多表代替密码破解初探

0x00.密文分析

第一次拿到这样一个txt文档，有7061个字节，由26个英文字母组成

ekfskkjxqhzjehueplxiroiitxegvltpuefdaiihvhehlenqhmxtnqsbblbtobporwfihmpotpehhahmalbwrifehqsblenqhmxhcjqmhtpehhaeuwmejlbxpkomkbhkblbtokfpmeikhehusippnxfajdtnmstriuvbpokhrpjrkxmtbgbioswpgtgeejkqeihjmjiftfkqeihosemgjfbhoirmrwimwpetfbtmkblbtoawtejgfeasqhclhjwoifefdeihmiagbblipdkspnusiltrgpbhmbtlbiehqsbadkfpnjcveoswlthathzqpotnptqikfpkptzjxirmrtxaopkcoiwgrqsbdhhbgtbspjcplptoikkotsepxnqqhhwsqhrmwrxwtmpdkqpmqsbhpoohnqefdenhhpalbwhhwsqhrmwrxwtmpdkqpmqsbdecwhcqsbhpoohtpmpedfptrdxeoejkdbinxqsbfthtifwmiambblbbtpehhtgrqsbnskegnjcremeoegegkqeihhhwsqhrmwrxwtmpdkqpmqsbhpoohfeubphhtdihpfxendthihckhuwlpxehqsbferpoiatutmpjibtgiafkqpmetfklipjboepxhhwsqhrmwrxwtmpdkqpmqsbhpoohtpmpedfdthbqtpsbiehqsbnhmhpmphctfboeetgnjitwoxtgraehimsefnwdctgbvefwehlenjvhdthithimiupuwiifpswlbqhrtxpjrmtfkqeywtnltgwcqdiihrtqeihehtmbhmbupstubnhgwoijqmhtpehhpikkeptdpjikpsknsbnbvlphqsbtlelepwipphcjqmopjrnfeivohpwoswfkbgtaeewgpuhmimiaoswiihmpeoqqeihthioswrbndkotpehhjcthrbkphiphnpplpxupmwmtbgthakklifenphmxgiqppjvseiswuboxkfpmeikhvkpoiatfdsbelplenhhpwvkptjohgembqskqtfdfbhxbpnftidfphtmvwdftmvlepwfbhvirdrgportmtgpwprqsbrgkdebhtadpmeasqmiadtapfenbooxtgrqsbkqmpqtqhcltjkehwmneotphaseirmpjrkxostokfpmeikltnipctqfqprjgplenklifenphmxgiqpthmiatmtmswleeotyphphcnhfjlkopejgewlhwrthmpwtrjcsjgioehbosemntimwrigdtbtpehhtfboeetskpatsphqsbhpoohjwhjdpkgtrnsbnbknsbnbvleelskpiifpatidftmcpregnrcceitwgpaqhimarovwlbaqnwoigpfepuwostoplpatgdjczrmpeibematgdoqjqvbopcrmbqhawdtwubqskqoswlbtlbegnrcceitwgpaqhimthoswamwtpstqdonjcikjiooqhepxhcqstpgkqeihthimiupstubnhgwointnlosemelpectelpecostovedfbeuwqnrjihrbfthioswltnsbphcalbwrifthioswmbnqmeoxjczrmpeibupstubtdnjiifppjosemstdfjvbimjjopjlbfehitgwltntiaoswctwlewqmbphnxiagiuosemtpgiqegwoiwgotabegplpfrwqoxiaiijdthaiaciooiqtdwoswomtglrefeytharoqojcootrrtfemghhvemplppefbqhgtbbopkdoswjmjftppnjcrwfinlknxhjvtposwotfppjltppcohgqsbitmcthirbphftobstfdpxjcnwamwakqeihoiqsbpqhdepktplhcoteetfzqnqeewgiuenqsbqegwoidecqhqogkqeihcmjfplplreecmkhrnjcmtittdthzqpotnppjoswmid.....

