Matt RuckmanThe Note In The Drawer
On the eighty-seven squiggles Edward Elgar sent to a twenty-three-year-old in 1897, the six categories of cipher that fail to crack them, and the kind of secret cryptanalysis was never built for.
On the fourteenth of July, 1897, the most celebrated composer England would produce in the entire Victorian era sat down at his desk in Malvern, Worcestershire, and drew eighty-seven small curling shapes on a piece of cream-colored paper. He arranged them in three neat rows. He included no key. He included no explanation. He folded the paper, slipped it inside a perfectly normal social letter his wife Alice had written to a twenty-three-year-old family friend named Dora Penny, and sent it.
Dora opened the envelope. Read Alice's letter. Found the squiggles. Stared at them for a while. Put them in a drawer.
The squiggles are still there. (Or rather, somewhere; Dora kept the note her entire life, never solved it, published a memoir in 1937 that included the cipher as a facsimile and a polite request to readers welcoming any suggestions, and died in 1964 still wondering.) The cipher is now called the Dorabella, after a nickname Elgar had borrowed for her from a character in Cosi fan tutte. It has resisted every cryptanalyst, codebreaker, computational linguist, GPU cluster, and bored Reddit user who has ever taken a serious run at it. One hundred and twenty-eight years and counting.
Some context for the kind of person who would send a twenty-three-year-old a cipher and expect her to enjoy it. Edward Elgar in 1897 was forty, married, increasingly famous, and had been (this is the relevant detail) making and sending little ciphers all his adult life. Two years after the note, he composed the Enigma Variations, a set of orchestral variations on a theme he claimed concealed another theme, a hidden counter-melody he never named and which, asked about it for the rest of his life, he refused to reveal.
He named the house he bought in 1899 Craeg Lea, which is an anagram of the initials of himself and his wife and daughter. He kept notebooks of ciphers and cryptograms. He left a famous undeciphered cipher in the margin of a concert program at a Crystal Palace event honoring Liszt, which nobody has decoded. The Dorabella is not an aberration in this man's life. It's a Tuesday.
He was also working in a culture that had cipher fever. The London Times ran personal-ad columns called "agony columns" where lovers, deserting husbands, and runaway daughters communicated in homemade ciphers nobody was supposed to read but everybody did.1 Newspaper puzzle pages ran cryptograms as standing features. In 1903 Arthur Conan Doyle published "The Adventure of the Dancing Men," a Sherlock Holmes story whose entire plot turned on a substitution cipher, and Doyle didn't have to explain to his readers what one was. The Victorian middle class was, on average, more cryptographically literate than the modern middle class is today, which is, depending on how you think about technology, either embarrassing or comforting.
What I'd like to do here is walk you through a handful of historical ciphers that have either been famously broken or famously not been broken, and use them as a kind of lit map for the eighty-seven squiggles in the drawer. Each section opens with a cipher that has resisted everything we've thrown at it, walks back through the technique that produced it, and ends with what that technique tells us about the Dorabella. The Dorabella analysis itself is at the close.
1. Why HAIL CAESAR finally fell
The simplest cipher in the world is approximately as old as writing-things-down-on-purpose: shift every letter of your message by some fixed number, send the result. Caesar (the Julius Caesar) reportedly used a three-shift, which means he sent his generals notes that looked like KDLO FDHVDU and expected them to figure out HAIL CAESAR on their own,2 and which also means that the entire intellectual content of the cipher is the number three.
It is mildly embarrassing for the Western tradition that this cipher held up for roughly eleven hundred years.
In ninth-century Baghdad, a polymath named Abū Yūsuf Yaʿqūb ibn Isḥāq al-Kindī,3 who wrote on philosophy and music and medicine and metallurgy and was on retainer to several caliphs, wrote down something nobody before him had bothered to: in any given language, the letters do not appear with equal frequency. In English, E shows up about 13% of the time, T about 9%, A about 8%; the J and Q and Z bring up the rear at well under 1%.4 In Arabic the curve looks different but still has a curve. Once you've measured the curve for the language you're working in, a Caesar cipher (or any monoalphabetic substitution, which is a Caesar with a fancier offset table) cannot hide. The letters line up against the curve in only one orientation. You count, you align, you read.
