Cryptography is as old as the need to send a message that an outsider cannot read. Its history is more than a curiosity: every era left a lesson that still applies today, whenever we encrypt a disk or open a website over HTTPS.
Ancient ciphers: substitution and shifting
The cipher attributed to Julius Caesar is the best-known example: each letter is replaced by the one a fixed number of positions further along the alphabet. With a shift of three, A becomes D, B becomes E and so on. The message "ATTACK" becomes "DWWDFN".
The flaw is obvious: there are only a couple of dozen possible shifts, and anyone can try them all in a few minutes. It is the first example of what we now call a brute-force attack: if the key space is small, keeping the algorithm secret is not enough.
A step forward was monoalphabetic substitution, in which each letter is replaced by another according to an arbitrary table. The number of combinations becomes enormous, yet the system still falls. The reason is frequency analysis: in English, E, T and A appear far more often than Q or Z, and this regularity survives substitution. By counting the most frequent symbols in the ciphertext, you quickly work back to the original letters.
First lesson: a huge key is useless if the cipher lets the structure of the text show through.
Polyalphabetic ciphers
To hide frequencies, the Renaissance saw the spread of polyalphabetic ciphers, the most famous being the one known as the Vigenère cipher (actually described earlier by Giovan Battista Bellaso). A keyword is used, and each letter of the message is shifted by a different amount depending on the corresponding letter of the key. The same plaintext E can turn into different letters in the ciphertext.
For centuries it was considered unbreakable, but in the nineteenth century cryptanalysts worked out how to attack it: if the key repeats, patterns repeat too. Once the key length is found, the cipher breaks down into many small Caesar ciphers, each vulnerable to frequency analysis.
Second lesson: repetition is the enemy of secrecy. Many practical mistakes today still come from reusing keys or values that are supposed to be unique.
The perfect cipher and its price
In the early twentieth century the one-time pad was formalised: a random key as long as the message, used only once. If these conditions hold, the ciphertext reveals nothing about the message, and this can be proven mathematically.
The problem is practical: you must generate, distribute and protect keys as long as every message you will ever send, and never reuse them. That is why the one-time pad has remained limited to very specific uses. Third lesson: theoretical security is worthless if key management is impractical.
Enigma: the machine that seemed invincible
In the 1920s and 1930s cryptography became mechanical. The Enigma machine, used by the German armed forces during the Second World War, combined rotors, a reflector and a plugboard. Each key press advanced the rotors, so the substitution changed with every letter. The number of possible starting configurations was astronomical.
Yet Enigma was broken. Polish mathematicians, led by Marian Rejewski, reconstructed how it worked as early as the 1930s. The work continued at Bletchley Park in England, where Alan Turing and many others designed electromechanical machines to speed up the search for the daily settings.
Success did not come from a shortage of keys, but from design and usage details:
- a letter could never be encrypted as itself, which made it possible to discard many hypotheses;
- operators used repetitive phrases, such as headers and weather reports, which supplied fragments of known plaintext;
- some procedures, such as repeating the message key, created exploitable patterns.
Fourth lesson: a cryptographic system is only as strong as its weakest link, and that link is often human usage.
The computer age and public keys
In the 1970s the US standard DES became the benchmark for commercial encryption; its 56-bit key, adequate at the time, was later made insufficient by growing computing power. Its successor, AES, is now the most widely used standard in the world.
The real revolution, however, was conceptual. In 1976 Whitfield Diffie and Martin Hellman published the idea of two parties agreeing on a secret key while communicating over a public channel. Shortly afterwards came RSA, the first practical public-key system for encrypting and signing. For the first time, people no longer needed to meet to exchange a secret: this is the foundation of HTTPS, digital signatures and encrypted chats.
The principle that runs through it all
In the nineteenth century Auguste Kerckhoffs stated a principle that is now a golden rule: a system must remain secure even if the enemy knows everything about how it works, except the key. Modern algorithms are public, studied by thousands of researchers, and that is precisely why they can be trusted. Be wary of anyone offering "secret, proprietary encryption" as a guarantee of security.
In short
- Ancient ciphers fell because of small key spaces or because they let the text's letter frequencies show through.
- Repeated keys and patterns ruined many systems, from Vigenère to Enigma.
- Enigma was broken mainly thanks to design flaws and predictable operating procedures.
- Public-key cryptography made it possible to communicate securely without meeting first.
- Kerckhoffs's principle still holds: security must depend on the key, not on keeping the algorithm secret.
