How codemakers and codebreakers have steered history and privacy

1

Discipline beats clever alphabets

A substitution cipher fails when users trust a compromised courier and ignore letter frequencies that Arab scholars had already exploited centuries earlier.

Singh opens on a plot carried in a monoalphabetic substitution cipher. The alphabet itself was not exotic; the decisive failures were human. A secretary doubling as an enemy agent and a codebreaker applying frequency counts turned the correspondence into evidence.

Natural language is uneven. In English the letter E dominates, short words repeat, and doubled letters leave patterns. A long enough ciphertext therefore leaks the structure of the plaintext once someone is patient enough to tally it. The forged postscript that followed the break simply widened the net.

The deeper claim is that real-world collapses are as often about tradecraft and misplaced trust as about pure mathematics. That lesson becomes the book’s engine: every later advance in codemaking will meet a matching advance in breaking, and human habits will keep supplying the openings.

In practice: In the 1586 Babington correspondence, frequency analysis plus a double agent exposed the assassination plan and led to the 1587 execution.

2

Reputation outruns the math

The Vigenère cipher stayed ‘unbreakable’ for roughly three hundred years mainly because no one had yet published a systematic way to find the repeating key’s length.

After simple substitution proved fragile, cryptographers moved to polyalphabetic methods. A repeating keyword shifts the alphabet for each letter, so the same plaintext letter can become many different ciphertext letters and ordinary frequency counts fail.

The system’s fame rested on an unsolved preliminary step: discovering how long the keyword is. Once that length is known, the ciphertext splits into separate simple ciphers that fall to ordinary tallies. Charles Babbage worked out the repeated-sequence method around 1854 but left it unpublished; credit later went to the 1863 publication by Friedrich Kasiski.

Singh treats the lag as a pattern, not an accident. Governments and individuals often hide breaking successes for advantage, so the public timeline of cryptography routinely trails the real one. The same gap will reappear with wartime and intelligence breakthroughs kept classified for decades.

In practice: Repeated ciphertext sequences let an attacker infer likely key lengths, after which each shifted alphabet is attacked on its own.

3

Codebreaking becomes a ministry

Once intercepted mail could swing diplomacy, European states turned cryptanalysis into standing rooms with budgets and specialists rather than lone cleverness.

Singh describes the Cabinets Noirs—black chambers in capitals such as Vienna—where officials opened, copied, resealed, and forwarded diplomatic letters while analysts worked the ciphers inside. The work was routine, not exceptional.

Institutional capacity changed the arms-race logic. Investment in breaking forced other states to field stronger codes, which then justified still more breaking investment. The telegraph intensified the pressure: anyone with line access could intercept, so cryptography left the narrow world of spies and entered broad commercial and military traffic.

By the twentieth century the function was inseparable from national-security infrastructure. That precondition explains the massive state-funded efforts that dominate the book’s middle chapters.

In practice: Vienna’s chamber systematically fed foreign diplomatic secrets to Austrian rulers through the eighteenth century.

4

One message tilts a war

Room 40’s handling of the Zimmermann Telegram showed that cryptanalysis is a strategic weapon whose value depends on when and how the secret is spent.

In 1917 British naval intelligence decrypted a German proposal that Mexico join against the United States in exchange for help reclaiming territory. The content was explosive; the dilemma was operational.

Revealing the plain text risked telling Germany its diplomatic cipher was readable. The solution was an intermediary copy obtained through a deniable channel in Mexico, so the message could be published while the primary break stayed hidden. American outrage followed, and the episode became one factor in the April declaration of war.

Singh’s point is double: breaking yields power, yet protecting the source can matter as much as the intelligence itself. The same tension returns at larger scale in the next war.

In practice: Publication of the telegram in American newspapers in early 1917 helped push the United States toward war with Germany.

5

Rotors turn language into search

Enigma replaced linguistic puzzles with combinatorial settings so numerous that only electromechanical search, fed by operator habits, could keep up.

Each keystroke stepped wired rotors and a plugboard, changing the substitution continuously. Brute force and manual frequency methods became hopeless. Poland’s Cipher Bureau, especially Marian Rejewski, first exploited mathematical properties of the daily settings and built early bomba devices.

In 1939, after Germany raised complexity, Poland shared its work with Britain and France. At Bletchley Park, Turing and Welchman refined bombe machines that used predictable phrases—weather reports, stock greetings—to shrink the search space. The break was never a single moment; new rotors and plugs forced constant escalation.