A small puzzle for you. The above is a Caesar cipher of a phrase relevant to this piece. The shift is somewhere between 1 and 25; al-Kindī's method will get you there in about thirty seconds with a pencil and less with the graphic above.5
2. Flatten the curve, lose your head
In 1838, the Hungarian aristocrat Gusztáv Batthyány donated his family library to the Hungarian Academy of Sciences. Among the books was a 448-page manuscript, hand-written on Venetian paper that watermark analysis dates to the 1530s, illustrated with 87 small scenes mixing Christian crosses, Islamic crescents, and what look like pagan deities in arrangements no scholar of any of the three traditions has been able to make sense of. The text uses around 792 distinct characters. It is called the Rohonc Codex, after the town in western Hungary (now Rechnitz, Austria) it was associated with. Nobody could read it then. Almost nobody can read it now.
That count is far more than any natural alphabet (Latin 23, Greek 24, Cyrillic 33, Arabic 28), and roughly what you'd expect from a heavy homophonic substitution: many cipher symbols mapping to a smaller underlying inventory of letters. A 2018 paper by Levente Király and Gábor Tokai proposed the manuscript is a religious text in a homemade Hungarian-derived script working on phonetic principles; the field has not converged on whether they're right. As unsolved manuscripts go, it's one of the cleaner cases.
The more famous one is the Voynich Manuscript, which I have written about elsewhere, and which sits in a similar statistical neighborhood for similar reasons. Both manuscripts have had serious cryptanalysts attached to them. William and Elizebeth Friedman (the most accomplished American cryptanalytic couple of the 20th century; Elizebeth alone broke Prohibition-era rumrunner ciphers, Nazi spy networks operating in South America, and approximately every other significant American cryptanalytic problem of her era) spent years on the Voynich. Both manuscripts share the same defining property: the encoding, whatever it is, appears to have been designed to flatten the frequency curve al-Kindī built his attack on.
The technique is called homophonic substitution. You assign three or four cipher symbols to E. Two or three to T. Pick freshly each time. The output frequencies plateau, and al-Kindī's method becomes inconclusive shrug. It was understood and used at the highest stakes by the 1580s.
The Vatican curia, the Venetian senate, and the French court all wrote in heavy homophonic systems by the 1580s. Mary Stuart, Queen of Scots, did not. Imprisoned in England under her cousin Elizabeth,6 Mary corresponded with her co-conspirators in a simpler nomenclator: a monoalphabetic substitution, twenty-three letters with one symbol each, plus a small dictionary of code words for the people and places her side talked about most. The trouble she ran into was that her cousin's spymaster Sir Francis Walsingham (a man whose surviving portraits communicate I have read your mail) had on retainer a cryptographer named Thomas Phelippes who could break monoalphabetic ciphers in his sleep. Mary's correspondents gave him plenty of text.
Phelippes broke the ciphers within days. Walsingham, who had intercepted everything from the start, then had Phelippes forge an additional postscript, in Mary's own cipher, asking the conspirators to please name the six gentlemen who would be doing the assassinating. They did. Mary was beheaded in February 1587. The cipher was the deciding piece of evidence.
Mary's cipher was her most secure communication tool, and it killed her. Every cryptographic disaster has the same shape: an interval during which the cipher has stopped working and the people using it don't know. Mary's was about a year. Germany used Enigma for most of the war without knowing it was readable, which on the standard estimate shortened the war in Europe by two years and saved on the order of fourteen million lives. 7
3. Le chiffre indéchiffrable, briefly
In 1939, an Oxford-educated, Russian-born cryptographer named Alexander d'Agapeyeff published an introductory cryptography textbook called Codes and Ciphers (apparently you can still buy it on Amazon), and at the back, as a fun challenge for readers, he included a 196-character cipher he had made up himself. Nobody solved it. In a later edition he removed the challenge entirely and admitted that he had forgotten the method by which he had encrypted it.