以下省略5k字节（试一试，可以在文后下载原文）

毫无头绪，考虑到目标明文是英文，要从英文的语言特征入手，即要统计字母的频率，同时也要考虑是否有标点符号、空格等非实义字符。

 

0x01.字母频率统计

我们在统计字母频率之前，要先了解英语文章中的字母统计概率，这是通过大量文字的统计得到的一般性概率，能够体现出英语的语言特征

可以看出，正常的英语文章的单字母槪率降序排序应该是etaoinshrdlcumwfgypbvkjxqz

这个顺序及概率将会在之后破解明文有很大帮助。

下面将开始对Cipher进行字母统计

（1）单字母频率

p--640   9.06％

t--543   7.69％

h--518   7.34％

e--430   6.09％

o--418   5.92％

i--358   5.07％

b--351   4.97％

q--322   4.56％

w--304   4.31％

s--292   4.14％

m--289   4.09％

j--245   3.47％

g--243   3.44％

l--241   3.41％

f--238   3.37％

d--237   3.36％

r--233   3.30％

k--230   3.26％

n--224   3.17％

a--170   2.41％

c--166   2.35％

x--125   1.77％

v--116   1.64％

u--101   1.43％

z--21     0.30％

y--6     0.08％

all—7061

以上统计频率发现，最高频率字母“p”也只有9.06％，与单字母概率极不吻合，于是舍弃仅为单字母的情况。

（2）多表替换情况

由于有了上一次的经验，使用脚本检查Cipher是不是多表代替的情况，直接使用表数为3的多表代替，跑出来结果如下：

三个表的字母频率都很好的吻合了第一步的常见英语文章的字母槪率，并且考虑到舍弃掉空格、标点符号，于是决定从这里尝试破解。

0x02.分析与破解

（1）字母排序

我们将整篇文章按照每个字母先后为mod3同余1、2、0划分为单表1、单表2、单表3，按照常见英语文章的字母概率etaoinshrdlcumwfgypbvkjxqz（明文）对应三个单表（密文）分别为：

单表1：poehtgmsldrcfiavqxnjubzywk

单表2：bpikthmnsfrcegvqoaxjudzlyw

 

单表3：wqjthepoldiarfbnuxkgsczvym

于是有了初步的转换密钥（密文->明文）。为了计算机处理方便，我们将密钥的密文做a-z的排列得到转换关系为

密文

A

B

C

D

E

F

G

H

I

J

K

L

M

N

O

P

Q

R

S

T

U

V

W

X

Y

Z

单表1

W

K

C

D

A

U

N

O

M

B

Z

R

S

P

T

E

G

L

H

I

V

F

Q

Y

X

J

单表2

Y

E

C

K

U

D

M

N

A

B

O

X

S

H

G

T

F

L

R

I

V

W

Z

P

Q

J

单表3

C

W

K

D

N

M

B

I

L

A

P

R

Z

F

H

S

T

U

V

O

G

X

E

Y

Q

J

这种顺序肯定不是最终的转换关系，因为频率并不真正等于概率，还要继续调整两两字母间的顺序，当然做到这一步，我们可以开始初步翻译明文了。

（2）初步翻译与猜解

使用（1）中的转换关系，写了一个脚本翻译得到文字：

发现依旧与我们需要的明文差别很大，但是已经有部分明文单词出现，可以根据这些单词推测真正的字母转换关系（假定这些单词是正确，翻译无误的话）。

 

常见英语文章的单词出现频率

可见，the、be、of等单词是很容易找到的，并且e、o等子母一旦确定的话，就能找到这些单词，所以要从这些单词入手。

 

