dracondi/README.md

The DRACONDI cipher
===================
DRACONDI (short for "Dual-key Rotating Alphabet CONDI") is a symmetrical, pen
and paper, dual-key cipher based upon the ACA's CONDI ("CONsecutive DIgraph")
cipher. It combines the ease of manual and software implementations with a
lot of security enhancements compared to the original CONDI design.

Design rationale
----------------
The original CONDI cipher as
[described by ACA](https://cryptogram.org/downloads/aca.info/ciphers/Condi.pdf),
while being very simple to implement and use, poses multiple problems when it
comes to security, such as:

- the initial offset only influences the first ciphertext letter;
- repeated plaintext digraphs are encrypted into the same ciphertext digraphs;
- the keyspace size is too small for modern use (about 88 bits);
- the keying scheme doesn't consider repeated keyphrase letters;
- the original CONDI preserves word division which eases the cryptanalysis.

By ditching the word division and altering the CONDI's offset calculation step
to account for the letter position in the message and the ciphertext letter
position in the second keyed alphabet, DRACONDI achieves the following
improvements:

- the initial offset is now affecting the rest of the ciphertext;
- the keyspace size has been increased to about 176 bits;
- repeated plaintext digraphs no longer encrypt into the same ciphertext;
- repeated letters in the keyphrase now affect the keyed alphabet;
- the ciphertext is (optionally) divided into the groups of 5 that no longer
  convey any additional information about the plaintext nature.

These improvements come at a cost of slightly longer offset calculation using
the second keyed alphabet, but otherwise the overall simplicity of the original
CONDI cipher is fully retained in DRACONDI.

The DRACONDI algorithm
----------------------
The entire DRACONDI cipher can be described in three sections: key preparation,
encryption and decryption. Additionally, all key and message material which is
alphabetical must first undergo the sanitization part (i.e. lowercasing it and
removing all non-alphabetical characters not belonging to the `[a-z]` range).
Unlike the original CONDI, all insignificant whitespace is to be removed in the
plaintext message, and all significant whitespace is to be replaced with any
rarely used letter, like `x`, `z` or `q`.

### Numeric information encoding (optional)

It is recommended, although not required (even for software implementations),
that the numeric digits from 0 to 9 are encoded with `a` to `j` respectively
and the numbers are framed within `xn` and `nx` digraphs. If the literal
spelling of a number is shorter, it is preferred to this representation.
For example, while 2 can be encoded as `xncnx`, the word `two` is just shorter
and is preferred. However, 13 is preferred to be encoded as `xnbdnx`, as the
word `thirteen` already is longer than this encoding. In case the length is
the same, the general recommendation is not to use any encoding. So, as an
example, the number 11 is just written as `eleven` as opposed to `xnbbnx` that
has the same 6-character length. Same for 20: `twenty` instead of `xncanx`.

### Key preparation

Unless both parties have agreed on using two completely randomized alphabets
(which is the most preferred way of setting up the key material for DRACONDI
and can be achieved in different ways, e.g. sharing a shuffled 52-card deck),
the key preparation process takes two keyphrases and outputs two mixed
alphabets, KA1 and KA2. The algorithm is identical for both keyphrases.
Follow these steps to create a mixed alphabet from a keyphrase of length `N`
(without any spaces or non-alphabetical characters):

1. Start writing down the (sanitized) keyphrase "as is". For every letter,
   replace it with the **previous** letter in the alphabet if it already
   occurred in the keyphrase. Repeat this process if necessary until a new
   letter is found.
2. Write the rest of the alphabet in the natural order.
3. Count `N` letters forward from the beginning and write down the resulting
   alphabet, wrapping around at the end. If `N` is over 25, count `N mod 26`
   letters instead.

You should be left with a mixed and shifted alphabet of 26 unique letters.
Write the indices from 0 to 25 above it for more convenient usage.

Example: with the key phrase `sivispacemparabellum` (20 letters long), the
unshifted alphabet will look like `sivhrpacemozqybdlkujfgntwx`. Then, since
our shift is 20, we read it from the 20th position (starting at 0) wrapping
around at the end: `fgntwxsivhrpacemozqybdlkuj`. This is our final keyed
alphabet. Now, we need to repeat the process with a different keyphrase to
get the second keyed alphabet.

### Encryption

The encryption process takes an initial plaintext message in the sanitized 
form and two keyed alphabets, KA1 and KA2. Follow these steps to encrypt a
message with DRACONDI.

1. Randomly choose the initial offset from 0 to 25. Write its corresponding
   letter in the KA1 alphabet as the first ciphertext letter.
2. For every plaintext letter, do the following:
    1. Locate the plaintext letter position in the KA1 alphabet. Locate the
     ciphertext position by moving (offset) letters to the right, wrapping
     around the alphabet if necessary.
    2. Write down the ciphertext letter according to the KA1 alphabet.
    3. Get the position of the ciphertext letter in the KA2 alphabet. Calculate
     the next offset as the sum of that position and the amount of letters
     already encrypted in the message (modulo 26).

As an optional step, you can split the ciphertext into 5-letter groups. This
grouping needs to be removed at the sanitization step before decrypting the
message on the receiving end. All reference implementations of DRACONDI in
software are required to implement this step.

### Decryption

The decryption process takes a ciphertext message in the sanitized form and
two keyed alphabets, KA1 and KA2. Follow these steps to decrypt a message
with DRACONDI.

1. Derive the initial offset from the first ciphertext letter in the KA1
   alphabet. Discard the first ciphertext letter afterwards.
2. For every remaining ciphertext letter, do the following:
    1. Locate the ciphertext letter position in the KA1 alphabet. Locate the
     plaintext position by moving (offset) letters to the left, wrapping around
     the alphabet if necessary.
    2. Write down the plaintext letter according to the KA1 alphabet.
    3. Get the position of the ciphertext letter in the KA2 alphabet. Calculate
     the next offset as the sum of that position and the amount of letters
     already decrypted in the message (modulo 26).

Implementation requirements
---------------------------
When implementing DRACONDI in software, the following rules are in place for an
implementation to be considered correct:
 
1. The software shall support three modes: keyed alphabets generation (from the
   keyphrase pair), encryption and decryption.
2. The keyed alphabets generation part shall be able to accept already permuted
   alphabets and output them completely unaltered, making no changes to them.
3. The encryption part shall sanitize the message and output the ciphertext in
   5-letter groups separated by a whitespace.
4. The decryption part shall sanitize the ciphertext before processing,
   removing any whitespace and non-letter characters from the input.

TI-74 BASIC port
----------------
The [dracondi.b74](dracondi.b74) file in this repository contains a port of the
cipher to the Texas Instruments TI-74 handheld computer in its native BASIC
language dialect. This port has been developed and tested on the TI-74S model
and contains the following limitations:

1. The message length is restricted by the device's line limit.
2. No message prefiltering is done: enter the plaintext strictly in lowercase,
without any spaces and non-alphabetical characters.
3. The resulting ciphertext is divided with spaces every five characters but
the last group is not autofilled.
4. When decrypting, you can enter the ciphertext with spaces but no other non-
alphabetical characters are allowed.
5. No explicit exit command provided, use the BREAK key to exit the program.

For field operation, this port requires your keyphrases to be hardcoded in the
line 100 and 110 `DATA` statements. You can change the line numbers as long as
they remain the first `DATA` statements in the device's program memory.

Credits
-------
Created by Luxferre in 2025, released into the public domain with no warranties.

The original CONDI cipher was created by Wilfred Higginson in 2011.