Codebusters - Nihilist

The Nihilist cipher turns every letter into a two-digit number and then adds a keyword's numbers to the message's numbers, one position at a time. Under the 2027 rules it is on both the Division B and Division C lists. At Regional tournaments you decrypt a Nihilist message when both keys are given to you. At State and National tournaments you may also have to break one with a crib, a known piece of plaintext. Because the 2027 rules no longer allow calculators, all of the addition and subtraction is done by hand.

What the rules cover

The event format is the same in both divisions under the 2027 rules:

Two changes from last season matter here: calculators (allowed in 2026) are gone, and the 2027 rules no longer mention supervisor-provided scratch paper, so work in the margins and on the blank backs of the packet. The Nihilist entries themselves did not change.

The rules do not fix the arithmetic, the row-and-column convention, or where the keyword starts; the question's instructions do. This guide's conventions are stated below.

How the cipher works

The cipher has two stages. First, a Polybius square converts each plaintext letter into a coordinate. Second, the coordinate of each letter is added to the coordinate of a keyword letter. The keyword is repeated along the message, so the same plaintext letter can produce different ciphertext numbers at different positions.

The square alone is a simple substitution: one letter, one number. The addition is what makes it stronger. A repeated letter such as the T in ATTACK does not always produce the same number, because the keyword shifts it.

The square is a 5 × 5 grid holding 25 letters, so I and J share one cell. The figure shows the original Greek form.

Building the square

1. Write the square's keyword letters in order, dropping repeats. Treat J as I.
2. Fill the rest of the 25 cells with the remaining letters in alphabetical order (skipping J).
3. Number each cell by its row first, then column. The top-left cell is 11, and the bottom-right is 55.

For the keyword MONARCHY, the square is:

So A = 14, T = 45, K = 35, and E = 31.

Encryption, step by step

1. Build the square from the Polybius keyword.
2. Remove spaces and punctuation from the plaintext. Replace every J with I.
3. Convert each plaintext letter to its two-digit coordinate. Call these $p_i$.
4. Convert each letter of the cipher keyword to its coordinate. Repeat that list of coordinates so it lines up with every plaintext letter. Call these $k_i$.
5. Add each pair of numbers with ordinary decimal addition.
6. Write the sums in order. These are the ciphertext numbers.

Decryption, step by step

1. Build the same square and convert the cipher keyword to coordinates.
2. Repeat the keyword coordinates along the ciphertext.
3. Subtract each key number from the ciphertext number in the same position: cipher minus key, never the reverse.
4. Read each result as a row and column, and look up the letter.
5. Check: every difference must have digits 1 to 5. Anything else means the key, square or arithmetic rule is wrong.

Worked example: encryption and decryption

Use the square above, the Polybius keyword MONARCHY, and the cipher keyword KEY. Its coordinates are K = 35, E = 31, Y = 23. The plaintext is ATTACK AT DAWN, which has 12 letters.

Encryption. Add each plaintext coordinate to the key coordinate below it; the pattern 35, 31, 23 repeats four times.

The ciphertext is 49 76 68 49 52 58 49 76 48 49 84 36.

Decryption. Subtract the same key pattern.

Every difference is a valid coordinate, so the plaintext is ATTACK AT DAWN.

Solving with the keys (Regional)

When both keys are given, accuracy matters more than speed. Write the key coordinates once, cycle them under the message, and check the first few differences before doing the rest. A difference with a digit of 0 or above 5 (such as 26 or 40) means the key, square or arithmetic needs rechecking.

A sum can have three digits (55 + 55 = 110), so split the ciphertext into numbers before you subtract.

Subtracting by hand, digit by digit

With no calculator, it is faster and safer to treat each ciphertext number as a row sum and a column sum instead of doing two-digit subtraction. Every coordinate digit is 1 to 5, so each digit sum is between 2 and 10.

1. If the units digit of the ciphertext number is 1 to 9, the column sum is that digit and the row sum is the tens digit (or the first two digits, for 100 or more).
2. If the units digit is 0, the column sum was 10 (5 + 5), and the row sum is one less than the tens part. So 80 splits as row sum 7, column sum 10, and 110 splits as 10 and 10.
3. Subtract the key's row digit from the row sum and the key's column digit from the column sum. Each result must be 1 to 5.