Polyalphabetic substitution uses a different substitution alphabet at every position. The first E in your message might encrypt to L, the second to W, the third to A. What tells you which alphabet to use where is, satisfyingly, a keyword.
The classic polyalphabetic cipher is the Vigenère (1553, published by Giovan Battista Bellaso, credited later to Blaise de Vigenère, which is, I gather, how cryptography typically goes), and it works like this. Pick a keyword. Say, ELGAR. Write your plaintext. Repeat your keyword underneath, letter by letter. Each plaintext letter is shifted by the alphabetic position of the keyword letter beneath it. Same plaintext letter, different positions, different cipher letters. The frequency curve flattens for a different reason than under homophonic substitution, but the cryptanalyst sees the same flat curve.
Vigenère held up for about three hundred years. Cryptographers called it le chiffre indéchiffrable, the cipher that cannot be deciphered. Charles Babbage, the Englishman best known for designing one of the first mechanical computers, almost certainly broke Vigenère in the 1850s. We know he did because they're in his notes, but no publication of it. The most popular theory for why is that the Crown Office asked him not to: Britain was using Vigenère-style ciphers in the Crimean War, the Russians were too, and a British cryptanalyst announcing he could break them all in The Times would have been a problem.
So Babbage broke it, didn't tell anyone, and a Prussian infantry officer named Friedrich Kasiski independently broke it in 1863, published, and got the credit. The method (the Kasiski examination) is clever: look for repeated letter sequences in the ciphertext, measure the distances between them, and the key length is almost certainly a factor of those distances. Once you have the key length, the problem reduces to several Caesar ciphers in parallel, and Caesar ciphers fall to al-Kindī.
The reason d'Agapeyeff still resists, presumably, is that he layered something on top: possibly a transposition, possibly a non-standard alphabet, possibly a deliberately-introduced error pattern. Without his original method to verify against, the brute-force decryption that finally produces something English-like may or may not be the intended plaintext, and the field has, mostly, given up trying to tell which.8
4. K4, eight characters longer than the Dorabella
In the courtyard of the CIA's Original Headquarters Building in Langley, Virginia, there is a sculpture by an artist named Jim Sanborn called Kryptos. It was dedicated in 1990. It's a curving copper plate, a little under twelve feet tall, with about 1,800 letters cut out of it and arranged into four ciphertexts. Sanborn designed it with a former CIA cryptanalyst named Ed Scheidt. The first three ciphers fell to the public: K1 and K2 to an NSA team in the early 1990s and independently to the computer scientist James Gillogly in 1999, K3 to Gillogly the same year. K1 used Vigenère. K2 used Vigenère. K3 used a complex columnar transposition. The fourth, K4, ninety-seven characters long, has held for thirty-five years.
Sanborn has released four cribs (known plaintexts at known positions) to date. Even with the cribs, K4 didn't fall in time. In late 2025, having turned eighty and watched the public attempts crest and recede for thirty-five years, Sanborn auctioned off the physical archive and the solution document itself; selling for $962,500. The buyer, whoever they are, now knows what the rest of us don't.
The technique behind K3, and probably underneath some layer of K4, is transposition, which is fundamentally different from every cipher we've discussed so far. Substitution ciphers (Caesar, homophonic, Vigenère) replace the letters. Transposition keeps the letters and rearranges the order. The Spartans, around 400 BCE, used a wooden rod of agreed diameter (called a scytale) around which you would wrap a strip of leather, write your message along the rod so each letter occupied one ring of the spiral, and then unwrap. Only someone with a rod of the same diameter could re-wrap and read it. The security model amounts to: you have a different stick.9 Modern columnar transposition writes the plaintext into a grid of fixed width and reads the columns out in some keyword-determined order. The plaintext letters all show up in the ciphertext, scrambled.
