The circular autokey cipher described in the X thread (dubbed the "ouroboros cipher" by its creator, Lily Ashwood) is a variant of a shifting Caesar cipher with an autokey mechanism that's looped in a ring, making it self-referential like a snake eating its tail. It operates on uppercase English letters (A-Z), treating them numerically as A=0, B=1, ..., Z=25 for modular arithmetic base-26. The key innovation is that there's no external key; instead, the shift for each letter is derived from the previous letter in the plaintext, with the sequence wrapping around circularly.
### How the Cipher Works
- **Encryption Process**:
1. Convert the plaintext to numbers: A=0, B=1, ..., Z=25.
2. For each position i (1 to n, where n is message length):
- The shift amount for the i-th letter is (numerical value of the (i-1)-th letter 1) mod 26.
- For the first letter, the "previous" is the last letter (circular).
- Ciphertext letter i = (plaintext letter i shift) mod 26.
3. Convert back to letters.
- **Example: Encrypting "CAT" (odd length, n=3)**
Plaintext: C=2, A=0, T=19
- Shift for C (previous=T=19): (19 1) mod 26 = 20
C shifted: (2 20) mod 26 = 22 = W
- Shift for A (previous=C=2): (2 1) mod 26 = 3
A shifted: (0 3) mod 26 = 3 = D
- Shift for T (previous=A=0): (0 1) mod 26 = 1
T shifted: (19 1) mod 26 = 20 = U
Ciphertext: WDU
- **ROT13 Twin Example**: ROT13 of "CAT" is "PNG" (P=15, N=13, G=6)
- Shift for P (previous=G=6): (6 1) = 7
P shifted: (15 7) = 22 = W
- Shift for N (previous=P=15): (15 1) = 16
N shifted: (13 16) = 29 mod 26 = 3 = D
- Shift for G (previous=N=13): (13 1) = 14
G shifted: (6 14) = 20 = U
Ciphertext: WDU (same as "CAT")
This demonstrates the core property: certain pairs (or groups) of plaintexts map to the identical ciphertext due to symmetries in the modular math.
### The Mathematical Inevitability: Why Odd Lengths Collapse to ROT13 Behavior
The cipher's equations can be expressed as a system where each ciphertext letter c_i satisfies:
c_i ≡ p_i p_{i-1} 1 mod 26 (with indices wrapping circularly).
Rearranging: p_i p_{i-1} ≡ c_i - 1 mod 26.
This forms a circulant linear system over the ring Z/26Z. For decryption (given c, solve for all possible p that could encrypt to it), the number of solutions depends on the kernel (null space) of the associated homogeneous system p_{i-1} p_i ≡ 0 mod 26 for all i (circular).
- **Kernel Analysis**:
- The homogeneous solutions follow p_i ≡ (-1)^{i-1} * k mod 26, where k is a scalar.
- Closing the loop imposes p_1 ≡ (-1)^n * p_1 mod 26.
- For **even n**: The condition always holds, and k can be any value (0-25), yielding 26 solutions. These correspond to adding an alternating pattern (±k repeating) to a particular solution, creating 26 equally plausible plaintexts mathematically. A human must inspect them to pick the "English-like" one.
- For **odd n**: The condition simplifies to 2 p_1 ≡ 0 mod 26, so p_1 must be 0 or 13 mod 26. This yields only 2 solutions. Notably, the non-trivial one adds 13 to every letter (since -13 ≡ 13 mod 26, making the alternating pattern collapse to a uniform 13 shift).
Thus, for odd-length messages:
- There are always exactly two valid plaintexts for any valid ciphertext: the original and its uniform ROT13 transformation.
- This happens independently for each character due to the circular dependencies, but the math forces the symmetry. The "collapse" means the cipher effectively behaves as if it were ROT13-invariant—the twins are always separated by a 13 shift across the entire message.
- Exception noted in the thread: This doesn't hold for odd-length strings of identical letters (e.g., "ZZZ"), which Claude calls the "eye of the ouroboros," likely because the uniform values disrupt the alternating kernel pattern.
For even-length messages, no such ROT13-specific collapse occurs; all 26 decryptions are symmetric and valid, without privileging the 13 shift.
### Decryption Ambiguity and Cracking
- **Odd n**: Easy to crack—brute-force the two options and pick the sensible one.
- **Even n**: Harder mathematically (26 options), requiring semantic judgment (e.g., "looks like English").
- In code analysis (as Claude did on the Python implementation), this emerges from solving the system, revealing the base-26 symmetries.
This cipher highlights how simple autokey rules, when made circular, introduce fascinating algebraic structures—unintended freeloaders like ROT13 living "rent-free" inside due to mod-26 even divisions. The diagram in the post (a screenshot of Claude's explanation and the
Ouroboros.py code) visualizes these chains as looped dependencies, mirroring the confusion in its twisted, self-referential form. If you'd like examples for even-length messages or a Python snippet to experiment, let me know!