Classical Cipher Analysis
Break classical and encoded ciphertext in CTF or security exercises using a structured identification-and-cryptanalysis playbook.
Overview
Classical Cipher Analysis is an agent skill for the Ship phase that identifies and breaks classical ciphers and encoded CTF ciphertext using frequency analysis, Kasiski examination, and known-plaintext techniques.
Install
npx skills add https://github.com/yaklang/hack-skills --skill classical-cipher-analysisWhat is this skill?
- Quick identification table maps observations (flat frequency, uppercase-only, etc.) to likely cipher types and first act
- Covers monoalphabetic substitution, Caesar/ROT, Vigenere, Enigma, affine, Hill, transposition, Bacon/Polybius/Playfair,
- Emphasizes decode-first for base64/hex-wrapped ciphertext before jumping to the wrong cipher family
- Routes to symmetric-cipher-attacks, hash-attack-techniques, and lattice-crypto-attacks for non-classical challenges
- Frequency analysis, IC, and Kasiski examination as core identification methodology
Adoption & trust: 1k installs on skills.sh; 980 GitHub stars; 1/3 security scanners passed (skills.sh audits).
What problem does it solve?
You have opaque or partially decoded text in a challenge and your agent keeps applying the wrong cipher break or skips the identification step entirely.
Who is it for?
CTF players and security learners who need repeatable classical cryptanalysis steps instead of one-shot LLM guesses.
Skip if: Teams implementing production encryption, key management, or modern AES/GCM application design—use symmetric-cipher-attacks and proper engineering practices instead.
When should I use this skill?
Substitution ciphers, Vigenere, transposition, XOR, or encoded text in CTF challenges requiring frequency analysis, Kasiski, or known-plaintext cryptanalysis.
What do I get? / Deliverables
You get a cipher-type hypothesis, ordered cryptanalysis steps, and pointers to modern-crypto sibling skills when the challenge is not classical.
- Cipher-type identification
- Ordered break steps for the matched classical family
- Routing note when modern crypto skills apply
Recommended Skills
Journey fit
How it compares
A procedural cryptanalysis playbook for classical puzzles, not a general security audit or MCP integration.
Common Questions / FAQ
Who is classical-cipher-analysis for?
It is for agents and humans solving CTF or training scenarios involving substitution, Vigenere, transposition, XOR, or encoded classical ciphertext.
When should I use classical-cipher-analysis?
Use it in Ship/security work when ciphertext looks classical, when frequency is uneven or suspiciously flat, or when base64/hex decoding must happen before analysis.
Is classical-cipher-analysis safe to install?
Treat it as educational offensive-security guidance; review the Security Audits panel on this Prism page before trusting the package in your environment.
Workflow Chain
Then invoke: symmetric cipher attacks, hash attack techniques
SKILL.md
READMESKILL.md - Classical Cipher Analysis
# SKILL: Classical Cipher Analysis — Expert Cryptanalysis Playbook > **AI LOAD INSTRUCTION**: Expert classical cipher identification and breaking techniques for CTF. Covers cipher identification methodology (frequency analysis, IC, Kasiski), monoalphabetic substitution, Caesar/ROT, Vigenere, Enigma, affine, Hill, transposition ciphers, Bacon/Polybius/Playfair, and XOR ciphers. Base models often skip the identification step and jump to the wrong cipher type, or fail to recognize encoded (base64/hex) ciphertext that needs decoding before analysis. ## 0. RELATED ROUTING - [symmetric-cipher-attacks](../symmetric-cipher-attacks/SKILL.md) when dealing with modern symmetric ciphers (AES/DES) rather than classical - [hash-attack-techniques](../hash-attack-techniques/SKILL.md) when the challenge involves hash-based constructions - [lattice-crypto-attacks](../lattice-crypto-attacks/SKILL.md) when knapsack-based ciphers are encountered ### Quick identification guide | Observation | Likely Cipher | First Action | |---|---|---| | All uppercase letters, uneven frequency | Monoalphabetic substitution | Frequency analysis | | All uppercase, flat frequency distribution | Polyalphabetic (Vigenere) | IC + Kasiski | | Only A-Z shifted uniformly | Caesar/ROT | Brute force 25 shifts | | Base64 alphabet (A-Za-z0-9+/=) | Base64 encoded (decode first) | Base64 decode | | Hex string (0-9a-f) | Hex encoded (decode first) | Hex decode | | Binary (0s and 1s) | Binary encoded | Convert to ASCII | | Dots and dashes | Morse code | Morse decode | | Raised/normal text pattern | Bacon cipher | Map to A/B, decode | | 2-digit number pairs (11-55) | Polybius square | Grid lookup | | Text appears scrambled (right letters, wrong order) | Transposition | Anagram analysis | | Non-printable bytes XOR-like | XOR cipher | Single/repeating key XOR analysis | --- ## 1. CIPHER IDENTIFICATION METHODOLOGY ### 1.1 Step 1: Character Set Analysis ```python def analyze_charset(ciphertext): """Identify encoding/cipher by character set.""" chars = set(ciphertext.strip()) if chars <= set('01 \n'): return "Binary encoding" if chars <= set('.-/ \n'): return "Morse code" if chars <= set('0123456789abcdef \n'): return "Hex encoding" if chars <= set('ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\n'): if '=' in ciphertext or len(ciphertext) % 4 == 0: return "Base64 encoding" if chars <= set('ABCDEFGHIJKLMNOPQRSTUVWXYZ \n'): return "Uppercase only — classical cipher" if all(c in '12345' for c in ciphertext.replace(' ', '').replace('\n', '')): return "Polybius square (digits 1-5)" return "Mixed charset — needs further analysis" ``` ### 1.2 Step 2: Frequency Analysis ```python from collections import Counter def frequency_analysis(text): """Compute letter frequency distribution.""" text = text.upper() letters = [c for c in text if c.isalpha()] total = len(letters) freq = Counter(letters) print("Letter frequencies:") for letter, count in freq.most_common(): pct = count / total * 100 bar = '#' * int(pct) print(f" {letter}: {pct:5.1f}% {bar}") return freq # English letter frequency (for comparison): # E T A O I N S H R D L C U M W F G Y P B V K J X Q Z # 12.7 9.1 8.2 7.5 7.0 6.7 6.3 6.1 6.0 4.3 4.0 2.8 ... ``` ### 1.3 Step 3: Index of Coincidence (IC) ```python def index_of_coincidence(text): """ IC ≈ 0.065 → English / monoalphabetic substitution IC ≈ 0.038 → random / polyalphabetic cipher """ text = [c for c in text.upper() if c.isalpha()] N = len(text) freq = Counter(text) ic = s