View source for Caesar cipher

{{short description|Simple and widely known encryption technique}}
{{featured article}}
[[File:Caesar cipher left shift of 3.svg|thumb|The action of a Caesar cipher is to replace each plaintext letter with a different one a fixed number of places down the alphabet. The cipher illustrated here uses a left shift of 3, so that (for example) each occurrence of {{mono|E}} in the plaintext becomes {{mono|B}} in the ciphertext.]]
<!--
{{Infobox cipher
| image          = [[Image:Caesar cipher left shift of 3.svg|320px]]
| caption        = Unicorn The action a Caesar cipher is to replace each plaintext letter with a different one a fixed number of places down the alphabet. The cipher illustrated here uses a left shift of three, so that (for example) each occurrence of {{mono|E}} in the plaintext becomes {{mono|B}} in the ciphertext.

| designers      = 
| publish date   =

| series         = 
| derived from   = 
| derived to     = 
| related to     = 
| certification  =

| key size       = 
| security claim = 
| block size     = 
| structure      = [[substitution cipher]]
| rounds         = 
| cryptanalysis  = Susceptible to [[frequency analysis]] and brute force attacks.
}}
-->

In [[cryptography]], a '''Caesar cipher''', also known as '''Caesar's cipher''', the '''shift cipher''', '''Caesar's code''', or '''Caesar shift''', is one of the simplest and most widely known [[encryption]] techniques. It is a type of [[substitution cipher]] in which each letter in the [[plaintext]] is replaced by a letter some fixed number of positions down the [[alphabet]]. For example, with a left shift of 3, {{mono|D}} would be replaced by {{mono|A}}, {{mono|E}} would become {{mono|B}}, and so on.<ref>{{cite web|first = James|last = Smith|work = Golang Project Structure|title = Writing Secret Messages With a Caesar Cipher|url = https://golangprojectstructure.com/caesar-cipher-secret-messages/|date = 2021-11-30|access-date = 2024-10-20}}</ref> The method is named after [[Julius Caesar]], who used it in his private correspondence.

The encryption step performed by a Caesar cipher is often incorporated as part of more complex schemes, such as the [[Vigenère cipher]], and still has modern application in the [[ROT13]] system. As with all single-alphabet substitution ciphers, the Caesar cipher is easily broken and in modern practice offers essentially no [[communications security]].

==Example==
The transformation can be represented by aligning two alphabets; the cipher is the plain alphabet rotated left or right by some number of positions. For instance, here is a Caesar cipher using a left rotation of three places, equivalent to a right shift of 23 (the shift parameter is used as the [[key (cryptography)|key]]):

{{Aligned table|cols=27|class=wikitable|col1header=on
|  Plain|  A|B|C|D|E|F|G|H|I|J|K|L|M|N|O|P|Q|R|S|T|U|V|W|X|Y|Z
|  Cipher| X|Y|Z|A|B|C|D|E|F|G|H|I|J|K|L|M|N|O|P|Q|R|S|T|U|V|W
}}

When encrypting, a person looks up each letter of the message in the "plain" line and writes down the corresponding letter in the "cipher" line.
 
 Plaintext:  THE QUICK BROWN FOX JUMPS OVER THE LAZY DOG
 Ciphertext: QEB NRFZH YOLTK CLU GRJMP LSBO QEB IXWV ALD

Deciphering is done in reverse, with a right shift of 3.

The encryption can also be represented using [[modular arithmetic]] by first transforming the letters into numbers, according to the scheme, A → 0, B → 1, ..., Z → 25.<ref>{{cite journal |last=Luciano |first=Dennis |author2=Gordon Prichett |date=January 1987 |title=Cryptology: From Caesar Ciphers to Public-Key Cryptosystems |journal=The College Mathematics Journal |volume=18 |issue=1 |pages=2–17 |doi=10.2307/2686311 |jstor=2686311 |citeseerx=10.1.1.110.6123 }}</ref> Encryption of a letter ''x'' by a shift ''n'' can be described mathematically as,<ref>{{cite book |title=Cryptology Unlocked |url=https://archive.org/details/Cryptology_Unlocked |last=Wobst |first=Reinhard |year=2001 |publisher=Wiley |isbn=978-0-470-06064-3 |page=19 }}</ref><ref>{{cite web |title=Caesar Cipher |url=https://solidify.software/posts/caesar-cipher |website=Solidify Software |access-date=2025-06-21}}</ref>