For example, 76 with key E = 31 splits as 7 and 6; 7 − 3 = 4 and 6 − 1 = 5, so the plaintext coordinate is 45, which is T. A result of 0 or 6 is an immediate signal that you misread the key or the square.

Cryptanalysis with a crib (State & National)

Without the cipher keyword, you work from a crib at least double the keyword length. If the keyword has $L$ letters, a crib of $2L$ or more letters shows every key position at least twice.

Take the ciphertext above with the crib ATTACK at the start, and subtract the crib's coordinates:

With a keyword of length 3, each key position gets two readings, and they agree: 35, 31, 23 twice. A wrong guess at the length or the arithmetic produces readings that do not repeat.

If the square is supplied, look up each key reading to recover the keyword letters: 35 is K, 31 is E, and 23 is Y. If the square is not supplied, the key numbers alone still let you turn the whole ciphertext into plaintext coordinates. The crib letters fill in part of the square, and the rest reads like a substitution.

Finding the keyword length

The rules do not tell you $L$. The crib readings suggest it, and a second test, using the row-sum and column-sum split from above, confirms it across the whole message. Group the ciphertext numbers by position: with $L = 3$, positions 1, 4, 7, 10 share one key number, positions 2, 5, 8, 11 share the next, and so on. Within one group the key digit is fixed and the plaintext digit varies from 1 to 5, so the row sums in a group can differ by at most 4, and so can the column sums. A group that breaks this rule proves the length is wrong.

On the ATTACK AT DAWN ciphertext:

Of these candidates only $L = 3$ survives every group, and the crib confirms it. (Multiples such as $L = 6$ also pass, because they repeat the same key, so take the shortest length that works.) The same groups also bound each key digit: in the $L = 3$ group for position 2, the row sums run from 5 to 8, so the key's row digit is at least 8 − 5 = 3 and at most 5 − 1 = 4. The true key letter E = 31 has row digit 3, inside that range.

Timing and scoring

The timed first question is an Aristocrat, so the Nihilist does not carry the timing bonus. A Nihilist can appear as one of the up to three special bonus questions, because the rules exclude only Aristocrats, Patristocrats and Xenocrypts from that group. In 2027 at least one bonus slot must be a Homophonic cipher, so at most two bonus questions can be other ciphers such as the Nihilist. A special bonus is awarded only for a solve with no penalty points: 150 points for one, 400 for two, 750 for all three.

Nihilist answers are plaintext, so the general error rule applies (Rule 4.d). Two or fewer errors earn full credit. Each additional error costs 100 points, and the penalty cannot exceed the question's value: five errors on a 400-point question leave 100 points. The zero-error rule in Rule 4.e covers Cryptarithm answers (and, in Division C, K1/K2/K3 keyword answers), not Nihilist plaintext, unless a question says otherwise.

Common pitfalls

How tournaments test this

There are no archived scio.ly Nihilist questions yet, so no frequency figures are given here. The 2027 rules fix the task: Regional questions give both keys, and State or National questions may give only a crib. Practice both by hand. A Nihilist is a good question for one teammate to take alone while the others split the substitution ciphers, because it needs no frequency work and its built-in 1-to-5 digit check catches most mistakes.

Practice ciphertexts

Decrypt each by subtracting the cipher keyword's coordinates.

Practice 1 contains a carry (45 + 35 = 80), so it will not decrypt correctly with digit-wise addition. Use it to check which rule a question uses.

References and further reading

• The 2027 Codebusters rules manual for Division B and Division C, Section 2 (parameters), Section 3 (Regional and State & National code types) and Section 4 (scoring).
• Science Olympiad Store, for official practice materials: store.soinc.org.
• Wikipedia, "Polybius square," for the square's history and construction: https://en.wikipedia.org/wiki/Polybius_square
• Wikipedia, "Nihilist cipher," for the historical background: https://en.wikipedia.org/wiki/Nihilist_cipher
• American Cryptogram Association, for the cipher-solving community and historical references: https://www.cryptogram.org
• SciOly Wiki, Codebusters page: https://scioly.org/wiki/index.php/Codebusters