Calculator
2 × 2 only
View inverse
Enter matching prepared plaintext and ciphertext. Do not include unencrypted filler assumptions: if the message was padded before it was encrypted, give the padded text.
A demonstration. Suppose an attacker can have blocks of their own choosing encrypted and see the result. The target is the key set in Encrypt mode; it is only kept out of sight here, not secret, since it is in this page all along.
Automatic recovery from short ciphertext is unreliable.
Background searching is not available here, most likely because this page was opened as a file instead of from a web server. The search still works, but the page pauses while it runs and it cannot be stopped.
Other candidates
Show recovery mathematics
Prepare the message
- Original
- —
- Working text
- —
- Blocks
- Plaintext blocks
Current block
How your message is transformed
| Block | Vector | Matrix result KP | mod 26 | Output |
|---|
Choose a row to see that block worked out above. Putting the cursor on a letter of your input chooses its block too.
Why must det(K) be invertible modulo 26?
Decryption multiplies by K⁻¹, so the key must have an inverse. A matrix has an inverse modulo 26 exactly when its determinant does, and a number has an inverse modulo 26 exactly when it shares no factor with 26: gcd(det(K), 26) = 1. Since 26 = 2 · 13, the determinant must be odd and not a multiple of 13.
When the gcd is not 1, several plaintext blocks share each ciphertext block and no rule can tell them apart. Take the matrix with rows (2, 4) and (2, 4): its determinant is 2 · 4 − 4 · 2 = 0, and it sends both AA and NA to AA.
How is the inverse matrix computed?
K⁻¹ = det(K)⁻¹ · adj(K) (mod 26). The adjugate adj(K) is the transpose of the matrix of cofactors, and it satisfies K · adj(K) = det(K) · I; multiplying by the inverse of the determinant modulo 26 turns that into the identity. For a 2×2 matrix with rows (a, b) and (c, d), the adjugate has rows (d, −b) and (−c, a).
Why does the Hill Cipher use blocks?
An n×n matrix multiplies a vector with n entries, so the letters are taken n at a time: a 2×2 key encrypts pairs of letters and a 3×3 key encrypts groups of three. Every letter of a ciphertext block is a mixture of all the letters of its plaintext block, which is what hides single-letter frequencies.
What happens to padding after decryption?
It is still there. Padding is added only to complete the last block, and decryption gives back exactly what was encrypted, padding included. A trailing X may be padding or may be a genuine letter of the message, so this calculator marks it as possible padding and deletes nothing. Ciphertext is never padded: if its length is not a multiple of the matrix size, letters are missing.
Can the key be recovered? Known-plaintext attacks
The Hill cipher is linear, and that is its weakness. If enough plaintext blocks and their ciphertext blocks are known, put them side by side as the columns of two matrices P and C; then C = KP, and whenever P is invertible modulo 26 the key is K = CP⁻¹ (mod 26). Break mode carries this attack out: the known-plaintext attack takes whatever blocks you have, and the chosen-plaintext attack picks the blocks that make P the identity, so that the ciphertext is the key itself.
Related topics
The Caesar, Affine, Vigenère and Substitution ciphers change one letter at a time, and the Playfair Cipher works on pairs with a square. The Hill cipher differs from them because it mixes several letters at once using linear algebra: the affine cipher's ax + b with a matrix in place of a.