做出mod3同余的查找表，便于对每个字母的定位，[数字]+[字母]表示该字母所处的同余系，对应到相应的单表中，使用文本搜索功能对单词进行定位

验证方法主要通过下面两种：

①  3t1h2e这种顺序可以确定单表3的明文t、单表1的明文h、单表2的明文e是正确的

②  1p2e3o1p2d3e这种顺序为“peopde”，假定这个单词就是“people”的话，那么单表2的明文d就与l颠倒了，需要在对应关系中调换。

经过大量的挑选及大胆的尝试来验证字母和调换字母顺序，转换成明文的字母越来越多，进一步能够识别的单词就更多，进一步推动破译速度。

（3）语句突破口，得到密钥

在经过大量的转换之后。。

在第九次转换中，检验单词的过程中发现了关键句：

“ihiveidream”，

显然这里有一个“dream”，再猜测“hive”是“have”，不难想到，这就是一篇马丁路德金的《I Have a Dream》（太出名了！）

马上上网查找原文：

Five score years ago, a great American, inwhose symbolic shadow we stand today, signed the Emancipation Proclamation.This momentous decree came as a great beacon light of hope to millions of Negroslaves who had been seared in the flames of withering injustice. It came as ajoyous daybreak to end the long night of their captivity.

 

But one hundred years later, the Negrostill is not free. One hundred years later, the life of the Negro is stillsadly crippled by the manacles of segregation and the chains of discrimination.One hundred years later, the Negro lives on a lonely island of poverty in themidst of a vast ocean of material prosperity. One hundred years later, theNegro is still languished in the corners of American society and finds himselfan exile in his own land. And so we've come here today to dramatize a shamefulcondition.

 

In a sense we've come to our nation'scapital to cash a check. When the architects of our republic wrote themagnificent words of the Constitution and the Declaration of Independence, theywere signing a promissory note to which every American was to fall heir. Thisnote was a promise that all men, yes, black men as well as white men, would beguaranteed the "unalienable Rights" of "Life, Liberty and thepursuit of Happiness." It is obvious today that America has defaulted onthis promissory note, insofar as her citizens of color are concerned. Insteadof honoring this sacred obligation, America has given the Negro people a badcheck, a check which has come back marked "insufficient funds."

。。。。。。以下省略5k字节

 

好了现在相当于拿到明文了，那么拿到密钥就易如反掌了（也就是相当于跳过了进一步猜解单词的过程，不过这也是可以实现的，只是偷了一下懒(⊙﹏⊙)b），通过明密文比较就能得到正确的转换关系。

 

0x03.得到结果

明文频率

etaoinshrdlcumwfgypbvkjxqz

 

密文频率

pothegmslrdiqfvcaxjnubzywk

                

bpkithnsmrfeqgvcoxjaudzlyw

                        

wqtjehploidnrfuabxkgsczvym

（颜色记录的是验证字母的过程，红色为直接验证正确，紫色为经过调换后才正确，浅绿色为明密文比较后确定的，蓝色为暂未确定的）

 

 

及解密密钥：

 

密文

A

B

C

D

E

F

G

H

I

J

K

L

M

N

O

P

Q

R

S

T

U

V

W

X

Y

Z

单表1

G

K

F

L

I

M

N

O

C

P

Z

R

S

B

T

E

U

D

H

A

V

W

Q

Y

X

J

单表2

B

E

F

K

C

L

M

N

O

P

A

X

R

S

G

T

U

D

H

I

V

W

Z

V

Q

J

单表3

F

G

K

L

I

M

B

N

D

O

P

H

Z

C

R

S

T

U

V

A

W

X

E

V

Q

J

 

 

 

 

