LC4 · ELSIEFOUR

LC4 (its author also calls it ElsieFour) blends three older ideas: the evolving internal state of the RC4 stream cipher, the lettered grid of the Playfair cipher, and a plaintext-dependent keystream — the property that lets it authenticate.

It uses a 36-character alphabet: #_ then 2–9 then a–z. The # and _ stand in for 0 and 1 so they are never confused with O, I, or l, and they double as word separators. The key is a random arrangement of those 36 tiles in a 6×6 grid — about 2¹³⁸ possible keys. A marker rests on one tile, starting top-left.

Each tile carries a fixed pair of small numbers, its row and column in the plain alphabet (0–5 each). Those numbers are read off the tile under the marker to decide how far you jump from a plaintext tile to its ciphertext tile. Because the grid rearranges after every character, that jump is different every time — a polyalphabetic cipher whose alphabet is always moving.

1. find P — Locate the plaintext tile at row r, column c.
2. jump to C — Read the tile under the marker; its two numbers are a down amount and a right amount. From P, move down and right by those (wrapping around the edges) to land on the ciphertext tile C. Write C down.
3. rotate row — Shift P's whole row one place right; the tile that falls off the right wraps to the left.
4. rotate column — Shift C's whole column one place down; the bottom tile wraps to the top. If the marker's tile moved in either rotation, the marker rides with it.
5. move marker — Read C's own two numbers and move the marker that far down and right, wrapping.

To decrypt, run the same machine in reverse: find C, step up and left by the marker tile's numbers to reach P, then do the identical row/column/marker updates.

• The nonce — safe key reuse. Before encrypting your message, run the cipher over a short random nonce (6+ characters) and throw that output away; it only stirs the grid into a fresh state. A different nonce gives a completely different ciphertext from the same key, so — unlike Solitaire, where reusing a key is fatal — you can keep one key for thousands of messages. Send the nonce in the clear; it is not secret.
• The signature — tamper detection. Append a secret signature (10+ characters, known only to you and your correspondent) to the plaintext, and encrypt the whole thing. The receiver decrypts and checks that the signature came out right. Because every tile depends on all the plaintext before it, changing even one ciphertext character scrambles the signature — so an altered or forged message fails the check. Authenticated encryption, done by hand.

Setting up the grid. The key is a random arrangement of the 36 tiles. Write it into the grid left to right, top to bottom — the example key here, 7ehtkb59cmvxy4zf2jd83rug_np6#owqilsa, fills row 0 with 7 e h t k b, row 1 with 5 9 c m v x, and so on down to row 5. To work the cipher away from a screen you make 36 physical tiles — paper cut-outs, card, or wooden chips — each marked with its letter and its two small numbers, lay them out in the 6×6 grid, and set a marker (a coin or a ring) on the top-left tile to begin.

Those two small numbers on every tile are simply its place in the plain alphabet #_23456789…xyz, written as (down, right) — value ÷ 6 and value mod 6. They belong to the letter and never change, no matter where the tile slides. Write them on each tile as you cut it out. One trap worth naming: they are the letter's coordinates in that sorted alphabet, not where the tile sits in your shuffled key — so 7 is always (1,1) whether it starts in the corner or anywhere else. In the bench below, the Tile numbers button prints all 36 at once (exactly what to copy onto physical tiles), and clicking any tile shows its own pair.

The master layout — make your tiles from this. The 36 tiles in plain alphabet order, each showing the fixed (row, col) it carries for life. Cut, print, or 3D-print all 36 from this sheet, then shuffle them into your secret key arrangement on the bench grid. Because the coordinates are baked into each tile and never move with it, a single physical set works for every key you will ever use.

Rows and columns count from 0, so the numbers run from (0,0) at # to (5,5) at z — a coordinate is never 6. (So c is (2,0) and a is (1,4), reading this fixed sheet, not the shuffled key.)

First, stir in the nonce. You run the six nonce letters through the machine and throw the output away; this churns the grid to a fresh, message-specific start, and is what lets one key be reused safely. Here is the very first nonce letter, in full:

1. The marker starts on the top-left tile, 7.
2. Find the first nonce letter s on the grid — row 5, column 4 (rows and columns count from 0).
3. Read the marker's tile, 7: its numbers are down 1, right 1. From s, move down 1 (row 5 wraps around to row 0) and right 1 → you land on b at (0,5). That is the ciphertext — and it is discarded here, because s is a nonce letter, not message.
4. Rotate s's row (row 5) one step right. Rotate b's column (column 5) one step down — which slides b from (0,5) down to (1,5).
5. Read the ciphertext tile b: its numbers are down 1, right 5. Move the marker from (0,0) down 1, right 5 → (1,5), which now holds b. The marker is on b, and the first letter is done.

Now repeat for each remaining nonce letter, always reading positions off the grid as it stands at that moment — it rearranges every step:

So the first real ciphertext character is w — the encryption of the message's first letter a. Every following letter works identically: the marker tile sets the jump to the ciphertext, P's row and C's column rotate, and the ciphertext tile sets where the marker moves next. Press Step in the bench below to watch each of these moves on the live grid.

* When the ciphertext lands in the same row as the plaintext, the row's rightward rotation carries it one column over before the column rotates — which is why w's rotated column is 1, not 0. A small bookkeeping point, faithfully followed.

LC4 is the rare hand cipher designed with modern cryptanalysis in view, and it delivers on the basics: its ciphertext is statistically uniform, so the frequency analysis that cracks classical ciphers — and the keystream bias that sinks Solitaire — finds nothing to grip. The keyspace is 2¹³⁸, and a ciphertext-only attack has no better option than brute force.

The honest caveats are about known plaintext. Kaminsky's own paper gives a backtracking key-recovery attack that needs roughly 2^58.9 work if the attacker has matching plaintext and ciphertext — far below the keyspace, though still large, and hard to mount because the plaintext is meant to be destroyed after sending. Later analysis (KIT, 2024) adds chosen-plaintext and broadcast attacks. And the old stream-cipher curse remains: one slip of the hand garbles everything after it, and working tiles, a marker, and constant rearranging is slower and fiddlier than shuffling a deck.

A 2017 refinement, LS47 (Saarinen), widens the board to 7×7 and 47 characters — room for punctuation and a passphrase-to-key scheme — and is what some reach for instead. Either way, the pair on this shelf marks the line: Solitaire is the famous attempt, LC4 is the modern state of the art, and the open question — a hand cipher that is both genuinely strong and genuinely quick — is still open.

sources · Kaminsky 2017 — the ElsieFour paper · Kopal — worked walkthrough · Saarinen — LS47 (the 7×7 refinement)