⌖ Arethusa
Steganographia · Liber I

SOLITAIRE

Root’s deck of cards · Schneier 1999

A stream cipher you run by hand with an ordinary deck of 52 cards plus two jokers — the order of the deck is the key. Schneier built it so a field agent could carry strong cryptography as nothing more suspicious than a deck of cards. It was thought secure for years; it has since been shown detectable — not broken open, but its keystream carries patterns a cryptanalyst can spot as non-random, and it has been set aside for practical use.

computation: local to your browser · verified: Schneier’s twelve published test vectors · prove the work below

01 What it is

Solitaire is an output-feedback stream cipher. The deck generates a keystream — one number from 1 to 26 for each letter of your message. To encrypt, add each keystream number to the matching plaintext letter, modulo 26. To decrypt, subtract. Encryption and decryption use the same procedure; only the add/subtract differs.

Every card has a value. Using bridge suit order — clubs 1–13, diamonds 14–26, hearts 27–39, spades 40–52 — each of the 52 cards is a number, and either joker counts as 53. When a card is read out as a keystream letter, only 1–26 is needed, so its value is taken modulo 26 (so the 2 of hearts, value 28, gives keystream 2 → the letter B).

The whole secret is the starting order of the deck. Sender and receiver must begin from decks in the exact same order. Everything else about the algorithm is public.

02 Keying the deck — the setup

"Keying" means agreeing on that starting order. Schneier gives three ways.

Where ~95 bits comes from. A newspaper bridge diagram deals all 52 cards into four hands of 13. Count the distinct deals — the multinomial 52! / (13!)4 — then read its size in bits as log₂.

distinct deals52! / (13!)4 ≈ 5.36 × 1028
log₂(52!)≈ 225.58 bits
log₂(13!) × 4≈ 32.54 × 4 = 130.16 bits
225.58 − 130.1695.4 bits

So a single bridge deal carries about 95 bits of entropy — if the column is chosen unpredictably. Two caveats. The column is printed in public, so the real secret is not those 95 bits but your private rule for which column. And it is less than the 52! ≈ 226-bit keyspace of a freely shuffled deck, because a bridge diagram only fixes which hand each card sits in — not the order within a hand, nor where the two jokers go.

What a "bit" is. A bit is one yes/no answer — a single coin flip, a binary 1 or 0. One bit tells two things apart. The rule that runs everything here: n bits name 2n possibilities, so every added bit doubles the count.

1 bit2 values · 0 1
2 bits4 values · 00 01 10 11
3 bits8 values · 000 … 111
4 bits16 values · a "nibble", one hex digit
10 bits1,024 values · ten doublings in
95.4 bits≈ 5.36 × 1028 values

Each step doubles the one above it (8 bits is a byte — 256 values — the most familiar landmark). The jump from 4 to 10 bits, 16 up to 1,024, shows how fast doubling runs away; by 95 bits the count is astronomical. Taking log₂ is just reading this backwards: "how many bits name this many possibilities."

What that buys against brute force. At a trillion guesses per second, trying every 95.4-bit possibility takes about 1.7 billion years — the expected hit landing near 850 million. For a second yardstick, point the single fastest computer on Earth at it: LineShine, the TOP500 #1 as of June 2026, runs at 2.198 exaflops — about 2.2 million times that trillion-per-second rate — yet even pretending each operation were a whole guess it still needs roughly 773 years to exhaust the space; a real guess costs thousands of operations, pushing that back into the millions of years.

Where ~1.4 bits per letter comes from. This is Shannon's estimate of the entropy of written English — how much genuinely new information a letter carries once redundancy is counted out. After "the quick brown f", the next letter is almost surely "o", so it tells you almost nothing.

26 letters, equally likelylog₂(26) ≈ 4.70 bits
− skewed frequencies (e, t common; q, z rare)≈ 4.0 bits
− digram / trigram structurelower still
Shannon 1951 — guessing experiments≈ 0.6 – 1.3 bits
Schneier's working figure1.4 bits / letter

That figure sets passphrase length. To match a freely shuffled deck (~226 bits) you would need about 160 characters of English; even the recommended 64–80 is only ~90–110 bits. A short, memorable phrase carries almost nothing — which is why it is a weak key no matter how good the rest of the cipher is.