This is annoying for cryptanalysts because every tool we've built up to this point assumes the cipher is doing something to the letters themselves. Transposition is invisible to those tools. The ciphertext frequency distribution looks like English, because it is English, just with the letters in the wrong rooms. You need a different family of tools (anagram-based, n-gram-based, geometric) to see it.
The really bad news, for the cryptanalyst, is that transposition can be layered on top of substitution. You encipher with a Caesar (or a homophonic, or a Vigenère), then transpose the result, and now your attacker needs to undo both. The layers don't add cleanly; they multiply. Thirty-five years of attempts on K4's ninety-seven characters, with four cribs that pin down twenty-four of them, has not produced a solution. K4 is eight characters longer than the Dorabella.10
5. What happens when the key is lost
On the morning of December 1, 1948, an unidentified man was found dead on Somerton Beach, just south of Adelaide, Australia. He had no wallet, no identification; every label had been cut out of every piece of his clothing. The autopsy was unable to identify a cause of death, though the spleen was three times its normal size and the liver was distended with blood, suggestive of poisoning by an agent the toxicologists couldn't isolate. In a fob pocket of his trousers was a tiny scrap of paper torn from the last page of a book. The scrap read TAMAM SHUD, which is the Persian phrase that ends Edward FitzGerald's English translation of the Rubaiyat of Omar Khayyam, and means "ended" or "finished."
Police canvassed bookshops, and a man came forward with a copy of the Rubaiyat he had found in the back seat of his unlocked car parked near the beach. The last page was torn out, matching the scrap. Inside the back cover of that copy, in pencil, were five lines of capital letters that have all the surface signs of a one-time pad or a book cipher:
WRGOABABD MLIAOI MTBIMPANETP MLIABOAIAQC ITTMTSAMSTGAB
(The first letter of the first line is read variously as M or W; the original is faint.) The book was, presumably, the key. The book was lost. Police photographed the page and returned the book to its owner, who later disposed of it. The man was finally identified in 2022, via genealogical DNA, as Carl "Charles" Webb, an electrical engineer from Melbourne. The cipher itself remains open. Whatever Webb meant to communicate, he communicated in a code whose key vanished with him, which is among the more melancholy facts in cryptography.
The technique is the book cipher. The mechanics: pick a book both you and your recipient own. Number its words (or pages, or letters; there are variants). Find the word "ATTACK." It is the 47th word of Chapter 3, say. You write 3-47. The recipient looks it up. Repeat for every word in your message. If the cryptanalyst doesn't know your book, the cipher is essentially unbreakable, because the relationship between the cipher numbers and the plaintext lives in the book, and the book might be any book; might be a specific 1822 edition with a typo on page 144 that none of the other editions have. The intelligence problem becomes "what is on this person's bookshelf," which is a different problem from cryptanalysis.
The most famous book cipher in history is the Beale Papers, three ciphers from 1885 Virginia, the second of which was solved using the Declaration of Independence as the key and describes a buried treasure in Bedford County, the first and third of which would name the location and the heirs respectively and have never been solved. The cryptographer Jim Gillogly demonstrated in 1980 that the unsolved Beale ciphers contain alphabetic anomalies (long runs like "abcdefghi") which are statistically extraordinarily unlikely in a real book cipher, which most contemporary cryptographers take to mean the whole story was a Victorian-era prank. Treasure hunters have spent careers and small fortunes regardless. There is a kind of person to whom buried treasure is a vocation rather than a hobby, and the field of unsolved ciphers selects for that person quite specifically.11
6. Elgar's secret, taken to the grave
In 1899, two years after sending the Dorabella, Edward Elgar finished a set of fourteen orchestral variations on a theme he had improvised at the piano one evening for his wife Alice. He titled the work Variations on an Original Theme, with a parenthetical: "Enigma." Asked, in person and in print, what the enigma was, he answered that the actual theme of the Variations is a counter-melody to a larger, hidden theme that runs through the entire work but is never played. He refused to identify the hidden theme. He refused for the rest of his life. He died in 1934 with the secret intact.