最终解密结果：（不包含空格、标点符号）

《I Have a Dream》

iamhappytojoinwithyoutodayinwhatwillgodowninhistoryasthegreatestdemonstrationforfreedominthehistoryofournationfivescoreyearsagoagreatamericaninwhosesymbolicshadowwestandtodaysignedtheemancipationproclamationthismomentousdecreecameasagreatbeaconlightofhopetomillionsofnegroslaveswhohadbeensearedintheflamesofwitheringinjusticeitcameasajoyousdaybreaktoendthelongnightoftheircaptivitybutonehundredyearslaterthenegrostillisnotfreeonehundredyearslaterthelifeofthenegroisstillsadlycrippledbythemanaclesofsegregationandthechainsofdiscriminationonehundredyearslaterthenegrolivesonalonelyislandofpovertyinthemidstofavastoceanofmaterialprosperityonehundredyearslaterthenegroisstilllanguishedinthecornersofamericansocietyandfindshimselfanexileinhisownlandandsowevecomeheretodaytodramatiqeashamefulconditioninasensewehavecometoournationscapitaltocashacheckwhenthearchitectsofourrepublicwrotethemagnificentwordsoftheconstitutionandthedeclarationofindependencetheyweresigningapromissorynotetowhicheveryamericanwastofallheirthisnotewasapromisethatallmenyesblackmenaswellaswhitemenwouldbeguaranteedtheunalienablerightsoflifelibertyandthepursuitofhappinessitisobvioustodaythatamericahasdefaultedonthispromissorynoteinsofarashercitiqensofcolorareconcernedinsteadofhonoringthissacredobligationamericahasgiventhenegropeopleabadcheckacheckwhichhascomebackmarkedinsufficientfundsbutwerefusetobelievethatthebankofjusticeisbankruptwerefusetobelievethatthereareinsufficientfundsinthegreatvaultsofopportunityofthisnationandsowehavecometocashthischeckacheckthatwillgiveusupondemandtherichesoffreedomandthesecurityofjusticewehavealsocometothishallowedspottoremindamericaofthefierceurgencyofnowthisisnotimetoengageintheluquryofcoolingoffortotakethetranxuilixingdrugofgradualismnowisthetimetomakerealthepromisesofdemocracynowisthetimetorisefromthedarkanddesolatevalleyofsegregationtothesunlitpathofracialjusticenowisthetimetoliftournationfromthexuicksandsofracialinjusticetothesolidrockofbrotherhoodnowisthetimetomakejusticearealityforallofgodschildrenitwouldbefatalforthenationtooverlooktheurgencyofthemomentthisswelteringsummerofthenegroslegitimatediscontentwillnotpassuntilthereisaninvigoratingautumnoffreedomandezualitynineteensiztythreeisnotanendbutabeginningthosewhohopethatthenegroneededtoblowoffsteamandwillnowbecontentwillhavearudeawakeningifthenationreturnstobusinessasusualtherewillbeneitherrestnortranxuilityinamericauntilthenegroisgrantedhiscitiqenshiprightsthewhirlwindsofrevoltwillcontinuetoshakethefoundationsofournationuntilthebrightdayofjusticeemergesbutthereissomethingthatimustsaytomypeoplewhostandonthewarmthresholdwhichleadsintothepalaceofjusticeintheprocessofgainingourrightfulplacewemustnotbeguiltyofwrongfuldeedsletusnotseektosatisfyourthirstforfreedombydrinkingfromthecupofbitternessandhatredwemusteverconductourstruggleonthehighplaneofdignityanddisciplinewemustnotallowourcreativeprotesttodegenerateintophysicalviolenceagainandagainwemustrisetothemajesticheightsofmeetingphysicalforcewithsoulforcethemarvelousnewmilitancywhichhasengulfedthenegrocommunitymustnotleadustoadistrustofallwhitepeopleformanyofourwhitebrothersasevidencedbytheirpresenceheretodayhavecometorealiqethattheirdestinyistiedupwithourdestinyandtheyhavecometorealixethattheirfreedomisinextricablyboundtoourfreedomwecannotwalkaloneandaswewalkwemustmakethepledgethatweshallalwaysmarchaheadwecannotturnbacktherearethosewhoareaskingthedevoteesofcivilrightswhenwillyoubesatisfiedwecanneverbesatisfiedaslongasthenegroisthevictimoftheunspeakablehorrorsofpolicebrutalitywecanneverbesatisfiedaslongasourbodiesheavywiththefatigueoftravelcannotgainlodginginthemotelsofthehighwaysandthehotelsofthecitieswecannotbesatisfiedaslongasanegroinmississippicannotvoteandanegroinnewyorkbelieveshehasnothingforwhichtovotenonowearenotsatisfiedandwewillnotbesatisfieduntiljusticerollsdownlikewatersandrighteousnesslikeamightystreamiamnotunmindfulthatsomeofyouhavecomehereoutofgreattrialsandtribulationssomeofyouhavecomefreshfromnarrowjailcellssomeofyouhavecomefromareaswhereyourxuestforfreedomleftyoubatteredbythestormsofpersecutionsandstaggeredbythewindsofpolicebrutalityyouhavebeentheveteransofcreativesufferingcontinuetoworkwiththefaiththatunearnedsufferingisredemptivegobacktomississippigobacktoalabamagobacktosouthcarolinagobacktogeorgiagobacktolouisianagobacktotheslumsandghettosofournortherncitiesknowingthatsomehowthissituationcanandwillbechangedletusnotwallowinthevalleyofdespairisaytoyoutodaymyfriendsandsoeventhoughwefacethedifficultiesoftodayandtomorrowistillhaveadreamitisadreamdeeplyrootedintheamericandreamihaveadreamthatonedaythisnationwillriseupandliveoutthetruemeaningofitscreedweholdthesetruthstobeselfevidentthatallmenarecreatedezualihaveadreamthatonedayontheredhillsofgeorgiathesonsofformerslavesandthesonsofformerslaveownerswillbeabletositdowntogetheratthetableofbrotherhoodihaveadreamthatonedayeventhestateofmississippiastateswelteringwiththeheatofinjusticeswelteringwiththeheatofoppressionwillbetransformedintoanoasisoffreedomandjusticeihaveadreamthatmyfourlittlechildrenwillonedayliveinanationwheretheywillnotbejudgedbythecoloroftheirskinbutbythecontentoftheircharacterihaveadreamtodayihaveadreamthatonedaydowninalabamawithitsviciousracistswithitsgovernorhavinghislipsdrippingwiththewordsofinterpositionandnullificationonedayrightdowninalabamalittleblackboysandblackgirlswillbeabletojoinhandswithlittlewhiteboysandwhitegirlsassistersandbrothersihaveadreamtodayihaveadreamthatonedayeveryvalleyshallbeexaltedandeveryhillandmountainshallbemadelowtheroughplaceswillbemadeplainandthecrookedplaceswillbemadestraightandthegloryofthelordshallberevealedandallfleshshallseeittogetherthisisourhopethisisthefaiththatiwillgobacktothesouthwithwiththisfaithwewillbeabletohewoutofthemountainofdespairastoneofhopewiththisfaithwewillbeabletotransformthejanglingdiscordsofournationintoabeautifulsymphonyofbrotherhoodwiththisfaithwewillbeabletoworktogethertopraytogethertostruggletogethertogotojailtogethertostandupforfreedomtogetherknowingthatwewillbefreeonedayandthiswillbethedaythiswillbethedaywhenallofgodschildrenwillbeabletosingwithnewmeaningmycountrytisoftheesweetlandoflibertyoftheeisinglandwheremyfathersdiedlandofthepilgrimspridefromeverymountainsideletfreedomringandifamericaistobeagreatnationthismustbecometrueandsoletfreedomringfromtheprodigioushilltopsofnewhampshireletfreedomringfromthemightymountainsofnewyorkletfreedomringfromtheheighteningallegheniesofpennsylvanialetfreedomringfromthesnowcappedrockiesofcoloradoletfreedomringfromthecurvaceousslopesofcaliforniabutnotonlythatletfreedomringfromstonemountainofgeorgialetfreedomringfromlookoutmountainoftennesseeletfreedomringfromeveryhillandmolehillofmississippifromeverymountainsideletfreedomringandwhenthishappenswhenweallowfreedomtoringwhenweletitringfromeveryvillageandeveryhamletfromeverystateandeverycitywewillbeabletospeedupthatdaywhenallofgodschildrenblackmenandwhitemenjewsandgentilesprotestantsandcatholicswillbeabletojoinhandsandsinginthewordsoftheoldnegrospiritualfreeatlastfreeatlastthankgodalmightywearefreeatlastalmightywearefreeatla

（免费，无需资源分）多表密码破解密文 http://download.csdn.net/detail/kalbertlee/9472014