Wadsworth Cipher
Thirty-three positions against twenty-six: unequal gearing creates message-dependent movement.
Ciphertext-only stochastic hill climbing (2020)
Step through a message one letter at a time. Each step turns the inner disk until the next plaintext letter reaches the index mark at the top; the outer disk is geared to it, so it turns by the same number of teeth. Whatever outer symbol lands under the index is the ciphertext — the count of turns, read off a 33-position scale.
Honest limits. The surviving device is a physical object; this is a model of its arithmetic, not a replica of its handling. Two choices here are the museum's own and are not documented settings: the inner disk is mixed by a keyword, and both disks start at their first position. The sources describe the disks, the 26:33 gearing and the turns-as-ciphertext rule — not a key schedule or a starting convention.
Why This Matters
Wadsworth’s device used 33 outer positions against 26 inner positions; Wheatstone’s better-known design used 27 against 26. In the arithmetic model here, repeatedly encrypting the same letter consecutively advances the outer position by 26 each time, visiting all 33 positions before repeating. Intervening different letters change the advance, so this is not a guarantee about arbitrary separated occurrences of a letter.
Decius Wadsworth was a colonel in the United States Army's Ordnance Corps, and it was there, in 1817, that he produced the cipher device that carries his name. Its operational use is not established by the cited archival record.
Louis Kruh's study of the device, the standard reference, is titled The Mystery of Colonel Decius Wadsworth's Cipher Device — and the word is doing real work. This exhibit makes no claim about where the device was carried, which dispatches it protected, or which office adopted it, because the record does not support one. It was a personal invention by a serving officer, and its operational history is obscure.
What survives instead is the mechanism — and, unusually for this museum, the object. The device itself is engraved "Decius Wadsworth 1817". William F. Friedman came across it at the Hamden Historical Society in Connecticut in the 1940s and borrowed it for the Army Security Agency's museum; Friedman's own assessment was that it is the first modern disk cipher invented. The Hamden Historical Society still holds it, and it went on display at the National Cryptologic Museum in the summer of 2024.
Two disks, one inside the other, geared together so that neither can turn alone.
Outer disk: 33 positions
A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
plus the digits 2 3 4 5 6 7 8
Inner disk: 26 positions
the letters only
Gearing: 26 : 33 (no common factor)
To encipher one letter:
1. Turn until the plaintext letter reaches the index
2. Count the teeth that went by (1 to 26 — never zero)
3. Send the outer symbol now standing at the index
The count is the message. "Turn until the letter comes up" means a repeated letter is not free: bringing T back round to T costs a full revolution of the inner disk, twenty-six teeth. And twenty-six teeth on a thirty-three-position outer ring does not return you to where you started. That single fact is the engine of the whole design.
Worked example — ATTACK, keyword WADSWORTH
The keyword lays out the inner disk as W A D S O R T H B C E F G I J K L M N P Q U V X Y Z. Both disks start at their first position.
| Plain | Inner position | Teeth turned | Outer lands on |
|---|---|---|---|
| A | 1 | 1 | B |
| T | 6 | 5 | G |
| T | 6 | 26 | 8 |
| A | 1 | 21 | U |
| C | 9 | 8 | 4 |
| K | 15 | 6 | B |
Ciphertext: BG8U4B. Look at the two Ts — G and 8. Look at the two As — B and U. A single plaintext letter need not have one fixed ciphertext equivalent; statistical structure still exists.
Note also the honest wrinkle: the final K also lands on B, colliding with the first A. The 33-symbol cycle applies to consecutive repetitions of a letter, not arbitrary occurrences throughout a message — different letters may share a ciphertext symbol. And because one turn moves the outer disk by between 1 and 26 teeth, seven of its thirty-three positions are out of reach from wherever it currently stands — a different seven at every step.
Feed the letter A to the device forty times and, after the first, the outer disk advances twenty-six positions every time — a repeated letter always costs a full revolution of the inner disk. Because 26 and 33 are coprime, those advances walk every one of the thirty-three outer symbols before the sequence repeats — on the thirty-fourth A, not before. The disks themselves only return to their common starting alignment after 858 teeth, the least common multiple of 26 and 33.