The resulting Ultra intelligence was guarded so tightly that, Singh notes, attacks were sometimes left uninterrupted rather than risk the source—an echo of the earlier telegram dilemma, now sustained across a whole war.

In practice: Predictable weather-report phrasing gave the bombes known plaintext anchors that narrowed otherwise astronomical settings.

6

Code war midwifes the computer

Colossus and Turing’s earlier universal-machine idea mean the digital revolution’s roots are entangled with cryptanalysis, not separate from it.

Bombe relays were still mechanical. Against the more complex Lorenz cipher used for high-level German traffic, Bletchley built Colossus, which tested settings with vacuum tubes at electronic speed. That leap prefigured general-purpose electronic computing.

Turing’s 1936 conception of a universal machine able to perform any computation given the right instructions supplied the conceptual base that later general-purpose designs drew on. Secrecy lasting until the 1970s left the public history of computing crediting other projects for advances that had earlier hidden roots in codebreaking.

Singh reframes the narrative: tools forged to win the code war became foundations of the information age, and the same machines that broke wartime ciphers would soon make classical methods obsolete and demand entirely new approaches.

In practice: Colossus used vacuum tubes to run cipher tests far faster than relay-based bombes, pointing toward electronic computing.

7

Secrecy without a prior meeting

Public-key cryptography removes history’s greatest practical weakness—the need to carry a shared secret key in advance—by splitting encryption and decryption across one-way math.

Every earlier system required both parties to possess the same secret before they could talk safely. Distributing that key over distance or under fire was always the soft spot. In the 1970s Diffie and Hellman, building on Merkle, proposed asymmetric keys: a public key anyone can use to encrypt, a private key only the recipient holds to decrypt.

The mechanism rests on trapdoor one-way functions—easy to compute, infeasible to reverse without special knowledge, such as factoring the product of two huge primes. Rivest, Shamir, and Adleman turned the idea into the 1977 RSA algorithm that still underpins much internet security.

Singh adds that GCHQ’s Ellis, Cocks, and Williamson had reached equivalent ideas earlier and kept them classified, so open credit went to the American researchers who published. The pivot is social as much as technical: strong encryption leaves the exclusive realm of states and becomes usable by ordinary people and businesses.

In practice: RSA lets a customer encrypt a transaction to a merchant’s public key so only the merchant’s private key can open it, with no pre-shared secret.

8

Encryption leaves the lab

Once PGP put military-grade public-key strength on civilian machines, the arms race became a values fight over whether any government should hold a master key.

Phil Zimmermann’s 1991 release of Pretty Good Privacy gave anyone with a computer access to strong encryption. A U.S. criminal investigation followed under export rules that treated such software like munitions; the case was later dropped, but the fault line stayed.

Singh sets out the tension without a technical winner. The same strength that shields dissidents, bank details, and private talk also blocks lawful intercept of criminal or terrorist traffic. Key-escrow proposals—government or a trusted third party holding a copy of every private key—create a single repository that is an irresistible target for theft or abuse, undercutting the security the system claims to offer.

Unlike earlier chapters settled by a new algorithm or machine, this dispute is political. It will recur whenever enforcement power and civil liberties collide over fresh technology.

In practice: Key escrow’s central store of private keys becomes the point of failure an attacker or abuser only needs to hit once.

9

Physics as the final lock

Quantum key distribution does not hide a harder math problem; it makes eavesdropping detectable because measuring a quantum state in the wrong basis disturbs it.

Bennett and Brassard’s 1980s proposal, building on Wiesner, encodes key bits in quantum properties such as photon polarization. An interceptor who measures in the wrong basis alters the state, so the legitimate parties can spot the intrusion and discard the key.

This differs in kind from RSA-style security, which rests on the practical difficulty of factoring large numbers. A future quantum computer running Shor’s 1994 algorithm could factor those numbers efficiently and collapse much existing internet security overnight. Quantum key distribution claims immunity to raw computing power because the guarantee is physical, not computational.

By the book’s 1999 writing, short-distance experiments had already shown the principle. Singh presents the moment as a possible close to the historical arms race for key exchange: for the first time the defenders may hold an advantage the attackers cannot simply out-compute.

In practice: An eavesdropper measuring photon polarization wrongly leaves a detectable disturbance, warning the two parties before they trust the key.