Hill Climbing, rotor and keyboard unknown

• Find message key
• Known plaintext, math attack.
• Known plaintext, tables attack.
• Dawson method, unknown rotor
• Dawson's method, unknown rotor and keyboard
• Konheim's method
• Hill Climbing, unknown rotor
• Hill Climbing, unknown rotor and keyboard. This Page.
• Friedman's method v1, unknown rotor),
• Friedman's method v1, unknown Rotor and keyboard
• Friedman's method v1, unknown Rotor and lampboard
• Friedman's method v1, all permutations are unknown
• Friedman's method v2, unknown Rotor
• Messages in-depth
• Remove lampboard permutation

Introduction

We want to decipher a message encrypted by the Hebern 1 rotor machine for which not only the rotor wiring is unknown but also the Keyboard permutation is unknown. The Hill Climbing algorithm studied previously cannot be used as is.

In fact, the Keyboard permutation confuses the permutation carried out by the rotor… but in the end we obtain a simple substitution! It is therefore possible to use the Hill Climbing algorithm but with the IC (Index of Coincidence) fitness function. Then we just have to solve the resulting simple substitution.

Example

Consider the following cryptogram:

C:\H1_TOOLS> python groupe.py <  MSGS\p100.cry
XFSDO XIZYH SMDNJ NJILA FINJL SSEOY OPUZS LEPMT HDROS QFONJ
LWRZY TKIKQ LVQFK KVLEJ FDHIK IKROK YRDZT IVKAI PJRGY EATRT
KITYA JPYLB TENHW CDESC LHXWT RIBJP ZDSJU DTBZX FFRHT WTODD
FIOAT ZLWYU OEBLN SHRHH TPTJA ETDOZ QGMQP EAYGC GHPTI JUDKW
DMBTU WVULM LJSIG LNNWA JHBLE OEMTV AEVDX KTIUI WZWVM XMPQP
ZPOXH LUNQL XGGCZ YWZNS LXYAH LLODD TDXCN JQHZL PIJQN VRZPJ
HPZPO XHLUZ VXCKF LPIEZ GZWCO GRHTE OXTDD GSNLW TJUBQ QWSQW
UYOPZ POXHL UZVXL LQBLU APQNQ XPENH PSRXT DDGUS YSPYO TNZTS
BIPJH OZFKM WOOBZ CXOMC JNWZS QFXIH VXPQL WYIEA NLZXQ CXXND
WYNPO PXZBW BAQTX NFCDO WSSNP PTEEW JHZYR WZXIT PUSZX HPCUD
TGUGT RONUV NOFKJ SXBNW XUYIS IGFVB CFIUB NJOVB SRAIG GXFSB
RLZUE THREE VWVYO VJRUC JFXXX LPHZL NSQXU KELTJ AGKOY USCXX
PYOWG TGGLM BIHTE ZLATY DGJJR OWHPY ZDYUC AUBPP ZARKF ZDHSS
SKYIS CTUVF NIMET YVYGX HJAIN SYXHI UDTYV ZWFKQ VJHZO MTVDH
SSSKY ISCTL NSQXI ETPKW KYFXX MVAGL TEZDK SOQFX EUEDT IAQVR
TDZPG LTTOB NDGPN APUUB ZOZSF CMGGN LLSEP HNDAQ EXWMQ STEAB
FXKAI SPOQG LNNPY SWFNU NAWDM WHIAE ISXHL PVPLP WHNDJ UODMJ
OQHOO CGMOQ TBRLZ DVKWC DUHPZ SRZYO OGUSG LTQIH OLVNB MHORL
RWRCF YPHQJ DJTDU DTGYZ VXDHT LUWFT FHRDB SCKGM ZHZAL MAWJB
XXEQD ATDMZ NSYJT RKILL VTTDE IHLUW ZEFQB AFZCR FGWHJ SBKQH
OARGB OULWV AJTXU XMCBQ TMLUT IOBPN HZALW VNGQC UUEZP QKSBQ
EXMRP LWYGA URAAS NODYP IVIPZ FEVJO KYRTR IFIID ISSXG GBBTB
PNYMD XHHMI VDRRW AVZXU GVHXW ZEHGX PKOAR GRCYN AUSSR HXDRN
HZEHS XIKOA ZUAGT LRGQK RXDCW HGQBF YAWKT NGNRE TOXZV XLEAD
OZTBL HRWSI RPIZA GCXAS GMTXG CBAZA BQTDC QVJAS RJJJM USZXF
LDUHT SENIX UIRWU EOQTL MHTFL EQBLE ILLSR IYTHZ XINYT TUGQL
ZXEZU PAZXV CIOUT YRHKD TDOVW JMTSO XHAPY UQAWP XTZOV DJPIA
NASGM GBLTU PRWXO NBDKN EUEYA EZJRX QYRPJ SFUAC SOH

We carry out an HC attack using the IC fitness function (used by default):

C:\H1_TOOLS> python  hc_h1.py -c MSGS\p100.cry
0 0.07039714170194156 WFZDZJDZYLELDYIZPOBOLYVJTZDBSFZWFZ...

We save the solution in a file (MSGS\p100_mono_hc.cry) and we carry out a HC attack but against a simple substitution. Of course, we could find the solution manually.

C:\H1_TOOLS> python  hc_substi.py -c MSGS\p100_mono_hc.cry -M BIG -m english -t 5
0 7.578662544189707 THEREARENOBORNDECISIONMAKERSWHETHERWELIKEITORNOTMA
1 7.578662544189707 THEREARENOBORNDECISIONMAKERSWHETHERWELIKEITORNOTMA
2 7.578662544189707 THEREARENOBORNDECISIONMAKERSWHETHERWELIKEITORNOTMA
3 6.922842519889452 ANTETDETORCREOFTWISIROLDMTESGNTANTEGTHIMTIAREORALD
4 7.578662544189707 THEREARENOBORNDECISIONMAKERSWHETHERWELIKEITORNOTMA

Cles:  JEPIZUKFONTAVYLGRDBWMHSCXQ  Score:  7.578662544189707
THEREARENOBORNDECISIONMAKERSWHETHERWELIKEITOR
NOTMAKINGACHOICEISAP...