Ideally, one key, one message — reusing a key lets two ciphertexts be subtracted to strip the key. For practial use, you could create a shared pre-agreed rule to remix the key after each message, but that does not address the issue of key reuse.

How long, really — and why brute force is the wrong question. Every figure above assumes an attacker must defeat the bridge column's full ~95 bits. But brute force attacks the key — the starting deck order — not the algorithm, which is public. So the real time to break a message depends entirely on how much genuine entropy went into keying the deck, and it ranges from instant to longer than the universe. (Testing one candidate key takes a realistic ~10,000 operations.)

short passphrase · ~28 bitsinstant
guessable "which column" rule · ~40 bitsinstant
bridge column, unpredictable · ~95 bits~7.5 million years
full 54-card shuffle · ~237 bits≈ 1049 years

All times are on the same machine, LineShine. Two worlds: a strong key is effectively never — a full shuffle is log₂(54!) ≈ 237 bits, and 1049 years is about 1039 times the age of the universe, which is just the math's honest way of writing "never." A weak key falls in seconds to months (on one laptop core the two weak rows are still only ~45 minutes and ~4 months) — the cipher's strength collapses to the key's.

But brute force is the wrong question. A huge keyspace does not make a cipher secure; what matters is whether its output is indistinguishable from random, and Solitaire's keystream measurably is not (section 05). That leak — and a reused key — are the real doors, not the brute-force wall.

03 Working one round by hand

Each keystream number costs five operations on the deck. Read the steps here, then watch them run on the live deck in the bench below — Step one letter at a time, or Run the whole message. Jokers are gold (★A / ★B) and both count as 53.

  1. move A — Find joker A and move it down one card. If it is on the bottom, it wraps to just below the top card (a joker never sits on top).
  2. move B — Find joker B and move it down two cards, wrapping the same way. Always move A before B.
  3. triple cut — Swap everything above the higher joker with everything below the lower joker. The two jokers and the cards between them stay put.
  4. count cut — Read the bottom card's value n. Move the top n cards to just above the bottom card. The bottom card itself never moves — that is what keeps the step reversible.
  5. read out — Read the top card's value n. The card n places below the top is the output. If it lands on a joker, discard it and run the round again. Reading the output does not move any cards.

Convert the output card to its keystream letter (value mod 26 → A–Z), then add it to the next plaintext letter to encrypt, or subtract it from the next ciphertext letter to decrypt — wrapping the alphabet, so A+A=B and Z is the do-nothing letter.

Card values — you need these for the count cut and the output. Using bridge suit order:

♣ clubs 1–13 ♦ diamonds 14–26 ♥ hearts 27–39 ♠ spades 40–52 ★ either joker 53

To read a card out as a keystream letter, take its value modulo 26 → 1–26 → A–Z: the 2♥ (value 28) gives 2 → B; the 5♠ (value 44) gives 18 → R. Setup: mark one joker A and the other B (say a small star and a big one). Both count as 53, but A moves down one and B moves down two — so they must be told apart.

04 The bench — watch it run

Type a passphrase to key the deck, then press Run to play the cipher across your message, or Step one letter at a time. The deck shows the top card and the struck card it points to, and the line below spells out the keystream-plus-letter arithmetic for every character.

▢ top card · ▢ struck = output · ★ jokers count 53
Deck keyed. Run to play, or Step one letter.
ciphertext
Show the work — keyed deck & full keystream
Work the text to see the path.

05 The break // run it yourself

A sound keystream should look like fair dice: two values in a row should match about 1 in 26 of the time (0.0385). In 1999 Paul Crowley measured Solitaire's and found matches near 1 in 22.5 (0.0444). Generate a stream here and watch the same bias show up on your own machine.

samples
0.0385
0.0444
0.0385 fair↑ 0.0444 Crowley0.060

What the bias actually gives an attacker. A stream cipher hides your message by adding a keystream to it: ciphertext = plaintext + key. If that keystream were truly random the result would be a one-time pad — unbreakable, because the ciphertext would reveal nothing. The bias is the crack in exactly that. When two keystream values in a row come out equal — which Solitaire does too often — subtracting the two ciphertext letters cancels the key and leaks a raw fact about the plaintext.

