Book Ciphers and Running-Key Ciphers: Why a Text-Based Key Fails Today
A book cipher uses an ordinary published text as the shared secret. Sender and receiver own the same edition, and the encoded message is nothing more than a set of pointers into it. The appeal is obvious. No suspicious key material, no cipher machine, nothing incriminating on a shelf that also holds forty other books. For roughly four centuries this was one of the better options available to spies, conspirators and diplomats working without institutional support.
It is no longer a serious method. Understanding why requires separating two schemes that get filed under the same name and fail for different reasons.
The two things called a book cipher
The true book cipher, sometimes called the ottendorf cipher, encodes each word of the plaintext as a coordinate: page, line, word. A message becomes a column of number triples such as 118.9.6, 172.8.7. Benedict Arnold used exactly this in his correspondence with John André, keyed first to Blackstone’s Commentaries on the Laws of England and later to a dictionary. Sometimes the coordinates point at individual letters instead of words, which lengthens the ciphertext considerably but removes the vocabulary limit.
The running-key cipher works differently. It takes a continuous stretch of the book as a keystream and combines it with the plaintext letter by letter, usually through a Vigenère tableau. The key is as long as the message, which superficially resembles a one-time pad. Both parties need only agree on a starting point.
They look related. Cryptanalytically they have almost nothing in common.
Why the running-key version collapses
The one-time pad is unbreakable because its key is uniformly random. Every possible plaintext of the right length remains equally consistent with the ciphertext, so there is nothing to solve for. A running-key cipher borrows the length of a one-time pad and none of the randomness.
Written English carries somewhere between one and one and a half bits of information per letter, against the 4.7 bits a uniform 26-letter alphabet would give. Both the key and the message are drawn from that same thin distribution. The ciphertext therefore does not hide one plaintext among astronomically many candidates. It constrains two pieces of English simultaneously, and the pair that satisfies both constraints is usually unique after a few dozen characters.
The classic manual attack, known as crib dragging, exploits this directly. Guess a common word at some position in the key, subtract it from the ciphertext, and look at what falls out on the plaintext side. If the result is gibberish, move on. If it reads like fragments of English, extend the guess in both directions and let each side pull the other forward. Analysts were doing this by hand before the First World War.
Automation made it routine. Modern solvers do hill-climbing or beam search against character n-gram statistics, scoring every candidate pair for how English-like both halves look, and they reliably recover messages of thirty to sixty characters with no knowledge of the source text. Given a candidate library to search, they identify the book as well. The running-key cipher should be treated as a puzzle format, not a security control.
Why the true book cipher is harder, and still not enough
Word-level book ciphers resist that attack. There is no letter-by-letter arithmetic to invert, and a number like 118.9.6 reveals nothing about the word it points to. Frequency analysis, the workhorse against classical substitution, has almost no purchase.
The weakness sits somewhere else. The real key is not the coordinate scheme; it is the identity of the book. And the identity of a book is a small secret.
Realistically, an attacker faces a keyspace of a few hundred thousand plausible texts, which is somewhere around twenty bits. That was a genuine obstacle when checking a candidate meant physically obtaining a copy and decoding by hand. It stopped being one once Gutenberg, HathiTrust, Google Books and the Internet Archive became scriptable. A candidate can be tested in milliseconds, and the test is unambiguous, because a wrong book yields word salad while the right one yields sentences. The search is also heavily prunable: period, language, genre and probable ownership all narrow it before the first decode attempt.
Edition matters, which is the one saving grace. Pagination varies between printings, so an attacker with the correct title but the wrong typesetting still gets nothing. This is a real defence and also a permanent operational hazard for the users, who must reliably possess identical physical objects.
What the numbers leak
Even before the book is identified, the ciphertext gives up structural information.
- Dimensions. The maximum values across the message reveal roughly how many pages the book has, how many lines a page holds, and how many words a line holds. That alone eliminates most of the candidate library.
- Repetition. Identical triples mean identical words. Frequent repeats mark function words, and their positions sketch the sentence structure.
- Locality. Encoders are lazy and tend to draw from nearby pages, so clusters in the number stream often correspond to clauses.
- Vocabulary failure. Words absent from the book must be spelled out some other way, and the shift in encoding pattern flags proper nouns, which are exactly the high-value targets.
- Length. Word counts and message shape survive intact. Traffic analysis does not need the plaintext.
In practice the historical failure mode was simpler than any of this. Book ciphers fell when the book was found during a search, or named by an informant, or deduced from a suspect’s own library. The key has to exist somewhere as a physical object, and physical objects can be seized.
The Beale ciphers, and what unsolved actually means
The three Beale ciphers, published in an 1885 pamphlet, are the standard case study. Cipher number two describes a buried treasure and was solved once someone tried the Declaration of Independence as the key. Numbers one and three, which supposedly give the location and the names of the depositors, have resisted every attempt since.
That resistance is regularly cited as evidence that book ciphers are strong. It is evidence of something narrower. The Beale ciphers are short. There is not enough material for any proposed solution to be provably correct, so a great many readings stay plausible and none can be confirmed. Statistical work on the number sequences has produced results inconsistent with a straightforward encoding of English, which is part of why many researchers now consider the whole affair a nineteenth-century hoax.
Underdetermination is not the same thing as security. A cipher that cannot be solved because too little of it exists offers no protection to anyone who needs to send a second message.
Where the method still has a use
Short messages, an obscure key text, no reuse, and no expectation that the traffic will be analysed by anyone with real resources. That describes puzzle hunts, alternate reality games, geocaching, and fiction. It does not describe anything with an adversary.
As a security mechanism the book cipher is obsolete on every axis. It is slow, it is easy to get wrong, it has no integrity protection whatsoever, so an attacker can alter the message without detection, and reusing the same passage across messages leaks catastrophically. A modern authenticated cipher such as AES-GCM or ChaCha20-Poly1305 does the same job with a 256-bit key that is genuinely random, and does it in microseconds.
The historical interest is real. The security value ran out around the time full-text search became free.