The candidates proposed since then number well into the dozens: Auld Lang Syne (which Elgar specifically denied), Twinkle Twinkle Little Star, Rule Britannia, Bach's Ein feste Burg ist unser Gott, Pergolesi's Stabat Mater, Now the Day Is Over, and a long tail of folk tunes and classical themes proposed by individual researchers, each with partisans, none with consensus. The hidden theme of the Enigma Variations is, by general agreement, the most famous unsolved musical cipher in classical music, and the man who could have ended the argument with one sentence chose not to.
Bach signed his work in musical notation. The notes B♭, A, C, B♮ played in sequence, on any piano, spell BACH. The trick is that German musical notation gives those notes letter names that line up: B♭ is called B, A is A, C is C, and B♮ is called H. B-A-C-H.
Bach embedded this motif throughout his career, including as the third subject of the final, unfinished fugue of the Art of Fugue, which he died before completing. The motif is, in a sense, his signature on the piece, and possibly the last music he wrote.
The English-speaking equivalent has the same trick but a smaller alphabet. English notation has no H; you can spell only words made of A through G. Which sounds restrictive until you realize how many English words it covers (BAD, BED, FACE, FAB, BEAD, CABBAGE, DEAD, DEAF, FED, FEED) and until you notice that Edward Elgar's first name contains four of those seven letters in a row.
Elgar was, by every account, fascinated by this. He encoded names and initials throughout his published oeuvre. The fourteenth variation of the Enigma is titled E.D.U., which is Alice Elgar's pet name for him (Edoo), and is a self-portrait in sound. The thirteenth variation is titled with three asterisks and is generally believed to be about Lady Mary Lygon but might (this is contested) be about a different woman entirely. The notation system Elgar used in the Dorabella, drawn rather than written, looks superficially nothing like musical notation, but at least three twentieth-century researchers have proposed that the symbols are simplified depictions of notes on a staff, with the curls indicating duration or pitch. None of them produced a coherent reading.12
7. 1976, and the rest is the internet
Every cipher in this piece, from Caesar to Elgar's fragment, shares one feature: the sender and the recipient have to agree, beforehand, on a shared secret. The secret can be small (a shift number) or large (a one-time pad, a book both of you only know, 13 a melody only two people remember), but it has to be communicated through a separate channel before any encrypted communication can happen.
In 1976, two Stanford researchers named Whitfield Diffie and Martin Hellman published a paper that broke this assumption. Their idea: a cipher in which two strangers can establish a shared secret over a public channel, with no prior coordination, in such a way that anyone listening to the entire exchange can't reconstruct the secret. This is public-key cryptography. It is what makes the modern internet possible. This is immense and undercuts everything. It is also the subject of a different post.
I mention it here only because every cipher we have discussed is, by the standards of the modern field, a curiosity. The math has moved on. The reason any of these older ciphers still matters is partly historical, partly pedagogical, and partly because a great many ciphers in the world today are still amateur ciphers from the 19th and early 20th centuries, scribbled in the margins of letters and notebooks, sent between people who knew each other and trusted each other and never imagined a stranger trying to read.
Like, for instance, the note in the drawer.
Closing: back to the drawer
We have walked through six categories of cipher, each of which was, in its day, the cipher to use, and each of which now fails the Dorabella. Let me say what that means in plain language, by walking through what a working cryptanalyst actually thinks about when she sits down with eighty-seven squiggles in front of her.
- Frequency analysis. The first thing she tries. The Dorabella has 87 characters and 24 distinct symbols; the expected count per symbol is under four; the variance swamps the signal; nothing useful is going to come out of this. She moves on.