: <math>E_n(x) = (x + n) \mod {26}.</math>

Decryption is performed similarly,

: <math>D_n(x) = (x - n) \mod {26}.</math>

(Here, "mod" refers to the [[modulo operation]]. The value ''x'' is in the range 0 to 25, but if {{nowrap|''x'' + ''n''}} or {{nowrap|''x'' − ''n''}} are not in this range then 26 should be added or subtracted.)

The replacement remains the same throughout the message, so the cipher is classed as a type of ''[[monoalphabetic substitution]]'', as opposed to ''[[polyalphabetic substitution]]''.

==History and usage==
{{See also|History of cryptography}}
[[File:Bust of Julius Caesar from History of the World (1902).png|thumbnail|The Caesar cipher is named for [[Julius Caesar]], who used an alphabet where decrypting would shift three letters to the left.]]
The Caesar cipher is named after [[Julius Caesar]], who, according to [[Lives of the Twelve Caesars|Suetonius]], used it with a shift of three (A becoming D when encrypting, and D becoming A when decrypting) to protect messages of military significance.<ref>{{cite book|author=[[Suetonius]]|url=http://thelatinlibrary.com/suetonius/suet.caesar.html#56|title= Vita Divi Julii |chapter=56.6|lang=la}}</ref> While Caesar's was the first recorded use of this scheme, other substitution ciphers are known to have been used earlier.<ref>{{cite web|title=Cracking the Code|url=https://www.cia.gov/news-information/featured-story-archive/2007-featured-story-archive/cracking-the-code.html|website=Central Intelligence Agency|access-date=21 February 2017|archive-url=https://web.archive.org/web/20201226065538/https://www.cia.gov/news-information/featured-story-archive/2007-featured-story-archive/cracking-the-code.html|archive-date=26 December 2020}}</ref><ref>{{cite book |title=[[The Code Book]] |last=Singh |first=Simon |author-link=Simon Singh |year=2000 |publisher=Anchor |isbn=0-385-49532-3 |pages=[https://archive.org/details/codebook00simo/page/289 289-290] }}</ref>
{{Blockquote|"If he had anything confidential to say, he wrote it in cipher, that is, by so changing the order of the letters of the alphabet, that not a word could be made out. If anyone wishes to decipher these, and get at their meaning, he must substitute the fourth letter of the alphabet, namely D, for A, and so with the others."|[[Suetonius]]|''[[Life of Julius Caesar]]'' 56}}
His nephew, [[Augustus Caesar|Augustus]], also used the cipher, but with a right shift of one, and it did not wrap around to the beginning of the alphabet:
{{Blockquote|"Whenever he wrote in cipher, he wrote B for A, C for B, and the rest of the letters on the same principle, using AA for Z."|[[Suetonius]]|''[[Life of Augustus]]'' 88}}
Evidence exists that Julius Caesar also used more complicated systems,<ref>{{cite journal |last=Reinke |first=Edgar C. |date=December 1962 |title=Classical Cryptography |journal=The Classical Journal |volume=58 |issue=3 |page=114 }}</ref> and one writer, [[Aulus Gellius]], refers to a (now lost) treatise on his ciphers:
{{Blockquote|"There is even a rather ingeniously written treatise by the grammarian Probus concerning the secret meaning of letters in the composition of Caesar's epistles."|[[Aulus Gellius]]|''Attic Nights 17.9.1–5''}}

It is unknown how effective the Caesar cipher was at the time; there is no record at that time of any techniques for the solution of simple substitution ciphers. The earliest surviving records date to the 9th-century works of [[Al-Kindi]] in the [[Arab]] world with the discovery of [[frequency analysis]].<ref>{{cite book |title=[[The Code Book]] |last=Singh |first=Simon |author-link=Simon Singh |year=2000 |publisher=Anchor |isbn=0-385-49532-3 |pages=[https://archive.org/details/codebook00simo/page/14 14–20] }}</ref>

