classical-cipher-analysis

Break classical ciphers using frequency analysis and Kasiski examination.

1.6k|204|Updated Apr 7, 2026
One-click install
npx skills add https://github.com/yaklang/hack-skills --skill classical-cipher-analysis
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: classical-cipher-analysis
Source: https://github.com/yaklang/hack-skills/tree/main/skills/classical-cipher-analysis
Command: npx skills add https://github.com/yaklang/hack-skills --skill classical-cipher-analysis

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps analysts and CTF players rapidly identify and break classical substitution, polyalphabetic, transposition, and XOR-based ciphers so they avoid misclassification and wasted effort on incorrect attack paths.

Core Features & Use Cases

  • Cipher identification: charset inspection, frequency distribution, index of coincidence (IC), and Kasiski examination to determine encoding and cipher family.
  • Targeted attack methods: procedures for Caesar/ROT, monoalphabetic substitution (frequency & crib-dragging), Vigenere (IC + per-column Caesar), affine brute force, Hill known-plaintext recovery, Playfair, Polybius, rail-fence and columnar transposition techniques, and single/repeating-key XOR handling.
  • Tool and automation guidance: recommended workflows integrating CyberChef, dcode.fr, quipqiup, xortool and Python scripts for reproducible, scripted analysis.
  • Use case: Given ciphertext from a CTF challenge or forensic artifact, determine whether it is encoded (base64/hex), monoalphabetic, polyalphabetic, transposed, or XOR-obfuscated and apply the appropriate decryption path.

Quick Start

Run a charset check, compute the index of coincidence, run Kasiski if IC suggests polyalphabetic encryption, and then apply frequency analysis, Caesar brute-force, or per-column Vigenere cracking to recover plaintext.

Frequently Asked Questions about classical-cipher-analysis

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I identify and break classical ciphers like Vigenere or XOR from captured ciphertext?

Break Vigenere ciphers by computing the index of coincidence (IC) to estimate key length, then applying per-column Caesar brute force to each subset. Kasiski examination further refines key length estimates to isolate polyalphabetic encryption periods for accurate plaintext recovery.

What is the best way to crack repeating-key XOR ciphertext without knowing the key length?

Repeating-key XOR ciphertext is broken by using Kasiski examination and index of coincidence to determine key length. Once the key length is found, per-column frequency analysis isolates single-byte XOR keys for each position to recover the full plaintext.

Does this classical cryptanalysis approach support Hill cipher known-plaintext attacks?

Yes, classical cryptanalysis supports Hill cipher known-plaintext recovery. By mapping known plaintext-ciphertext pairs to matrix representations, you can perform matrix inversion to recover the encryption key and decrypt the remaining ciphertext accurately.

Can I use CyberChef and Python scripts for automated ciphertext frequency analysis and decryption?

Yes, workflows integrate CyberChef, xortool, and Python scripts for automated frequency analysis and decryption. This scripted approach handles charset detection, affine brute force, and crib-dragging to ensure reproducible analysis across complex classical cipher challenges.

When should I use Kasiski examination and index of coincidence for cipher identification?

Use Kasiski examination and index of coincidence (IC) when cipher identification suggests polyalphabetic encryption. IC measures text repetition rates to distinguish monoalphabetic from polyalphabetic ciphers, while Kasiski finds repeated substrings to estimate the Vigenere key length.