Known-Plaintext Attacks on the Vigenère Cipher
A known-plaintext attack begins with something a ciphertext-only attack does not have: part of the original message and the ciphertext produced from that same part of the message.
Against the Vigenère cipher, that information is especially powerful because the key shift used at each known position can be calculated directly.
If a plaintext letter P and its corresponding ciphertext letter C are known, the Vigenère key value at that position is:
There is no need to infer that key letter from frequency statistics. The plaintext-ciphertext pair reveals it.
What happens next depends on the structure of the key. In the traditional repeating-key Vigenère cipher, a recovered segment of the keystream can expose other positions that use the same recurring key letters.
If you already know the complete key, the Vigenère Cipher Decoder and Encoder can decrypt the message directly. A known-plaintext attack matters when only some message content is known and the key is still secret.
One known word can reveal several key letters
Consider this ciphertext:
Suppose independent information confirms that ciphertext positions 12 through 17 correspond to the plaintext word:
Align the known plaintext with those ciphertext letters:
Using A=0 through Z=25, subtract each plaintext value from its ciphertext value modulo 26.
| Position | Plaintext | Ciphertext | Calculation | Recovered key letter |
|---|---|---|---|---|
| 12 | B = 1 | F = 5 | 5 – 1 = 4 | E |
| 13 | R = 17 | F = 5 | 5 – 17 ≡ 14 mod 26 | O |
| 14 | I = 8 | Z = 25 | 25 – 8 = 17 | R |
| 15 | D = 3 | D = 3 | 3 – 3 = 0 | A |
| 16 | G = 6 | T = 19 | 19 – 6 = 13 | N |
| 17 | E = 4 | K = 10 | 10 – 4 = 6 | G |
The known word has revealed this six-character keystream segment:
That is already secret key material. But it is not yet safe to assume that the keyword itself is literally EORANG.
Recovering a keystream segment is not always the same as recovering the keyword
The distinction matters because the known plaintext fragment may begin in the middle of the repeating key cycle.
In the example above, the first recovered letter came from ciphertext position 12.
Suppose separate analysis has established that the Vigenère period is 6.
The key positions repeat like this:
Position 12 corresponds to key position 6. Positions 13 through 17 then correspond to key positions 1 through 5.
So the recovered segment:
maps onto the six key positions as:
The repeating keyword is therefore:
Why the subtraction works
Vigenère encryption can be written as:
where:
If both P and C are known, rearrange the equation:
For example, take the first pair from the known word:
Nothing statistical is happening here. The corresponding plaintext and ciphertext values determine the shift exactly.
This is why a known-plaintext attack is fundamentally different from trying to infer a Vigenère key from ciphertext frequencies.
How much known plaintext is enough?
There is no single number that applies to every situation.
One known plaintext letter reveals one keystream letter at one position.
Three known consecutive letters reveal three consecutive keystream values.
If the repeating period is known to be 6 and the attacker knows six consecutive plaintext-ciphertext pairs spanning all six key phases, every key position can be recovered.
| Known information | What it can reveal |
|---|---|
| 1 aligned plaintext character | One key shift at one recurring position |
| Several aligned characters | A segment of the keystream |
| A continuous fragment at least as long as the known period | Potentially every key position |
| Several separate known fragments | Potentially different missing positions in the key cycle |
Length alone is not the only issue. What matters is which key positions the known plaintext covers.
Several short fragments at different offsets may collectively expose the whole repeating key even when no single fragment is as long as the period.
A longer known fragment can expose the repetition itself
Suppose the key period is not known in advance, but enough corresponding plaintext and ciphertext are available to recover a long stretch of the keystream.
If subtraction produces:
the repeating structure is visible directly.
Even a less convenient alignment may reveal:
The analyst can inspect the recovered sequence for a shorter repeating period and then map the characters back to their absolute key positions.
This means known plaintext can sometimes help with both stages of the problem:
That route is different from estimating the period from ciphertext statistics alone.
Knowing the text is not enough if you do not know where it aligns
The direct formula assumes that each known plaintext character is paired with its actual ciphertext character.
Suppose you are confident that the word BRIDGE occurs somewhere in the message, but you do not know its exact location.
Aligning it with the first six ciphertext letters:
Moving it one position:
Moving again:
Every alignment produces some sequence of key letters because modular subtraction always produces a result.
The existence of a recovered sequence therefore does not prove that the alignment is correct.
The correct position must be validated by additional evidence: repeating key consistency, other known text, the expected period, or whether the resulting key decrypts the rest of the ciphertext sensibly.
Known plaintext and a guessed crib are not exactly the same
The distinction is useful because the two situations carry different levels of confidence.
In a strict known-plaintext scenario, the attacker has reliable plaintext and its corresponding ciphertext.
For example, a document may contain a header whose original text is already available elsewhere, or both encrypted and unencrypted versions of part of a message may have been obtained.
