The Lost Scroll of Caesar: When Three Letters Saved a Republic

The Courier on the Mulian Way

The night smelled of wet ash and dead horses. Somewhere behind the courier, on the road that ran south from Corfinium toward the Adriatic, a column of Pompeian cavalry was still searching farmsteads, and the courier's heart was louder than the hoofbeats he had left behind. He was twenty-three, perhaps twenty-four. He carried no sword. The leather satchel across his chest held a single scroll, and the scroll held perhaps forty words in a hand he did not recognize, sealed with a signet ring he had never seen before, and addressed to a man whose name he had been told to forget. If the cavalry caught him, he would be killed quickly. If the cavalry caught him *and* read the scroll, the war would end in a single afternoon, and the Roman Republic would belong to a different man.

He did not know this. He knew only that he had been paid, that the road was dark, and that the man who had hired him had said three words before sending him off: *perge, tace, vive* — go, be silent, live.

The message inside that scroll was short. By modern standards, almost embarrassingly short. It contained instructions for the movement of three legions across the Apennines, an order to abandon a particular town before siege, and a single sentence of personal greeting that, if read by the wrong pair of eyes, would have condemned the sender to proscription and the recipient to civil disgrace. The two men exchanging it had every reason in the world to want the message kept secret from everyone except the man for whom it was intended. They had, in modern language, a *confidentiality* problem. And the solution they reached for was, in a way, the ur-solution of our entire subject. They wrote it down in Greek, then shifted every letter three places to the left in the alphabet.

That is the whole of the Caesar cipher, and it is older than the man whose name it bears. What the courier carried was not a clever puzzle. It was not a work of cryptographic genius. It was a small act of alphabet surgery, and yet for nearly a thousand years after that dark night, that small act — sometimes called *Caesar's cipher*, sometimes *the shift cipher*, sometimes *the code of the augurs* — would be the first thing any general, ambassador, or paramour reached for when they wanted to whisper across enemy territory. To understand why, and to understand exactly how badly it fails, is to understand the entire grammar of cryptography in miniature. The Caesar cipher is the alphabet's first secret, and it is also the first lesson in why secrets are hard.

We are going to look very carefully at this tiny system, and we are going to do something that, for the first two thousand years of its use, almost nobody bothered to do. We are going to count.

---

The Alphabet Wrapped in a Ring

Before we can speak about breaking the Caesar cipher, we have to speak about what it is. Let us slow down. The Roman courier's message, when finally delivered, was read by a man who knew the secret of the seal. He would, presumably, count three letters back from each character in the Greek text, recover the original words, and understand the orders. To us, watching from twenty centuries away, this looks childish. To the courier, and to the men who designed the system, it must have looked like magic. The truth is somewhere in between: it is mathematics, in a form so simple that we can write the whole thing down on a single index card, and yet so powerful as a thought experiment that it gave rise to an entire science.

Let us define our terms with the care they deserve. Cryptography, at its most austere, is the study of techniques by which a message — called the *plaintext* — is transformed into a different form — called the *ciphertext* — in such a way that someone who intercepts the ciphertext cannot recover the plaintext, but someone who knows a specific piece of additional information, called the *key*, can. The plaintext, in our courier's case, was the Latin (or Greek) instructions. The ciphertext was the shifted text. The key was the number 3. That is the whole skeleton. Everything else we will discuss in this book is a fleshing-out of these four ideas: *plaintext*, *ciphertext*, *key*, and *transformation*.

The Caesar cipher's transformation is the simplest non-trivial one we can imagine. We take the alphabet — the ordinary twenty-six letters A through Z that we have used, with minor variations, for two thousand years — and we add to each letter a fixed number, called the *shift*. If the shift is 3, then A becomes D, B becomes E, C becomes F, and so on. When we run out of letters at the end of the alphabet, we wrap around: X becomes A, Y becomes B, Z becomes C. The recipient, knowing the shift, simply reverses the operation: subtract 3, wrap around, recover the original.

This is the heart of the system, and it is worth dwelling on the wrap-around, because the wrap-around is what makes the cipher mathematical. Without the wrap-around, "shift by 3" would eventually run off the edge of the alphabet and fail. With the wrap-around, the alphabet becomes a closed loop. The letter after Z is A. The letter before A is Z. The alphabet is no longer a line; it is a ring. And a ring of twenty-six objects, with a notion of "add a fixed number of steps," has a name. It is called the *cyclic group of order 26*, and in mathematical shorthand we write it as $\mathbb{Z}_{26}$.

You do not need to be a mathematician to feel comfortable with $\mathbb{Z}_{26}$. Think of it this way. The twenty-six letters are arranged on the rim of a clock — not a twelve-hour clock, a twenty-six-hour clock. Position 0 is A. Position 1 is B. ... Position 25 is Z. Position 26, if we reached it, would be A again, which is why we say the letters "wrap." Adding a shift of $k$ to a letter at position $p$ produces a new position $c$, given by the formula:

$$c \equiv p + k \pmod{26}$$

The three horizontal lines, $\equiv$, mean "is congruent to," which is just a fancy way of saying that we are allowed to subtract 26 as many times as we like, or add 26 as many times as we like, without changing the value. (This is called *modular arithmetic*, and it is the silent engine of almost everything we will do in this book, from Caesar to RSA to the elliptic curves that guard your credit card.) The Caesar cipher is, formally, the map that sends a plaintext letter $p$ to a ciphertext letter $c$ using the rule above, with $k = 3$.

The decryption rule is the inverse. If the recipient knows $k$, they compute:

$$p \equiv c - k \pmod{26}$$

which, since subtracting 3 is the same as adding 23 (because $-3 \equiv 23 \pmod{26}$), they can equally well phrase as "shift by 23 forward." This is a tiny technicality, but it carries a deep lesson. In modular arithmetic, every operation has an inverse. Every encryption has a decryption. The math is honest, and reversible, in a way that physical destruction of a message is not.

Let us work a single example, slowly, because the example is the cipher. Suppose the plaintext word is *CAESAR*. In our numbering, C is at position 2 (counting from A = 0), A is at 0, E is at 4, S is at 18, A is at 0, R is at 17. We apply a shift of $k = 3$ to each:

• $2 + 3 = 5$, which is F.
• $0 + 3 = 3$, which is D.
• $4 + 3 = 7$, which is H.
• $18 + 3 = 21$, which is V.
• $0 + 3 = 3$, which is D.
• $17 + 3 = 20$, which is U.

The ciphertext is *FDHVDU*. To decrypt, we shift each letter back by 3 (or, equivalently, forward by 23):

• $5 - 3 = 2$, which is C.
• $3 - 3 = 0$, which is A.
• $7 - 3 = 4$, which is E.
• $21 - 3 = 18$, which is S.
• $3 - 3 = 0$, which is A.
• $20 - 3 = 17$, which is R.

We are back where we started. The cipher is, in this precise sense, *self-inverse composed with itself*: applying it twice does not return us to the plaintext (it gives us a shift of 6), but applying it with the inverse key returns us perfectly. The mathematics works.

To make this concrete, here is the entire encryption pipeline as a fl