A piece of text encrypted in a [[Hebrew language|Hebrew]] version of the Caesar cipher not to be confused with [[Atbash]], is sometimes found on the back of Jewish [[mezuzah]] scrolls. When each letter is replaced with the letter before it in the [[Hebrew alphabet]] the text translates as "[[YHWH]], our God, YHWH", a quotation from the main part of the scroll.<ref>{{cite book |last1=Eisenberg |first1=Ronald L. |title=Jewish Traditions |date=2004 |publisher=Jewish Publication Society |location=Philadelphia |isbn=9780827610392 |pages=582 |edition=1st}}</ref><ref>{{cite book |last1=Sameth |first1=Mark |title=The Name : a history of the dual-gendered Hebrew name for God |date=2020 |publisher=Wipf & Stock |location=Eugene, Oregon |isbn=9781532693830 |pages=5–6}}</ref>

In the 19th century, the personal advertisements section in newspapers would sometimes be used to exchange messages encrypted using simple cipher schemes. [[David Kahn (writer)|David Kahn]] (1967) describes instances of lovers engaging in secret communications enciphered using the Caesar cipher in ''[[The Times]]''.<ref>{{cite book |title=The Codebreakers |last=Kahn |first=David |author-link=David Kahn (writer) |year=1967 |isbn=978-0-684-83130-5 |pages=775–6 }}</ref> Even as late as 1915, the Caesar cipher was in use: the Russian army employed it as a replacement for more complicated ciphers which had proved to be too difficult for their troops to master; German and Austrian [[Cryptanalysis|cryptanalysts]] had little difficulty in decrypting their messages.<ref>{{cite book |title=The Codebreakers |last=Kahn |first=David |author-link=David Kahn (writer) |year=1967 |isbn=978-0-684-83130-5 |pages=631–2 }}</ref>
[[File:Confederate cipher disk.jpg|alt=Caesar cipher can be constructed into a disk with outer rotating wheel as plain text and the inner fixed wheel as cipher text. Both outer and inner plates should have alphabets in the same direction. |thumb|Caesar cipher translated to a disk has both outer and inner plates having alphabets in the same direction and not the reverse as seen in CipherDisk2000.]]
Caesar ciphers can be found today in children's toys such as [[secret decoder ring]]s. A Caesar shift of thirteen is also performed in the [[ROT13]] [[algorithm]], a simple method of obfuscating text widely found on [[Usenet]] and used to obscure text (such as joke punchlines and story [[Spoiler (media)|spoilers]]), but not seriously used as a method of encryption.<ref>{{cite book |title=Cryptology Unlocked |url=https://archive.org/details/Cryptology_Unlocked |last=Wobst |first=Reinhard |year=2001 |publisher=Wiley |isbn=978-0-470-06064-3 |page=20 }}</ref>

The [[Vigenère cipher]] uses a Caesar cipher with a different shift at each position in the text; the value of the shift is defined using a repeating keyword.<ref>{{cite book |title=The Codebreakers |last=Kahn |first=David |author-link=David Kahn (writer) |year=1967 |pages=148–149 |isbn=978-0-684-83130-5 }}</ref> If the keyword is as long as the message, is chosen at [[randomly|random]], never becomes known to anyone else, and is never reused, this is the [[one-time pad]] cipher, proven unbreakable. However the problems involved in using a random key as long as the message make the one-time pad difficult to use in practice. Keywords shorter than the message (e.g., "[[Vigenère cipher#History|Complete Victory]]" used by the [[Confederate States of America|Confederacy]] during the [[American Civil War]]), introduce a cyclic pattern that might be detected with a statistically advanced version of frequency analysis.<ref>{{cite book |title=The Codebreakers |last=Kahn |first=David |author-link=David Kahn (writer) |year=1967 |pages=398–400 |isbn=978-0-684-83130-5 }}</ref>

In April 2006, fugitive [[Sicilian Mafia|Mafia]] boss [[Bernardo Provenzano]] was captured in [[Sicily]] partly because some of his messages, clumsily written in a variation of the Caesar cipher, were broken. Provenzano's cipher used numbers, so that "A" would be written as "4", "B" as "5", and so on.<ref>{{cite news |first=John |last=Leyden |title=Mafia boss undone by clumsy crypto |url=https://www.theregister.co.uk/2006/04/19/mafia_don_clueless_crypto/ |work=[[The Register]] |date=2006-04-19 |access-date=2008-06-13 }}</ref>

