Affine cipher

What the affine cipher is

Number the alphabet A = 0, B = 1, through Z = 25. An affine cipher encodes a letter x as (a × x + b) mod 26, where a and b are the key and “mod 26” means divide by 26 and keep the remainder, so that the result lands back inside the alphabet. The shift b can be anything from 0 to 25. The multiplier a cannot: it must share no factor with 26, which rules out every even number and 13, leaving twelve choices. With a = 1 the cipher is a plain Caesar shift; with b = 0 it is a pure multiplication.

The reason a is restricted is that decoding needs to undo the multiplication, and that only works when a has a multiplicative inverse mod 26: a number that, multiplied by a, leaves a remainder of 1. For a = 5 the inverse is 21, because 5 × 21 = 105 = 4 × 26 + 1. For a = 3 it is 9, for a = 7 it is 15. If a were 2, two different letters could encode to the same ciphertext letter and the message could not be recovered. The name “affine” is borrowed from geometry, where an affine transformation is a scaling followed by a shift, which is exactly what the formula does to the alphabet.

Decoding is the formula run backwards: subtract b, multiply by the inverse of a, take mod 26. The arithmetic is small but there is a lot of it, and the mistakes kids make are arithmetic mistakes: forgetting to add 26 when a subtraction goes negative, multiplying by a instead of by its inverse, and mislabelling the alphabet by starting at A = 1. A written alphabet with its numbers, and the inverse worked out once and written at the top of the page, prevent nearly all of them.

If the key is not given, the cipher can still be broken, because it is monoalphabetic: each letter always encodes the same way, so frequency analysis applies. Guessing that the two most frequent ciphertext letters are E and T gives two equations in a and b, which solve by the same mod-26 arithmetic. With twelve possible multipliers and twenty-six shifts there are 312 keys in all, few enough that a patient solver could also just try them.

How to solve an Affine cipher

Number the alphabet A = 0 to Z = 25. Each plaintext letter is multiplied by a key number a, then a second key number b is added, and the result is taken mod 26 (divide by 26, keep the remainder). The multiplier a must share no factor with 26, so it is one of 1, 3, 5, 7, 9, 11, 15, 17, 19, 21, 23 or 25.

1. Write the alphabet with its numbers, A = 0 through Z = 25. Every step below is arithmetic on those numbers.
2. Find the inverse of a: the number from 1 to 25 that, multiplied by a, leaves a remainder of 1 when divided by 26. For a = 5 it is 21, because 5 × 21 = 105 = 4 × 26 + 1.
3. For each ciphertext letter, take its number, subtract b, multiply by the inverse, then take mod 26. If a subtraction goes negative, add 26 before you continue.
4. Turn each result back into a letter. Spaces and punctuation stay where they were.
5. If the key is not given, use the two most common ciphertext letters as E and T and solve the pair of equations for a and b; check the guess on a short word before applying it everywhere.

A worked example

Decode HWPC WU RAZ (a = 5, b = 8)

The inverse of 5 is 21 (5 × 21 = 105, and 105 − 104 = 1).
For each letter: (number − 8) × 21, then mod 26.

H = 7 → (7 − 8) × 21 = −21 → add 26 → 5 → F
W = 22 → (22 − 8) × 21 = 294 → 294 − 286 = 8 → I
P = 15 → (15 − 8) × 21 = 147 → 147 − 130 = 17 → R
C = 2 → (2 − 8) × 21 = −126 → add 130 → 4 → E

The same steps turn WU into IS and RAZ into HOT.
Plaintext: FIRE IS HOT

Affine in Codebusters

Among the Science Olympiad rule sets OlyPrep has read, the affine cipher does not appear on the elementary or Division B Codebusters lists; it is more commonly met at the high-school level and in introductory cryptography courses. It is in the open Cipher Lab because it is the natural next step after Caesar, and because the arithmetic habits it builds, numbering the alphabet, working mod 26, checking an answer by re-encoding, carry over to several ciphers that are on those lists.

Where it is tested, the key is usually given and the question is a decode: apply the inverse formula to each letter and recover the message. Scoring, where OlyPrep has seen it described, is by the letters of the decoded message with a small allowance for errors, so the aim is a clean pass through the arithmetic rather than speed.

The lab below hands out a fresh a and b with every challenge and shows the key beside the ciphertext. On the easy setting the key is always a = 5, b = 8, the same pair as the worked example above, so a student can follow the card line by line and then try a message of their own. Medium and hard draw any valid multiplier and any shift.

Practice the Affine cipher

The lab below is set to the Affine cipher alone. Pick a difficulty, generate a challenge, decode it, then check your answer or reveal the solution. It runs in your browser, needs no account, and is unlimited on every OlyPrep plan.

Where the Affine cipher is tested

None of the Science Olympiad rule sets OlyPrep has read names the affine cipher on its elementary or Division B Codebusters list. It is in the open lab as the step after Caesar.