Kasiski Examination: Find the Vigenère Key Length
Suppose you intercept this Vigenère ciphertext but do not know its key:
One sequence stands out: AVEGGX appears three times. Its occurrences begin at positions 1, 19, and 49.
Those positions are not enough to reveal the key, but the distances between them contain useful evidence:
All three distances are divisible by 6.
That observation is the basis of the Kasiski examination: repeated ciphertext sequences can reveal the period of a repeating-key Vigenère cipher because repetitions produced under the same part of the keystream tend to occur at distances divisible by that period.
The method does not normally hand you the key itself. Its immediate job is narrower and extremely useful: reduce an unknown key length to a small set of plausible periods.
You can use the Vigenère Cipher Decoder and Encoder to test known keys directly. Kasiski examination addresses the harder situation where the repeating key is not known.
Why repeated ciphertext can expose the key period
A traditional Vigenère cipher repeats its key when the message is longer than the keyword.
With a six-letter key, the same key positions recur every six encrypted letters:
Now imagine that the same plaintext sequence occurs twice in a message. If the second copy begins at the same point in that six-position key cycle, both plaintext copies are encrypted with the same sequence of shifts.
The resulting ciphertext sequences will therefore be identical.
For both occurrences to begin at the same key phase, the distance between their starting positions must be a multiple of the repeating period.
With a period of 6, distances such as 6, 12, 18, 24, 30, and 48 all return to the same point in the cycle.
Kasiski examination works backward from that relationship. The analyst does not know the period, but repeated ciphertext gives distances whose factors can point toward it.
Work the example from ciphertext alone
Return to the sample ciphertext:
Assume for the moment that this is all the analyst has. There is no plaintext and no known keyword.
Search for repeated sequences of three or more letters. The unusually useful repeat here is:
Record where each occurrence starts:
| Occurrence | Starting position |
|---|---|
| 1 | 1 |
| 2 | 19 |
| 3 | 49 |
Then calculate the pairwise distances between their starting positions.
| Occurrences compared | Distance | Useful factors |
|---|---|---|
| 1 → 2 | 18 | 2, 3, 6, 9, 18 |
| 2 → 3 | 30 | 2, 3, 5, 6, 10, 15, 30 |
| 1 → 3 | 48 | 2, 3, 4, 6, 8, 12, 16, 24, 48 |
Ignoring the trivial factor 1, the factors shared by all three distances are:
Kasiski examination therefore gives us several candidates rather than a single certain answer.
In this constructed example, the ciphertext was actually produced using a six-letter repeating key, so 6 is the correct period. But an analyst working honestly from the ciphertext should not assume that simply because 6 is the largest common factor.
Why a common factor is evidence, not proof
This is where a mechanical explanation of Kasiski examination can become misleading.
If a distance is 18, the key period is not automatically 18. The repetition would also align correctly for periods that divide 18, including 2, 3, 6, and 9.
One distance therefore gives a family of candidates.
Multiple independent repetitions are much more informative because the true period, or one of its factors, tends to recur across their spacing values.
This is why a useful Kasiski examination collects evidence rather than declaring a key length from the first repeated trigram it finds.
Do not blindly take the GCD of every distance
The greatest common divisor is useful in a clean example.
For the distances above:
That correctly identifies the true period.
Real ciphertext is less cooperative.
Some repeated sequences occur accidentally. Suppose several genuine repetitions give distances of 18, 30, and 48, but an unrelated three-letter sequence happens to repeat at a distance of 25.
If all four numbers are thrown into one GCD calculation:
The useful six-letter signal disappears even though the original three distances still strongly support it.
A more robust examination factors many distances and looks for factors that receive repeated support. GCD calculations remain useful for compatible groups of distances, but a single accidental repeat should not be allowed to erase the rest of the evidence.
| Approach | Useful when | Main risk |
|---|---|---|
| GCD of selected distances | The repetitions appear related and the data is relatively clean. | An accidental distance can reduce the GCD dramatically. |
| Factor-frequency analysis | Many repeated sequences and distances are available. | Small factors can receive support simply because they divide many numbers. |
| Use both | Normal practical analysis | Still requires verification rather than blind acceptance. |
Longer repeated sequences deserve more attention
Two-letter combinations repeat naturally, especially in a long ciphertext. A matching digram is therefore weak evidence by itself.
Three-letter and longer repetitions are usually more interesting. A long repeated sequence is less likely to have appeared purely by accident than a short one.
This does not mean every long repeat is genuine evidence of key alignment. Different plaintext and key combinations can occasionally produce the same ciphertext sequence.
Sequence length should therefore affect how much confidence you give a repeat, not whether you accept it automatically.
| Observed repeat | Typical evidential value |
|---|---|
| Single repeated letter | Essentially useless for Kasiski analysis |
| Repeated digram | Often too common to trust alone |
| Repeated trigram | A practical starting point |
| Repeated sequence of four or more letters | Generally more interesting, especially when supported by other repeats |
One long repeat can accidentally create many copies of the same evidence
There is another subtle problem when repeated sequences are collected automatically.
Suppose the six-letter sequence AVEGGX repeats twice. That same event automatically creates several shorter repeated sequences:
A program may report all of these as separate repeated n-grams.
They are not ten independent pieces of evidence. They are largely different views of the same underlying repetition.