- Homophonic substitution. Possible, but with only 24 symbols there is barely room. She thinks about it for a while: maybe one symbol stands for two letters, contextually; maybe two symbols stand for one letter, selectively; the patterns she would need to detect to find this are exactly the patterns a short cipher hides. She runs some tests. They are inconclusive. She moves on.
- Polyalphabetic substitution. Vigenère and its descendants need detectable repeats. The Dorabella has very few. Any key length above four or five renders the message essentially random under standard tests. She tries the lengths anyway. Nothing comes out.
- Transposition. The frequency distribution doesn't cleanly match any natural language. She tries the standard column orders, the keyword-derived orders, the geometric reads. Everything is almost a match. Nothing is.
- Book cipher. The surface form is wrong; the symbols look pictorial rather than numeric. She thinks about the Cosi fan tutte libretto, since that is where the Dorabella nickname came from, and tries it. Nothing comes out. She tries the Rubaiyat. Nothing. She tries Tennyson, Shakespeare's sonnets, Dickens, the King James Bible. Nothing.
- Musical cipher. The most plausible single guess, given who Elgar was. She tries the obvious mappings: each Dorabella symbol to a note, the curl direction encoding pitch or duration, the three rows of the cipher as three voices in a counterpoint. She tries it as a key signature. She tries it as solfege. She tries treating the whole thing as a melody and asking whether any phrase from any piece Elgar and Dora both knew matches the resulting contour. Nothing comes out that survives controls.
After enough hours, what she is left with is the suspicion that the Dorabella isn't running on any of these techniques. That it is running on something stranger and more particular: a personal cipher between two people, encoded with a key that depends on a shared knowledge between Edward and Dora that nobody outside their friendship has access to, or possibly a cipher constructed on principles Elgar made up himself and used in this one note and nowhere else. A key that is a private joke. A piece of music they both knew. A nickname only they used. A date that meant something. The eighty-seven squiggles are not unbreakable in principle. They are unbreakable in practice, because the cryptanalyst, whoever she is, isn't in the room with them, wasn't there in 1897, isn't in their friendship, and doesn't have what Dora had, which is the rest of the relationship the cipher was sitting inside.
Or, and this is the option I find hardest to dismiss and hardest to prove,14 the Dorabella isn't a cipher in the strict sense at all. It is a piece of musical or visual play. A doodle. Eighty-seven squiggles drawn for a young woman the composer was fond of, with no intended readable content, sent so she would have to wonder what it said and then ask him about it, except that she didn't ask, she put it in a drawer, and Edward Elgar died in 1934 still wondering whether Dora ever wondered.
I should mention, because there is a small genre obligation to mention, that I have spent some real time on the Dorabella myself, and that the calibrated answer at the end of my own work is, more or less, that the strongest signals I could find don't survive controls. A full write-up of that work is here.15 Treat the linked paper as a long way of saying no, it didn't work.
But here is what I came out the other end of the project actually believing, which is the only thing this post has been trying to get to.
The history of cryptography is, mostly, the history of people trying to keep things secret from large adversaries: empires, armies, intelligence services, criminal syndicates. The techniques get more sophisticated; the adversaries get more sophisticated; cipher and cryptanalyst escalate together. This is the cryptography of public secrets, of secrets-with-stakes. It is the cryptography that gets written about.
The Dorabella isn't that. It is the cryptography of one person writing to one other person, about something that mattered only to them, with no adversary in mind. There is no security model. There is no threat. The only thing the cipher is trying to do is be readable to one specific person and unreadable to nobody in particular, which is, when you think about it, also approximately what speech is, and handwriting is, and the way we use private nicknames with our friends is. When two people who know each other well communicate, they are constantly using a kind of cipher (context, allusion, shared history, jokes only they get) that nobody else can fully get, really. The Dorabella is what happens when one of those people is also a composer who liked drawing little shapes.
What I think the Dorabella has been resisting, for a hundred and twenty-eight years, is being pulled out of one relationship and into a different one: out of the relationship between Edward and Dora and into the relationship between strangers and a puzzle. Whatever it says, if it says anything, it is saying it to her. Not to us.
