Kasiski Examination

The observation the method rests on

A Vigenere cipher shifts each letter by a different amount, cycling through a keyword. That defeats letter counting, because the same plaintext letter becomes different ciphertext letters depending on where it falls. But the key repeats, and repetition leaks.

Suppose the word THE appears twice in the plaintext, and by coincidence both occurrences line up with the same three letters of the key. Both encipher to the same three ciphertext letters. The distance between them, counted in letters, is therefore a whole number of key cycles: a multiple of the key length.

One such coincidence proves little. Dozens of them, factored and tallied, point straight at the length.

What this tool measures

Every sequence of the chosen length that occurs more than once is collected with its positions. For each one, every pairwise distance is computed, not just the gaps between neighbours, because three occurrences carry three pieces of evidence and taking only consecutive gaps throws one away.

Each candidate key length then gets two numbers: how many distances it divides, and how many distinct repeated sequences contributed at least one of those distances. The ranking uses the first, corrected for chance. The second sits beside it and is deliberately kept out of the score, because it is a judgement rather than an arithmetic: one chatty sequence repeating eight times inflates the distance count without adding independent evidence, whereas three different sequences agreeing on a factor is three separate coincidences pointing the same way. If the suggested length rests on a single sequence, that is the number that should make you doubt it.

The divisor trap

This is the part that catches people, and it is arithmetic rather than cryptography. If 12 divides a distance then so do 2, 3, 4 and 6. Every divisor of the true key length inherits its entire score, so a table sorted by support puts the smallest factors on top no matter what the key actually was.

The fix is arithmetic too. Charge every factor for the support chance hands it: 2 divides half of any set of distances for free, so its raw count must be halved before it can be set beside a factor that divides only a sixth of them. Correct for that and the true key length outranks its own divisors, because a divisor carries only its own share of the evidence. Correct as well for the noise a factor is entitled to, which grows with the factor, and the true length outranks its multiples too. What is left is one rule with nothing tuned in it: within any family of divisors and multiples, keep the strongest member. The full tally stays underneath so you can disagree with it: if the suggested length has only one sequence behind it, a factor with six sequences behind it deserves a look.