Worked leak. Take the commonest English pair, TH (T=20, H=8), landing where the keystream repeats — say the value 9 twice:

c₁ = T + 929 → 3 = C
c₂ = H + 917 = Q
c₂ − c₁  (from "CQ")17 − 3 = 14 = p₂ − p₁

The attacker computes c₂ − c₁ = 14 straight off the ciphertext — and that equals p₂ − p₁, because the two equal keys cancelled. They now know the second letter is 14 past the first without the key; "14 apart" plus "most common digram" points at TH.

Why this is slow, not a magic decoder. The catch: nobody tells the attacker which pairs were repeats. For a true repeat, c₂ − c₁ equals the plaintext difference; for an ordinary pair it equals that plus keystream noise. The bias only means about 1 pair in 22.5 carries the real signal instead of 1 in 26 — a faint skew that surfaces only from a large pile of ciphertext, never from one "CQ." And here is the part most accounts blur: that the keystream is distinguishable from random is the whole finding — it is what disqualifies Solitaire as a serious cipher. It is not a way to read your message. No known procedure turns the bias into plaintext at any volume; leaked information is not a decryption. Section 06 puts that in its place.

06 Where it stands

1 · Brute force — not the weakness. The keyspace is enormous (section 02). A well-keyed deck is unbreakable by brute force essentially forever, on any hardware.

2 · The keystream bias — the real cryptographic flaw, and the subtle one. Crowley (1999) showed the output is not random: when the top card repeats a value across two rounds (about 1 in 51), the output repeats ~34% of the time, pulling the match rate to 1/22.5. That makes Solitaire broken by definition — a keystream that fails the most basic randomness test cannot be called secure, and the bias lives in the algorithm, so every key inherits it. But — and this is the point most accounts blur — being distinguishable from random is not the same as being readable. The leak is tiny (Shiu 2019: ~0.0005 bits per character, about one page leaking a single bit), and no known method turns it into your plaintext at any volume.

3 · The non-reversibility — structural, and secondary. Crowley also showed the deck-advance is not one-to-one: one found edge case esists where a joker on the top and a joker on the bottom both move to second place, so two deck states collapse into one. It sounds alarming but does not stop you decrypting — you never reverse the deck; both sides run the same forward keying and one side subtracts instead of adds. What it breaks is Schneier's argument that the keystream is uniform, and it is part of why the bias exists.

4 · The operational flaws — how it actually gets broken. Not cryptography, but this is what reads your mail. Key reuse is a cliff at message number two: two ciphertexts under one key subtract to c₁ − c₂ = p₁ − p₂, the key gone, the pair pried apart by English structure — total and instant, no statistics, no waiting. A weak key falls at message number one: a short passphrase carries so little entropy that its small keyspace brute-forces in minutes. Add no recovery from a single hand-slip and an evening to encrypt a long note, and these — not the bias — are why Solitaire stays off the field.

The lesson worth keeping. A cipher's security has almost nothing to do with the size of its keyspace once that keyspace is big enough; it is about whether the output is indistinguishable from random. Solitaire is broken by definition (the bias), essentially never broken by brute force (the keyspace), and actually broken in the field only by a reused or weak key.

The honest coda: nobody has clearly done better with cards alone. Crowley's own follow-up, Mirdek, he calls "very insecure." Shiu's 2019 fixes cost the one thing that justified a card cipher — that a person can do it at a table. That is the open problem: enough internal state to resist a computer, few enough steps for a human. The modern answer that trades the deck for a grid of tiles is LC4 — the next leaf in this book.

sources reviewed · Schneier — algorithm, keying, test vectors · Crowley — the keystream bias · Crowley — Mirdek · Programming Praxis — worked implementation · Shiu 2019 — Analysis of Solitaire