If you want to write a cipher that resists every method modern cryptanalysis has, write a short note, in your own handwriting, to one specific person, about something only they would understand. Leave it in a drawer.
Footnotes
-
The agony columns ran on the front page of The Times for most of the nineteenth century and were the closest thing the Victorian middle class had to a public group chat: parents pleading with runaway daughters; husbands advertising for wives who had taken the savings; lovers coordinating elopements through book ciphers (one 1862 pair, signing themselves "Pio Nono" and "Pope Jean," used a romance journal called Spurs and Skirts until Pope Jean's father intercepted a message and shut it down). The column also had its professional users. Ignatius "Paddington" Pollaky, a Hungarian-born detective working out of an office at 13 Paddington Green, ran what is generally credited as Britain's first private inquiry agency from 1862; advertised his services in the column (election work, divorce, libel; "discreet enquiries in England or abroad"); and conducted live communications with witnesses and case subjects through coded ads in the same paper. His casework included spying on Confederate agents in Britain during the American Civil War, breaking up London sex-trafficking rings, and recovering abducted children. His surname became Victorian slang for over-eager questioning. Gilbert and Sullivan worked him into Patience in 1881 as "the keen penetration of Paddington Pollaky." Sherlock Holmes is, by some accounts, partly modeled on him. ↩
-
He probably did not actually expect them to figure it out on their own. He probably expected to have communicated the shift to them in advance. Cryptography assumes the receiver is in on it. This is a thing that turns out to be true at every scale of the field, from Caesar to public-key, and that we'll come back to in section 7. ↩
-
Working out how to type "Abū Yūsuf Yaʿqūb ibn Isḥāq al-Kindī" with the right symbols/diacritics would take longer this post. The macron over the A. The macron over the U. The ʿayn, which is a modifier-letter turned comma. The dot under the H. The bar over the I. This monolingual copy-pasted. ↩
-
Linguists fight about exact percentages, the rankings shift slightly depending on the corpus, English-as-spoken differs from English-as-written, English-of-Wikipedia differs from English-of-19th-century-novels. The 13% E figure is approximately correct, ETAOIN SHRDLU is approximately the right ranking, and that is all the precision this piece needs. ↩
-
Try frequency analysis on the Dorabella and the math defeats you on sample-size grounds. Eighty-seven characters is too short a stretch of text for a frequency curve to settle into anything reliable; each symbol shows up only a handful of times, and the variance swamps the signal. Any candidate substitution produces a "plausible" plaintext under any number of mappings, with no statistical way to choose between them. The observation is shallow. It is also the first reason the note in the drawer is hard. ↩
-
Yes, that Elizabeth: Elizabeth I, daughter of Henry VIII, queen of England 1558–1603. Mary was her first cousin once removed (Mary's grandmother Margaret Tudor was Henry VIII's sister). Catholic Europe regarded Mary as the rightful English queen on the grounds that the Catholic Church didn't recognize Henry VIII's marriage to Anne Boleyn and therefore considered Elizabeth illegitimate. Mary fled Scotland in 1568 after abdicating under pressure; Elizabeth, faced with a co-claimant her enemies could rally around, kept her under house arrest in a sequence of English country estates for nearly nineteen years before well, keep reading the paragraph. ↩
-
Homophonic substitution flattens the frequency curve by assigning multiple cipher symbols to each plaintext letter (three or four to E, two or three to T, and so on). The Dorabella's twenty-four symbols against the twenty-six letters of English barely covers a one-to-one mapping, let alone a many-to-one one. Strict homophony is out. But "homophonic in spirit," where one symbol sometimes stands for two letters in some context-dependent way, is much harder to rule out, and a short cipher hides exactly this kind of pattern perfectly. ↩
-
Polyalphabetic methods need detectable repeats to find the key length, and the Dorabella has very few. Any key length above four or five renders the message essentially random under standard tests, including the index of coincidence. If Elgar used a polyalphabetic scheme, he chose a key long enough relative to the message to be unrecoverable, which (and I'm aware this is the kind of statement that sounds confident only because it sounds like a sentence) means his cipher achieved one-time-pad-like resistance by accident. ↩
