The Buckinghamshire projectA key used twice cancels itself
A cipher a twelve-year-old can build in an hour, one mistake that ruins it, and the patient guessing that turns that mistake into two readable messages.
Teleprinters sent each character as five on-off signals, which gives 32 possible codes. In the letters shift of the international teleprinter alphabet, 27 of the 32 codes are the letters A to Z and the space; the other five are controls such as carriage return. Our toy cipher takes a message in those codes and combines each one with a random five-bit key symbol using exclusive or, written XOR: where the two bits match you get 0, and where they differ you get 1. XOR has one lovely property. Do it twice with the same key and you get your message back, so the same small function encrypts and decrypts.
With a truly random key as long as the message, a single ciphertext tells an attacker almost nothing. Our 37-character message has 32 to the power 37 possible keys, about 4.9 times ten to the 55, and for every 37-character message you can imagine there is a key that produces this exact ciphertext from it. That is the one-time pad, and the words one time are the whole security argument.
Our run of 26 September 2026: two messages, one key, fixed seed so anyone can repeat it| Step | What we did | What came out |
|---|
| Message one | BRING THE MAPS TO AYLESBURY ON MONDAY | 37 characters, 185 bits |
| Message two | THE TRAIN FROM BLETCHLEY LEAVES AT TE | The same length, cut to fit |
| Encrypt both | XOR each with the same 37-symbol key | Two strings of apparent noise |
| Combine the ciphertexts | C1 XOR C2 | Identical to message one XOR message two in 37 of 37 positions: the key has gone |
| Look for zeros | Positions where C1 XOR C2 is 0 | Only 9 and 14, the two places where both messages have a space |
That fourth row is the lesson. Once the key cancels, the attacker is no longer facing random noise; they are facing two English messages laid over each other, and English is full of patterns. The standard attack is called crib dragging. Guess a word that is probably in one message, a crib, and slide it along the combined text one position at a time. At each position, XOR the guess into it. If the guess is right and in the right place, what comes out is a readable piece of the other message.
Crib dragging on our two messages: how many positions give letters only, and what the right one gives| Crib | Positions tried | Letters or spaces only | The readable one |
|---|
| " THE " (five symbols) | 33 | 16 | Position 5 gives "RAIN ", from message two |
| "BLETCHLEY" | 29 | 9 | Position 15 gives "TO AYLESB", from message one |
| "AYLESBURY" | 29 | 12 | Position 18 gives "TCHLEY LE", from message two |
The middle column is the second lesson. A filter that keeps only letters and spaces is not enough: " THE " passes at almost half the positions, which is about what arithmetic predicts, since 27 of the 32 codes are usable and 27 over 32 to the fifth power is roughly 43 per cent. A longer crib is more selective, but still lets through nine or twelve candidates. What picks the right one is language: "TO AYLESB" is plainly the start of something, and "RDUAROZBE" is not. A good learner writes a scorer for that judgement, counting common letter pairs, and finds out how often it agrees with their own eye.
Ages 10 to 13
Encrypt a message with XOR by hand on paper, then in Python, then decrypt it with the same function and see why that works.
Ages 13 to 16
Reuse a key on purpose, combine the ciphertexts, and drag three cribs across the result, keeping a table of what each position gives.
Ages 16 and up
Write a scorer that ranks candidates by common letter pairs, then measure how many letters of both messages it recovers without help.
What this project is not
It is not the Lorenz machine and it is not how Bletchley Park did its work, which was far more complicated. It is the smallest cipher that shows a fault any cipher built this way has to avoid: a key stream must never be used twice. Everything in the tables is our own run of our own code, repeatable with seed 20260926.