In 2020 Thomas Kaeding published an automated attack covering this whole family of devices — what he calls "cipher clocks", the machines built from revolving hands or rotating concentric disks: Wheatstone's Cryptograph, Wadsworth's device, and the Urkryptografen. The key observation is structural. The action of a cipher clock factors: it is a stream cipher followed by a monoalphabetic substitution. Once you see it that way, the disk arrangement stops being an unbreakable physical secret and becomes an ordinary substitution sitting on top of a known, deterministic stream — and substitutions fall to search. Kaeding hill-climbs the substitution against a fitness measure of how well the result looks like the stream component alone, with no crib and no known plaintext.
Kaeding’s attack illustrates why a mechanical cycle length is not a security level. The disk arrangement and deterministic movement provide structure for automated search. Nothing here establishes that Wadsworth’s design defeated all nineteenth-century pencil-and-paper analysis.
| Concept from Wadsworth's device | Modern evolution |
|---|---|
| Coprime disk sizes stretch the period to their least common multiple | Coprime LFSR lengths in stream-cipher combiners; the same trick, and the same insufficiency on its own |
| The model’s movement depends on the next plaintext letter | Compare with synchronous stream ciphers, whose keystream generation is independent of plaintext |
| Structure that factors into stream-then-substitution | Divide-and-conquer cryptanalysis: attack the components separately rather than the composition |
| Long period, small secret | Period is not entropy — security is bounded by keyspace, not by how long the output takes to repeat |
| Exhibit | 69 of 174 |
| Hall | VII — Mechanical Cipher Machines |
| Inventor | Col. Decius Wadsworth, U.S. Army Ordnance Corps |
| Year | 1817 |
| Outer disk | 33 positions — A–Z plus 2–8 |
| Inner disk | 26 positions — letters only |
| Gearing | 26:33 |
| Period | 858 teeth (lcm of 26 and 33) |
| Trust | Broken |
| Broken By | Kaeding, ciphertext-only hill climbing (2020) |
Three devices in this hall turn disks against each other. They are listed here in date order, and in date order only:
| 1790s | Jefferson — 36 stacked wheels; unpublished, and it stayed in his papers until the 20th century |
| 1817 | Wadsworth — two geared disks, 26:33 |
| 1860s | Wheatstone — two geared hands on a clock face, 26:27 |
The chronology does not by itself establish transmission of ideas. Jefferson’s unpublished wheel, Wadsworth’s device, Bazeries’s later cylinder and the M-94 should not be labelled a documented direct lineage without evidence; similar mechanisms can be independently developed.
References distinguish archival observations, later historical interpretation and cryptanalytic research.
- Louis Kruh, "The Mystery of Colonel Decius Wadsworth's Cipher Device", Cryptologia, vol. 6, no. 3 (1982), pp. 238–247. DOI: 10.1080/0161-118291857037. The standard historical reference for the device. It is paywalled; the specific statements below are cited to the archival document in note 2, which this museum read directly.
- "Decius Wadsworth Disc Cipher", William F. Friedman collection, U.S. National Security Agency (declassified), item 41788379082740 — NSA scan, full text. Source for Wadsworth's rank and Ordnance service, the 1817 date, the 26-and-33 character sequences, the statement that it is not known whether the device was ever used, and that it antedates Wheatstone's by half a century.
- National Cryptologic Foundation, "Inventors' Day & the Wadsworth Cipher", Cryptologic Dates in History — NCF calendar entry. Source for the "Decius Wadsworth 1817" engraving, Friedman's discovery of the device at the Hamden Historical Society in the 1940s, his assessment of it as the first modern disk cipher, and its display at the National Cryptologic Museum in summer 2024.
- Thomas Kaeding, "Automated ciphertext-only attack on the Wheatstone Cryptograph and related devices", IACR Cryptology ePrint Archive, report 2020/1492 (2020). The cryptanalysis: the "cipher clock" family factors into a stream cipher followed by a monoalphabetic substitution, which a stochastic hill-climbing attack then breaks from ciphertext alone.