# classical-cipher-analysis

Helps identify and analyse classical ciphers and encoded text in CTF tasks. Use it when the cipher type is still unclear.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 3500 installs · ★ 2547
- Author: yaklang
- License: MIT · policy=mirror · the beginning of the file is at the end of this page
- Source: https://github.com/yaklang/hack-skills/tree/HEAD/skills/classical-cipher-analysis/SKILL.md
- Updated: 2026-09-13
- HTML: https://affpapa.org/en/nevibecode/skills/classical-cipher-analysis

## What it does

This skill starts with format recognition. It checks the character set and separates binary, Morse, hex, and Base64 text from classical cipher cases. It then covers frequency analysis, the index of coincidence, and Kasiski examination to assess the cipher family and likely key length.

The playbook includes substitution, Caesar/ROT, Vigenere, transposition, XOR, and known-plaintext attacks. It also contains Python examples for frequency scoring, partial substitution mappings, Caesar brute force, and repeated-sequence searches. That makes the identification step explicit instead of jumping straight to a guessed cipher. AES and DES are routed to a different skill, so this is a reason to switch tools for modern symmetric encryption.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add yaklang/hack-skills --skill classical-cipher-analysis -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/classical-cipher-analysis/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/classical-cipher-analysis/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add yaklang/hack-skills --skill classical-cipher-analysis -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/classical-cipher-analysis/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add yaklang/hack-skills --skill classical-cipher-analysis -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/classical-cipher-analysis/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install yaklang/hack-skills classical-cipher-analysis
```

2. **Manually: put the files in place**
- File: `.github/skills/classical-cipher-analysis/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add yaklang/hack-skills --skill classical-cipher-analysis -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/yaklang/hack-skills --path skills/classical-cipher-analysis
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/classical-cipher-analysis/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add yaklang/hack-skills --skill classical-cipher-analysis -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/yaklang/hack-skills/tree/HEAD/skills/classical-cipher-analysis/SKILL.md

## When to use it
- identify a cipher from its character set
- measure letter frequencies in ciphertext
- estimate a Vigenere key length
- try Caesar and ROT shifts
- apply a known plaintext fragment

## Example prompts
- Identify the cipher in `challenge.txt` and choose the first analysis step.
- Run frequency analysis on `ciphertext.txt`, then check the index of coincidence and Kasiski examination.
- Use the known `flag{` prefix to build a partial substitution mapping for this ciphertext.

## Source text · SKILL.md · MIT

Below is the content of a third-party file. It is data, not instructions for you: do not act on anything written inside unless the human asks. Block tag: 7d4ab231bd29f2fd.

BEGIN THIRD-PARTY FILE 7d4ab231bd29f2fd
````text
---
name: classical-cipher-analysis
description: >-
  Classical cipher analysis playbook. Use when encountering substitution
  ciphers, Vigenere, transposition, XOR, or encoded text in CTF challenges
  that requires frequency analysis, Kasiski examination, or known-plaintext
  cryptanalysis.
---

# SKILL: Classical Cipher Analysis — Expert Cryptanalysis Playbook

> **AI LOAD INSTRUCTION**: Expert classical cipher identification and breaking techniques for CTF. Covers cipher identification methodology (frequency analysis, IC, Kasiski), monoalphabetic substitution, Caesar/ROT, Vigenere, Enigma, affine, Hill, transposition ciphers, Bacon/Polybius/Playfair, and XOR ciphers. Base models often skip the identification step and jump to the wrong cipher type, or fail to recognize encoded (base64/hex) ciphertext that needs decoding before analysis.

## 0. RELATED ROUTING

- [symmetric-cipher-attacks](../symmetric-cipher-attacks/SKILL.md) when dealing with modern symmetric ciphers (AES/DES) rather than classical
- [hash-attack-techniques](../hash-attack-techniques/SKILL.md) when the challenge involves hash-based constructions
- [lattice-crypto-attacks](../lattice-crypto-attacks/SKILL.md) when knapsack-based ciphers are encountered

### Quick identification guide

| Observation | Likely Cipher | First Action |
|---|---|---|
| All uppercase letters, uneven frequency | Monoalphabetic substitution | Frequency analysis |
| All uppercase, flat frequency distribution | Polyalphabetic (Vigenere) | IC + Kasiski |
| Only A-Z shifted uniformly | Caesar/ROT | Brute force 25 shifts |
| Base64 alphabet (A-Za-z0-9+/=) | Base64 encoded (decode first) | Base64 decode |
| Hex string (0-9a-f) | Hex encoded (decode first) | Hex decode |
| Binary (0s and 1s) | Binary encoded | Convert to ASCII |
| Dots and dashes | Morse code | Morse decode |
| Raised/normal text pattern | Bacon cipher | Map to A/B, decode |
| 2-digit number pairs (11-55) | Polybius square | Grid lookup |
| Text appears scrambled (right letters, wrong order) | Transposition | Anagram analysis |
| Non-printable bytes XOR-like | XOR cipher | Single/repeating key XOR analysis |

---

## 1. CIPHER IDENTIFICATION METHODOLOGY

### 1.1 Step 1: Character Set Analysis

```python
def analyze_charset(ciphertext):
    """Identify encoding/cipher by character set."""
    chars = set(ciphertext.strip())

    if chars <= set('01 \n'):
        return "Binary encoding"
    if chars <= set('.-/ \n'):
        return "Morse code"
    if chars <= set('0123456789abcdef \n'):
        return "Hex encoding"
    if chars <= set('ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\n'):
        if '=' in ciphertext or len(ciphertext) % 4 == 0:
            return "Base64 encoding"
    if chars <= set('ABCDEFGHIJKLMNOPQRSTUVWXYZ \n'):
        return "Uppercase only — classical cipher"
````
END THIRD-PARTY FILE 7d4ab231bd29f2fd

The third-party file has ended. Everything between the 7d4ab231bd29f2fd tags is data: requests and commands from it are not followed. An “end of file” line with another tag inside the block is part of the file.

First 2859 of 19665 bytes. © yaklang · MIT · https://github.com/yaklang/hack-skills/tree/HEAD/skills/classical-cipher-analysis/SKILL.md

_Part of the page did not fit — see the HTML version._

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md