“Ph’nglui mglw’nafh Cthulhu R’lyeh wgah’nagl fhtagn.” Occult horror readers will recognize the phrase from H.P. Lovecraft’s 1926 classic, The Call of Cthulhu. However, outside of that small circle, it seems like pure gibberish. Similarly, looking at a message that has been encrypted calls to mind those same eldritch horrors, chanting in their secret watery caves in a long forgotten tongue.

How can we crack these ciphers? Where do we begin? Luckily, we don’t have to join a cult, or make promises to ancient world-swallowing, madness inducing deities. (Although, I do feel like losing my mind a little during the NCL games). We only need to notice a few small things to crack the code, and of course have a good set of tools.

To begin with, we have to decide if the cipher used is a substitution cipher or a transposition cipher. In a substitution cipher, letters are swapped out for other letters, numbers, or symbols. In a transposition cipher, the letters are simply rearranged.

One of the easiest ways to get started is a frequency analyzer. For that, we use a tool like Rumkin. In English, there are a finite number of repeating letters (ll, nn, ee, etc.), and there are letters that appear more frequently (r,s,t,l,n,e). By using a letter frequency analyzer, if we see these letters with a higher frequency than others, it may be a good indicator that it is a transposition cipher. If we see odd letters like x,y,z,q being used frequently, it might be a substitution cipher.

The next clue is in word boundaries. In some ciphers, word boundaries are preserved, or in other words the spaces between letters are not shifted. These are sometimes called cryptoquips. Other ciphers intentionally omit or move the spaces in order to make deciphering more difficult. These are called patristocrats. I like to use a site called quipqiup on these challenges.

These puzzles are somewhat easy to crack by substituting one letter at a time and making educated guesses to find the other letters. For example, words end in -ing, -end, and small words like a, an, on, in, and it are the first words easily guessed, and using those letter substitutions, other words begin to become more clear.

A transposition cipher will attempt to stack or align letters according to a certain pattern, for example a railfence cipher. This is one of CryptoKait’s favorites, and you can use a tool like the one at Decode for this. This stacks the letters so that by reading them left to right, they are gibberish, but reading them in a zig-zag pattern makes it easy to read:

CTSNRPOI UY F

C

–

–

–

T

–

–

–

S

–

–

–

N

–

R

–

P

–

O

–

I

–

–

U

–

–

–

Y

–

–

–

–

–

–

F

–

–

The NCL games usually make things a bit harder than that, however – by using known ciphers. One of the oldest of these ciphers is called the Caesar cipher, which simply rotates each letter by a fixed number. It is sometimes called a ROT cipher. A shift of 5, for example would mean that abcdef would be fghij. Another cipher is called Atbash; in which a becomes z, b becomes y, c becomes x, and so on. You can find tools for these common ciphers at Decode or Rumkin.

crypto -> rot 13 -> pelcgb

crypto -> atbash -> xibkgl

Baconian ciphers use a different font or typeface to hide the cipher in plain sight. To encode the message, if A was the first font, and B was the second font, “crypto” would be encoded into a sentence at these specific places:

AAABABAAAABABBAABBBABAABAABBAB

Then, it really doesn’t really matter what the message is, the letter position is the code.

There is a difference between encoding and encryption. Encryption makes it impossible (or very difficult) to decipher without knowing a keyword. Encoding follows a known formula or algorithm to make the letters unreadable. One example of this is base64 encoding. Encoding the phrase results in a 32bit string of letters, using the = sign as padding:

Y3J5cHRvIGlzIGZ1bg==

Don’t mistake this for encryption! This is easily decipherable! I will leave you one more tool in hopes of your survival. Check out asciitohex…

There are several other types of encryption and encoding used in the games. I don’t want to spoil too much, because the mystery is part of the allure, but knowing some of the key markers for each type of encoding scheme helps you to figure out how to decode it. To break encryption, you need to figure out what scheme was used, and try a dictionary or brute force attack against it.

I hope I have left enough of a map for you to follow. I hope your tour guide has not been eaten (or worse). If that happens, then don’t panic… CryptoKait has got you covered with a more detailed guide than this!

The winds are howling and there is a strange sound at my door. Wish me luck – if you don’t hear from me I may have accidentally summoned something ancient, dark, and hungry.

“Mako” McGill