Counting every overlapping substring as a separate vote can make one spacing look much more convincing than it really is.
When reviewing Kasiski results, group overlapping repetitions that occur at the same positions and recognize the longest meaningful match as the stronger observation.
This matters especially when software produces a large factor table. More rows in the output do not necessarily mean more independent evidence.
Measure the distance between starting positions
Kasiski spacing is normally measured from the start of one occurrence to the start of the next occurrence.
If a repeated sequence begins at positions 12 and 42:
The relevant distance is 30.
Do not subtract the length of the repeated sequence to calculate only the unused characters between the two copies. The key phase is determined by the positions where the sequences begin.
This distinction is easy to miss when the repeated blocks are being marked visually on paper.
Spaces and punctuation can distort your positions
The position count must match the symbols over which the Vigenère key actually advanced.
In a traditional A–Z treatment, ciphertext is often normalized to alphabetic characters before analysis:
If spaces and punctuation were preserved for display but did not consume key positions during encryption, counting them as part of the Kasiski distance produces incorrect spacing.
On the other hand, a custom implementation might advance its key across characters differently.
The rule is therefore not simply “always remove spaces.” The rule is: measure positions according to the symbol stream that consumed the repeating keystream.
When the encryption convention is unknown, the standard first assumption for classical Vigenère is usually to analyze the alphabetic ciphertext as a continuous stream.
Key length and key period are not always identical
Most explanations describe Kasiski examination as a method for finding the “key length.” In ordinary cases, that description is practical.
More precisely, the examination looks for the period of the repeating keystream.
Consider the written keyword:
It contains six letters, but its shift pattern is:
The actual pattern repeats every three positions.
From a cryptanalytic perspective, the effective period is therefore 3, not 6.
A Kasiski examination is likely to reveal evidence for that shorter fundamental period because that is the interval at which the substitutions truly repeat.
This is why “find the keyword length” should be understood as shorthand for finding the repeating period relevant to the cipher.
Why small factors often appear alongside the real period
Suppose several useful distances are multiples of 6:
The factor 6 appears repeatedly, but so do 2 and 3 because both divide every multiple of 6.
A factor-frequency table may therefore rank several related candidates highly.
| Candidate | Why it may appear often |
|---|---|
| 2 | Divides many even distances, including all multiples of 6. |
| 3 | Divides every distance that is a multiple of 6. |
| 6 | May be the actual period generating the aligned repetitions. |
| 12 or 18 | May appear because some observed spacings are multiples of the true period. |
The factor with the highest count is therefore not guaranteed to be the correct answer.
Kasiski analysis is best used to create a ranked set of plausible periods that can be tested against additional evidence.
How to verify a Kasiski candidate
Suppose the repeated-sequence evidence suggests possible periods of 2, 3, and 6.
Do not immediately choose one and start guessing a keyword.
Instead, test what each candidate predicts about the ciphertext.
If the period really is 6, taking every sixth ciphertext character should collect letters that were encrypted using the same Vigenère key position.
Each stream should behave more like text subjected to one fixed Caesar-style shift than the unsplit Vigenère ciphertext does.
Statistical methods can then be used to evaluate whether the candidate period produces plausible language-like streams.
That verification step matters because Kasiski examination is a candidate-generation method, not an oracle.
When Kasiski examination becomes unreliable
The method depends on useful repetitions appearing in the ciphertext. That requirement creates several natural limitations.
| Situation | Effect on Kasiski evidence |
|---|---|
| Very short ciphertext | There may be too few repeated sequences to infer a reliable period. |
| Long key relative to the message | Repeated plaintext is less likely to align with the same key phase more than once. |
| Few natural plaintext repetitions | The ciphertext may contain little genuine repeated-pattern evidence. |
| Many accidental short repeats | Factor counts become noisy and can promote false candidates. |
| Nonrepeating keystream | The periodic relationship Kasiski relies on is absent. |
A failed Kasiski examination therefore does not prove that the ciphertext is not Vigenère. It may simply mean the sample does not contain enough usable repetition.
Other statistical approaches can estimate the period without depending on visible repeated sequences in exactly the same way. Those methods are complementary rather than reasons to stretch Kasiski beyond what its evidence supports.
Where Kasiski fits in a complete Vigenère attack
Kasiski examination solves one stage of a larger problem.
At that point, the key itself may still be completely unknown.
What has changed is the structure of the problem. Instead of treating the ciphertext as one polyalphabetic stream, an analyst can separate it according to the suspected period and investigate each recurring key position.
That next stage belongs to the broader Vigenère cryptanalysis process , rather than to Kasiski examination itself.
Why the method was historically important
Friedrich Kasiski published his analysis of polyalphabetic ciphers in 1863. His published method showed that the repetition used to make a short keyword practical could itself reveal the cipher’s period.
Charles Babbage had independently worked out techniques for attacking Vigenère-type ciphers earlier, but his work was not published at the time. Kasiski’s name became attached to the repeated-sequence method because his treatment appeared publicly.
The wider development and attribution of the cipher are covered in the History of the Vigenère Cipher .
The important cryptanalytic idea remains simple: a repeating key leaves evidence of its repetition in sufficiently informative ciphertext. Kasiski examination turns that evidence into candidate periods by measuring where repeated sequences occur, rather than trying to guess the secret word directly.
