Monoalphabetic substitution and Vernam ciphers

Monoalphabetic substitution

Each letter of the alphabet is always replaced by the same other letter, given by a key alphabet. A Caesar cipher (shift every letter by the same amount) is a simple example.

An example key alphabet. To encrypt, find the plaintext letter in the top row; to decrypt, find the ciphertext letter in the bottom row.

Strengths and weaknesses

Using the key above, 'MEET AT NOON' becomes 'DTTZ QZ FGGF'.

• Benefit: simple and quick by hand; with a random key there are 26! (about 4 x 10²⁶) possible keys, so trying every key is impractical.
• Drawback: it is easily broken by frequency analysis. Each plaintext letter always becomes the same ciphertext letter, so letter frequencies are preserved: the most common ciphertext letter probably stands for E (in English), and common patterns such as THE show through. A Caesar cipher has only 25 useful keys, so it can be broken by trying them all.

The Vernam cipher (one-time pad)

The Vernam cipher combines each bit of the plaintext with a bit of the key using XOR. Decryption XORs the ciphertext with the same key, because (P XOR K) XOR K = P.

For perfect security the key must be:

• truly random,
• at least as long as the message,
• used only once, then destroyed,
• kept secret and shared securely.

Then every possible plaintext of that length is equally likely, so the ciphertext gives no information and the cipher cannot be broken, even with unlimited computing power. Drawbacks: generating truly random keys is hard, and huge keys must be distributed securely in advance (the key exchange problem) and never reused.

Vernam example

Encrypt 'H' (ASCII 72 = 01001000) with key 10110011:

XOR gives 1 when the bits differ, 0 when they are the same.

Worked example

Use the key alphabet above to decrypt 'RQZQ'.

1. R: find it in the cipher row; the letter above it is D
2. Q: find it in the cipher row; the letter above it is A
3. Z: find it in the cipher row; the letter above it is T
4. Q: find it in the cipher row; the letter above it is A

Answer: DATA

Check yourself

1. Using the key alphabet QWERTYUIOPASDFGHJKLZXCVBNM (A becomes Q, B becomes W, and so on), encrypt the word CODE.
   Show answer

   EGRT. C to E, O to G, D to R, E to T: EGRT.

2. Using the same key alphabet QWERTYUIOPASDFGHJKLZXCVBNM, decrypt ATN.
   Show answer

   KEY. ATN: each ciphertext letter is found in the key row and replaced by the letter above it, giving KEY.

3. A Caesar cipher shifts each letter 3 places forward (A becomes D). Encrypt XYZ.
   Show answer

   ABC. X to A, Y to B, Z to C: the alphabet wraps round.

4. Encrypt the bit pattern 11001010 using the Vernam cipher with key 01100110.
   Show answer

   10101100. XOR bit by bit: 10101100.

5. A Vernam ciphertext is 00010101 and the key is 01011100. Decrypt it to find the plaintext bit pattern.
   Show answer

   01001001. XOR with the key again: 01001001 (ASCII 73, the letter 'I').

6. Why can a monoalphabetic substitution cipher be broken by frequency analysis?
   • Each plaintext letter is always replaced by the same ciphertext letter, so letter frequencies are kept
   • The key is longer than the message
   • It uses XOR, which is reversible
   • It changes the key for every letter
   Show answer

   Each plaintext letter is always replaced by the same ciphertext letter, so letter frequencies are kept. Common letters like E stay common in the ciphertext.

7. Which condition is required for a Vernam cipher to be perfectly secure?
   • The key is a short word that is easy to remember
   • The same key is reused for every message
   • The key is truly random, as long as the message and used only once
   • The key is sent with the ciphertext
   Show answer

   The key is truly random, as long as the message and used only once. Breaking any of these rules lets attackers find patterns.

8. How many different useful keys does a Caesar cipher on the 26-letter alphabet have (excluding a shift of 0)?
   Show answer

   25. Shifts 1 to 25; a shift of 26 returns the original.

Practise with instant feedback Print this lesson

Sources

• Pearson Edexcel International Advanced Subsidiary/Advanced Level in Computer Science specification (2026)

Last updated 8 November 2026. Spotted a mistake? Tell us.