-
The historicity of all this is contested by classicists, who note that no Spartan source actually describes using a scytale as a cipher rather than as a tag for messengers carrying official messages. But the device existed, the description goes back to the 4th century BCE, and "Spartans had a cool cryptographic stick" is a hard idea to dislodge from popular history. There is a not-small body of cryptographic literature in which the scytale has acquired the status of foundational origin story despite (a) no compelling textual evidence and (b) a security model amounting, as the main text observes, to "you have a different stick." This is a thing that happens to origin stories. ↩
-
Transposition on its own would preserve the Dorabella's symbol-frequency distribution, and you could check whether that distribution matches some natural language's letter-frequency curve. It almost matches a few languages. It cleanly matches none. The signal is consistent with "a transposition of something," but the somethings include English, Italian, French, German, Latin, and idiosyncratic combinations of all five. Which is to say it isn't actionably consistent with anything. ↩
-
A book cipher would require a key text Elgar and Dora both shared, and the Dorabella's surface form is wrong. The symbols don't look numeric or page-and-line; they look pictorial. Elgar gave Dora the Cosi fan tutte nickname, so the libretto is a candidate; nobody has produced a coherent reading from it. Dora herself, who had every incentive to remember any shared reference, never recognized one. ↩
-
If the Dorabella is a musical cipher, the cryptanalyst's task is approximately three problems stacked together: identify which symbol corresponds to which note, identify what the resulting sequence of notes encodes (a name? a phrase? a quotation from a piece they both knew?), and then identify the encoding system used. Each layer multiplies the others. The fact that Elgar was a composer who encoded musical signatures for sport in his published work, and who took the secret of the Enigma's hidden theme to his grave, makes the musical-cipher hypothesis the strongest single guess for what the Dorabella is. It is also, partly for the same reasons, the one nobody has been able to make work. ↩
-
The one-time pad is the famous theoretically-unbreakable cipher. Claude Shannon proved in 1949 that if the key is truly random, at least as long as the message, and used exactly once, the ciphertext leaks zero information beyond message length. The catch is implementation: distributing a one-megabyte key to send a one-megabyte message is exactly as hard as the problem it's supposed to solve. The most famous failure is Venona, the U.S. Army Signal Intelligence Service program that ran from 1943 to 1980, mostly out of a former girls' college in Arlington, mostly staffed by women, and exploited a 1942 Soviet pad-printing error in which a small set of pages was printed in duplicate. The roughly three thousand messages they decrypted named Klaus Fuchs, Ted Hall, Julius and Ethel Rosenberg, Alger Hiss, and Donald Maclean, and the FBI knew the Rosenbergs were guilty when it executed them in 1953 but couldn't say how it knew without burning the source. A one-time pad on the Dorabella, in 1897, from an English composer to a twenty-three-year-old he had nicknamed Dorabella, is implausible enough to rule out. ↩
-
There is a school of thought, going back to Eric Sams's original 1970 work and earlier, that proposes the Dorabella isn't a cipher in the strict sense. I am a member, mostly, but only conditionally. I think the most defensible position is "we cannot rule it out with available methods," which is a different position from "it isn't one." The difference matters more than it sounds like it should. ↩
-
The paper is Calibrated Falsification of Prior Dorabella Decryptions: A Negative Result on Substitution-Consistency and Language Identification, May 2026. It falsifies three previously published Dorabella decryptions and one adjacent claim on the Liszt Fragment, and shows that Italian as the plaintext language does not survive matched-budget calibration. A specific alphabet that produces five middle-frequency Italian content morphemes (mandava, piume, alcun, dissi, odio) is exhibited as a worked example of the false-positive mode simulated annealing produces on short ciphers, rather than as a candidate decryption. ↩