Simple Substitution Algorithms
Thilan Dissanayaka Cryptography March 04, 2020

Simple Substitution Algorithms

A substitution algorithm is a method of encryption where elements of the plaintext (the original message) are replaced with other symbols or characters. The main idea is:

Replace each letter or group of letters in a message with something else to obscure the original meaning.

πŸ›οΈ Classical Substitution Algorithms Let’s look at a few fundamental substitution algorithms that have been used historically and are still taught today for educational purposes.

  1. Caesar Cipher The Caesar Cipher is one of the simplest and most well-known substitution ciphers. It shifts each letter in the plaintext by a fixed number of positions down the alphabet.

πŸ”’ Example: Shift by 3:

Plaintext:  HELLO
Ciphertext: KHOOR

πŸ”§ Encryption Formula: For each character:

E(x) = (x + n) mod 26

Where:

x is the position of the letter (0–25)

n is the shift amount (e.g., 3)

mod 26 wraps around the alphabet

πŸ”“ Decryption Formula:

D(x) = (x - n) mod 26

Caesar cipher is easy to break with brute-force since there are only 25 possible shifts.

  1. Monoalphabetic Substitution Instead of shifting letters, each letter of the alphabet is replaced by another fixed letter using a predefined substitution key.

🧾 Example: Suppose this mapping:

A β†’ M, B β†’ N, C β†’ B, D β†’ V, E β†’ C, ..., Z β†’ Q

Then:

Plaintext:  ATTACK
Ciphertext: MBBMBO

Unlike Caesar, this cipher uses a completely shuffled alphabet, making it harder to brute-force but still vulnerable to frequency analysis.

  1. Atbash Cipher The Atbash cipher is a special kind of monoalphabetic cipher where the alphabet is reversed.

πŸ”„ Mapping:

A ↔ Z, B ↔ Y, C ↔ X, ..., M ↔ N

Example:

Plaintext:  HELLO
Ciphertext: SVOOL

Atbash is very simple, and once you know it’s a reverse alphabet, it’s easy to decode.

  1. ROT13 Cipher The ROT13 cipher is a Caesar cipher with a shift of 13. Applying it twice restores the original text.

πŸ” Example:

Plaintext:  HELLO
Ciphertext: URYYB

Apply ROT13 again:

Ciphertext: URYYB β†’ HELLO

Used in forums to obscure spoilers or jokes. ROT13 is self-inverse.

πŸ“‰ Weaknesses of Simple Substitution Ciphers While educational and historically important, simple substitution algorithms are not secure by modern standards.

Here’s why:

Frequency analysis can reveal common letters (like E, T, A).

Brute-force is easy for Caesar (only 25 options).

Patterns in ciphertext can reveal word structure.

βœ… Why Study Them? Even though they’re outdated, simple substitution ciphers are important because they:

Teach core ideas of encryption and decryption

Help build intuition about symmetric key cryptography

Lay the groundwork for understanding modern cryptographic systems

πŸ§ͺ Try It Yourself! You can implement a Caesar cipher in your favorite programming language. Here’s a basic version in Python:

def caesar_encrypt(text, shift):
    result = ''
    for char in text.upper():
        if char.isalpha():
            result += chr((ord(char) - 65 + shift) % 26 + 65)
        else:
            result += char
    return result

print(caesar_encrypt("HELLO WORLD", 3)) # Output: KHOOR ZRUOG 🧩 Conclusion Simple substitution algorithms may not secure your bank account, but they play a crucial role in understanding the evolution of cryptography. They’re fun to play with and reveal how encryption began thousands of years ago.

Up next, we’ll look at polyalphabetic substitution (like the VigenΓ¨re cipher), which adds more complexity and security.

ALSO READ
Blockchain 0x000 – Understanding the Fundamentals
May 21, 2020 Web3 Development

Imagine a world where strangers can exchange money, share data, or execute agreements without ever needing to trust a central authority. No banks, no intermediaries, no single point of failure yet...

Identity and Access Management (IAM)
May 11, 2020 Identity & Access Management

Who are you β€” and what are you allowed to do? That's the fundamental question every secure system must answer. And it's exactly what Identity and Access Management (IAM) is built to solve.

How I built a web based CPU Simulator
May 07, 2020 Pet Projects

As someone passionate about computer engineering, reverse engineering, and system internals, I've always been fascinated by what happens "under the hood" of a computer. This curiosity led me to...

Writing a Shell Code for Linux
Apr 21, 2020 Exploit Development

Shellcode is a small piece of machine code used as the payload in exploit development. In this post, we write Linux shellcode from scratch β€” starting with a simple exit, building up to spawning a shell, and explaining every decision along the way.

Exploiting a Stack Buffer Overflow on Windows
Apr 12, 2020 Exploit Development

In a previous tutorial we discusses how we can exploit a buffer overflow vulnerability on a Linux machine. I wen through all theories in depth and explained each step. Now today we are going to jump...

Access Control Models
Apr 08, 2020 Identity & Access Management

Access control is one of the most fundamental concepts in security. Every time you set file permissions, assign user roles, or restrict access to a resource, you're implementing some form of access control. But not all access control is created equal...

Exploiting a  Stack Buffer Overflow  on Linux
Apr 01, 2020 Exploit Development

Have you ever wondered how attackers gain control over remote servers? How do they just run some exploit and compromise a computer? If we dive into the actual context, there is no magic happening....

Basic concepts of Cryptography
Mar 01, 2020 Cryptography

Ever notice that little padlock icon in your browser's address bar? That's cryptography working silently in the background, protecting everything you do online. Whether you're sending an email,...

Common Web Application Attacks
Feb 05, 2020 Application Security

Web applications are one of the most targeted surfaces by attackers. This is primarily because they are accessible over the internet, making them exposed and potentially vulnerable. Since these...

Remote Code Execution (RCE)
Jan 02, 2020 Application Security

Remote Code Execution (RCE) is the holy grail of application security vulnerabilities. It allows an attacker to execute arbitrary code on a remote server β€” and the consequences are as bad as it sounds. In this post, we'll go deep into RCE across multiple languages, including PHP, Java, Python, and Node.js.