A crib is usually a suspected piece of plaintext rather than one known with certainty.
An analyst might suspect that a message contains a common greeting, date, location, protocol phrase, or repeated report heading.
| Situation | Starting assumption | What must be verified? |
|---|---|---|
| Known plaintext | The plaintext-ciphertext pair is reliable. | How the recovered key material extends to the rest of the cipher. |
| Guessed crib | The plaintext fragment may or may not be correct. | The text itself, its alignment, and the resulting key consistency. |
The arithmetic is the same once a candidate fragment is aligned, but the strength of the evidence is not.
Known plaintext is also different from chosen plaintext
These attack models are related but should not be merged into one term.
In a known-plaintext attack, the attacker obtains plaintext-ciphertext pairs that already exist.
In a chosen-plaintext setting, the attacker can cause selected plaintext to be encrypted and observe the resulting ciphertext.
Against a simple Vigenère construction, chosen plaintext can be even more direct because the attacker controls the input.
For example, a plaintext consisting entirely of A characters has numerical value zero at every position:
Since:
and P=0, the ciphertext letters directly reproduce the Vigenère keystream.
That is a chosen-plaintext scenario, not merely known plaintext, because the attacker selected the message that was encrypted.
Alignment errors can produce a completely wrong key
Correct plaintext letters paired with the wrong ciphertext positions produce valid-looking but incorrect key letters.
This can happen even when the starting position is known if the analyst and the original encryption process handle nonalphabetic characters differently.
Suppose the displayed plaintext is:
One implementation may advance the Vigenère key only on alphabetic characters:
Another custom implementation might consume a key position for spaces or other symbols.
If the analyst assumes the wrong rule, the recovered keystream becomes misaligned after the first affected character.
Before subtracting long plaintext fragments, normalize them according to the same alphabet and key-advancement convention used by the cipher.
Partial key recovery can extend beyond the known fragment
The most damaging property of traditional Vigenère in this attack model is not merely that known plaintext reveals the shifts used for those particular letters.
The shifts repeat.
If key position 3 is recovered as A, every message position that uses key position 3 receives that same shift.
With a six-letter period:
One recovered key letter can therefore decrypt many ciphertext characters outside the known plaintext fragment.
If enough different key positions are recovered, large portions of the message can become readable before the complete key has been reconstructed.
Partial plaintext may then provide additional confirmation about the remaining key positions.
Reusing the same Vigenère key increases the value of known plaintext
If several messages use the same repeating keyword and the key starts from the same phase, recovered key positions from one message can be applied to corresponding positions in the others.
For example, if the first four key letters have been recovered as:
those four shifts can be used immediately wherever the same four key phases recur in every message encrypted under that arrangement.
Additional known plaintext from another ciphertext may reveal the two missing positions.
This is why repeated key material is especially problematic: information learned in one place does not necessarily stay confined to that one ciphertext.
A wrong plaintext guess can still produce a convincing-looking key
Modular subtraction always maps a plaintext-ciphertext pair to some letter value.
If the plaintext guess is wrong, the calculation does not display an error message. It simply produces the wrong key sequence.
That sequence may even contain recognizable fragments by chance.
A candidate key recovered from uncertain plaintext should therefore be tested against evidence that was not used to create it.
Useful checks include:
| Check | What it tests |
|---|---|
| Repeat consistency | Do recovered letters agree when the same key position appears again? |
| Independent known fragment | Does the candidate key explain another plaintext-ciphertext pair? |
| Full-message decryption | Does extending the candidate key produce coherent plaintext elsewhere? |
| Period consistency | Does the recovered sequence fit the independently suspected repeating period? |
Validation matters most when the starting plaintext was a guess rather than a confirmed known pair.
What known plaintext cannot automatically tell you
A known fragment is powerful, but its value should not be overstated.
If the fragment reveals only three key positions of a twelve-position period, the other nine shifts remain unknown.
If the exact ciphertext alignment is unknown, several placements may need to be tested.
If the keystream does not repeat in the assumed way, recovered key material from one location may not apply to later positions.
And if the supposed plaintext was only a guess, the entire result may rest on a false premise.
Where known-plaintext analysis fits in a Vigenère attack
Ciphertext-only methods try to learn structure from the encrypted text itself.
Frequency analysis uses language statistics. Kasiski examination uses repeated sequences. Coincidence methods use probability and periodic behavior.
Known plaintext changes the problem because some of the plaintext is no longer unknown.
For those positions, key recovery becomes direct arithmetic:
That is why known plaintext is such strong evidence against the traditional repeating-key Vigenère cipher. The cipher does not merely leak a statistical clue. At aligned known positions, the plaintext and ciphertext directly determine the keystream values used to connect them.
For the wider sequence of period discovery, key recovery, and decryption when no plaintext is known in advance, see How to Break the Vigenère Cipher .