In 2011, Rajib Karim was convicted in the United Kingdom of "terrorism offences" after using the Caesar cipher to communicate with Bangladeshi Islamic activists discussing plots to blow up [[British Airways]] planes or disrupt their IT networks.  Although the parties had access to far better encryption techniques (Karim himself used [[Pretty Good Privacy|PGP]] for data storage on computer disks), they chose to use their own scheme (implemented in [[Microsoft Excel]]), rejecting a more sophisticated code program called [[Mujahedeen Secrets]] "because 'kaffirs', or non-believers, know about it, so it must be less secure".<ref>{{cite news |title=BA jihadist relied on Jesus-era encryption |url=https://www.theregister.co.uk/2011/03/22/ba_jihadist_trial_sentencing/ |work=[[The Register]] |date=2011-03-22 |access-date=2011-04-01 }}</ref>

==Breaking the cipher==
{| class="wikitable" align="right" style="margin: 0 0 1em 1em"
! Decryption<br>shift
! Candidate plaintext
|- align="center"
| 0
| {{mono|exxegoexsrgi}}
|- align="center"
| 1
| {{mono|dwwdfndwrqfh}}
|- align="center" 
| 2
| {{mono|cvvcemcvqpeg}}
|- align="center"
| 3
| {{mono|buubdlbupodf}}
|- align="center"
| bgcolor="#ffebad" | 4
| bgcolor="#ffebad" | {{mono|attackatonce}}
|- align="center" 
| 5
| {{mono|zsszbjzsnmbd}}
|- align="center"
| 6
| {{mono|yrryaiyrmlac}}
|- align="center"
| colspan="2" | ...
|- align="center"
|  23
| {{mono|haahjrhavujl}}
|- align="center"
| 24
| {{mono|gzzgiqgzutik}}
|- align="center"
| 25
| {{mono|fyyfhpfytshj}}
|}
The Caesar cipher can be easily broken even in a [[ciphertext-only attack|ciphertext-only scenario]]. Since there are only a limited number of possible shifts (25 in English), an attacker can mount a [[brute force attack]] by deciphering the message, or part of it, using each possible shift. The correct description will be the one which makes sense as English text.<ref>{{cite book |title=Cryptology |last=Beutelspacher |first=Albrecht |author-link=Albrecht Beutelspacher |year=1994 |publisher=[[Mathematical Association of America]] |isbn=0-88385-504-6 |pages=8–9 }}</ref> An example is shown on the right for the ciphertext "{{mono|exxegoexsrgi}}"; the candidate plaintext for shift four "{{mono|attackatonce}}" is the only one which makes sense as English text. Another type of brute force attack is to write out the alphabet beneath each letter of the ciphertext, starting at that letter. Again the correct decryption is the one which makes sense as English text. This technique is sometimes known as "completing the plain component".<ref>{{cite journal |last=Leighton |first=Albert C. |date=April 1969 |title=Secret Communication among the Greeks and Romans |journal=Technology and Culture |volume=10 |issue=2 |pages=139–154 |doi=10.2307/3101474 |jstor=3101474 }}</ref><ref>{{cite book |title=Elementary Cryptanalysis: A Mathematical Approach |last=Sinkov |first=Abraham |author-link=Abraham Sinkov |author2=Paul L. Irwin |year=1966 |publisher=Mathematical Association of America |isbn=0-88385-622-0 |pages=13–15 }}</ref>

