext and the recovered key-extension (which is also plaintext) should independently look like coherent language. That narrows the search dramatically compared to a truly random key stream. In practice, this is the same principle behind “crib-dragging” and language-model-assisted attacks. A candidate priming key is only kept if both halves of what it produces (the decrypted message and the plaintext now sitting in the key stream three positions ahead) simultaneously look like real language. It’s not enough for just one or the other to look right. That double requirement is considerably harder to satisfy by accident than getting a single stream to look plausible, which is exactly why it narrows the search so effectively.

This is the same fundamental lesson the one-time pad makes explicit: a key stream is only as strong as its randomness, not merely its length or its resistance to any one specific attack technique like Kasiski examination.

Plaintext Autokey vs. Ciphertext Autokey

There’s a second historical variant worth knowing about: instead of extending the key stream with the plaintext (as covered above), some implementations extend it with the ciphertext instead. After the priming key runs out, position i’s key letter becomes ciphertext position i - (priming key length) rather than plaintext position i - (priming key length).

Side by side, the two constructions look like this (priming key “KEY”, 3 letters):

Plaintext autokey:
  Key stream:  K  E  Y  [plaintext letter 1]  [plaintext letter 2]  ...

Ciphertext autokey:
  Key stream:  K  E  Y  [ciphertext letter 1]  [ciphertext letter 2]  ...

Both variants share the same core idea (fold the message into its own key) and the same core weakness (a short, compromised priming key cascades open). But they differ in exactly what statistical structure leaks into the key stream. Plaintext autokey leaks plaintext-language statistics, while ciphertext autokey’s key stream is at least one derivation step further removed from raw language patterns. The visualizer above implements the classic plaintext autokey variant.

Modern Relevance

Autokey has no place in modern security, but remains genuinely important as:

• A historical milestone: often cited as the first serious attempt to eliminate key periodicity, directly motivated by the weakness that would later be formalized as Kasiski examination.
• A conceptual bridge to stream ciphers: modern stream ciphers generate a pseudorandom keystream from a seed, rather than reusing message content. But the core insight (avoid a short, repeating key) traces back to ideas like Autokey.
• A teaching example for why “no periodicity” isn’t the same as “cryptographically strong”: it closes one specific attack (Kasiski) while remaining open to others (known-plaintext attacks, language-statistics-based cryptanalysis). That’s a useful contrast with the perfect security of a truly random one-time pad.

Python Implementation

Encryption can build the whole key stream upfront, since the plaintext is already known. Decryption has to unroll it one letter at a time, exactly as described above:

def autokey_encrypt(text, priming_key):
    text = ''.join(c for c in text.upper() if c.isalpha())
    priming_key = ''.join(c for c in priming_key.upper() if c.isalpha())
    key_stream = priming_key + text  # the key stream is the plaintext, shifted over
    result = ''
    for i, char in enumerate(text):
        p = ord(char) - ord('A')
        k = ord(key_stream[i]) - ord('A')
        result += chr((p + k) % 26 + ord('A'))
    return result

def autokey_decrypt(ciphertext, priming_key):
    priming_key = ''.join(c for c in priming_key.upper() if c.isalpha())
    key_stream = list(priming_key)
    plaintext = ''
    for i, char in enumerate(ciphertext):
        c = ord(char) - ord('A')
        k = ord(key_stream[i]) - ord('A')
        p = (c - k) % 26
        letter = chr(p + ord('A'))
        plaintext += letter
        key_stream.append(letter)  # the freshly recovered letter extends the key
    return plaintext

if __name__ == "__main__":
    priming_key = "KEY"
    plaintext = "ATTACKATDAWN"

    ciphertext = autokey_encrypt(plaintext, priming_key)
    recovered = autokey_decrypt(ciphertext, priming_key)

    print(f"Plaintext:  {plaintext}")
    print(f"Ciphertext: {ciphertext}")
    print(f"Recovered:  {recovered}")

This reproduces the worked example above: ATTACKATDAWN → KXRAVDAVNAPQ → ATTACKATDAWN. Notice autokey_decrypt grows key_stream inside the loop; it genuinely can’t know position i’s key letter until position i - len(priming_key)’s plaintext has just been recovered.

Limitations

This implementation covers the plaintext-autokey variant only:

• No ciphertext-autokey option. The Plaintext Autokey vs. Ciphertext Autokey section above describes a second variant that extends the key with ciphertext instead; this code would need a small change to autokey_encrypt to support it.
• English letters only, formatting is lost. Spaces, punctuation, and case are stripped before encryption, same as every cipher in this series.
• No priming-key validation. An empty priming key breaks the indexing in both functions; there’s no check guarding against it.
• Not intended for real security. As the Catch section above explains, this is exactly as vulnerable to language-statistics-based cryptanalysis as any other faithful Autokey implementation; the code demonstrates the mechanism, not a secure system.

Conclusion

The Autokey cipher represents real, documented historical progress: by folding the plaintext into its own key stream, it eliminates the periodic structure that makes Vigenère so vulnerable to Kasiski examination. But it trades one weakness for another. The key stream, being built from ordinary language, still carries statistical structure an attacker can exploit, and a compromised priming key cascades open the entire message. It’s a clear illustration that eliminating one specific attack vector doesn’t automatically produce a secure cipher. True security requires a key stream that’s genuinely random, a lesson the one-time pad takes to its logical conclusion.

FAQ

What is the Autokey cipher?

A polyalphabetic cipher that extends Vigenère’s idea by using a short priming key followed by the plaintext itself (or, in the ciphertext-autokey variant, the ciphertext) as the ongoing key stream, eliminating the repeating-key structure that makes Vigenère vulnerable to Kasiski examination.

How does decryption work if the key depends on the plaintext?

Sequentially: each ciphertext letter is decrypted using whatever key material is currently known, and the newly-recovered plaintext letter immediately extends the key stream for a later position. This cascades forward one letter at a time until the whole message is recovered.

Is the Autokey cipher secure?

No, not by modern standards. While it defeats Kasiski examination, its key stream is built from ordinary language and therefore retains exploitable statistical structure, and it remains vulnerable to known-plaintext attacks.

What’s the difference between plaintext autokey and ciphertext autokey?

Plaintext autokey extends the key stream using the plaintext itself; ciphertext autokey extends it using the ciphertext instead. Both eliminate key periodicity, but they leak slightly different statistical structure into the key stream.

How does Autokey relate to the one-time pad?

Both aim to avoid a short, repeating key. The one-time pad achieves perfect security by using a truly random key as long as the message. Autokey approximates unboundedness by reusing the message’s own (non-random) content. That’s why it remains breakable, while the one-time pad, used correctly, is not.

References

1. Wikipedia. “Autokey cipher.” Available at: https://en.wikipedia.org/wiki/Autokey_cipher

2. Practical Cryptography. “Autokey Cipher.” Available at: http://practicalcryptography.com/ciphers/autokey-cipher/

3. Singh, Simon. “The Code Book.” Doubleday, 1999.