[[File:English letter frequency percentages.png|alt=|left|thumb|The distribution of letters in a typical sample of English language text has a distinctive and predictable shape. A Caesar shift "rotates" this distribution, and it is possible to determine the shift by examining the resultant frequency graph.]]
Another approach is to match up the frequency distribution of the letters. By graphing the frequencies of letters in the ciphertext, and by knowing the expected distribution of those letters in the original language of the plaintext, a human can easily spot the value of the shift by looking at the displacement of particular features of the graph. This is known as [[frequency analysis]]. For example, in the English language the plaintext frequencies of the letters {{mono|E}}, {{mono|T}}, (usually most frequent), and {{mono|Q}}, {{mono|Z}} (typically least frequent) are particularly distinctive.<ref>{{cite book |title=The Code Book |last=Singh |first=Simon |author-link=Simon Singh |year=2000 |publisher=Anchor |isbn=0-385-49532-3 |pages=[https://archive.org/details/codebook00simo/page/72 72–77] |url=https://archive.org/details/codebook00simo/page/72 }}</ref> Computers can automate this process by assessing the similarity between the observed frequency distribution and the expected distribution. This can be achieved, for instance, through the utilization of the [[chi-squared statistic]]<ref>{{cite web |url=http://www.cs.trincoll.edu/~crypto/historical/caesar.html |title=The Caesar Cipher |access-date=2008-07-16 |last=Savarese |first=Chris |author2=Brian Hart |date=2002-07-15 |publisher=[[Trinity College (Connecticut)|Trinity College]] }}</ref> or by minimizing the sum of squared errors between the observed and known language distributions.<ref>{{cite web |url=https://raw.org/tool/caesar-cipher/ |title=Caesar Cipher Decryption |access-date=2024-04-02 |last=Eisele |first=Robert |date=2007-05-18 }}</ref>

The [[unicity distance]] for the Caesar cipher is about 2, meaning that on average at least two characters of ciphertext are required to determine the key.<ref>{{cite book |last1=Lubbe |first1=Jan C. A. |title=Basic Methods of Cryptography |date=12 March 1998 |publisher=Cambridge University Press |isbn=9780521555593 |pages=47–8}}</ref> In rare cases more text may be needed. For example, the words "{{mono|river}}" and "{{mono|arena}}" can be converted to each other with a Caesar shift, which means they can produce the same ciphertext with different shifts. However, in practice the key can almost certainly be found with at least 6 characters of ciphertext.<ref>{{cite book |last1=Pardo |first1=José Luis Gómez |title=Introduction to Cryptography with Maple |date=19 December 2012 |publisher=Springer Berlin Heidelberg |isbn=9783642321665 |page=5}}</ref>

With the Caesar cipher, encrypting a text multiple times provides no additional security. This is because two encryptions of, say, shift ''A'' and shift ''B'', will be equivalent to a single encryption with shift {{nowrap|''A'' + ''B''}}. In mathematical terms, the set of encryption operations under each possible key forms a [[group (mathematics)|group]] under [[Function composition|composition]].<ref>{{cite book |title=Cryptology Unlocked |url=https://archive.org/details/Cryptology_Unlocked |last=Wobst |first=Reinhard |year=2001 |publisher=Wiley |isbn=978-0-470-06064-3 |page=31}}</ref>
{{clear left}}

==See also==
* {{Annotated link|Scytale}}
{{clear}}

==Notes==
{{reflist}}

==Bibliography==
* {{Cite book |last=Kahn |first=David |url=https://archive.org/details/codebreakersstor0000kahn_k4s3 |title=The Codebreakers: The Story of Secret Writing |date=1996 |isbn=0-684-83130-9 |edition=Revised |location=New York |oclc=35159231 |url-access=registration}}
*  Chris Savarese and Brian Hart, ''[http://www.cs.trincoll.edu/~crypto/historical/caesar.html The Caesar Cipher]'', [[Trinity College (Connecticut)|Trinity College]], 1999

==Further reading==
* {{Cite book |last=Bauer |first=Friedrich Ludwig |title=Decrypted Secrets: Methods and Maxims of Cryptology |date=2000 |publisher=Springer |isbn=3-540-66871-3 |edition=2nd and extended |location=Berlin |oclc=43063275|ref=none}}

==External links==
{{commons category|Caesar ciphers}}
{{Wikifunctions|Z12812|Latin alphabet Caesar cipher}}
* {{MathWorld | urlname=CaesarsMethod | title=Caesar's Method |ref=none}}
* [https://ciphersonline.com/es/cifrado-cesar Use this decoder, Agent 2S.]

{{Cryptography navbox | classical|state=collapsed}}

[[Category:Classical ciphers]]
[[Category:Group theory]]
[[Category:Julius Caesar]]