Solved 340-character cipher (old version)

Zodiac, the serial killer who terrorized Northern California in the late 1960s, sent four ciphers to local newspapers. The first cipher was separated into three different parts and each part was sent to Vallejo Times-Herald, the San Francisco Chronicle, and the San Francisco Examiner. The combination of all three parts formed a 408-letter cipher, which was decrypted one week after it was received. Zodiac also sent a 340-letter cipher, mailed on a card on November 8 1969, that was recently solved.

Articles and information about the 340 cipher

High-resolution scan of the 340-character cipher

Cipher as it appeared in the SF Chronicle on Nov 13, 1969 (Credit: Deborah Silva, who posts as Seagull on the Zodiac forums)

• Encyclopedia of observations - A collection of observations about the cipher text
• Comparison of cipher alphabets
• Comparison of character repetition rates
• Comparison of sequence repetition rates
• Levenshtein distance analysis - A look at the occurrences of repeated sequences that are not exact matches.
• Quadrant analysis - Do the n-gram counts improve If we split the cipher text into four quadrants?
• Quadrant analysis Part 2 - An expansion of the previous quadrant analysis experiment. Is it possible to produce quadrant arrangements that increase the number and quality of homophones detected algorithmically?
• Information theory (entropy, randomness, etc)
• FBI analysis from Dan Olson
• Cipher-related excerpts from case documents
• Word frequency analysis (word frequencies derived from a corpus of Zodiac correspondences)
• Omnidirectional repetitions - An investigation into patterns that repeat in arbitrary directions by following "snake-like" paths.
  • (Above link is broken. Click here for an archived copy.)
• "Complexification" - Did the cipher author begin with a simpler set of cipher symbols, then "complexify" certain symbols to further flatten the symbol distributions?
• Substring ranking - Can we apply measurements that give us a way to find interesting sections of cipher text for focused attacks?
• Catalog of repeating fragments - A comprehensive list of portions of cipher text that occur more than once in the cipher text.
• Cipher Legitimacy - Are the Zodiac ciphers real, or are they hoaxes?
• Corpus Experiments - A collection of corpus-based experiments performed on the Zodiac ciphers
• Outline of ongoing work on Z340
• Another outline of ongoing work on Z340

Homophone sequences

• Detection of homophone sequences in the cipher text
  • Jurgen Koller's "Two-Times Repetition" approach
  • Computation of statistical significance of 6-symbol repetitions at the beginning of the cipher text
  • Brute force search for homophone sequences - Shows sequences detected in the 408 and 340 ciphers by performing brute force searches for sequences involving up to 7 symbols.

The "Pivots"

• Reversible trigram patterns in the intersecting "pivots" of the cipher text
• Experiment to estimate odds of two intersecting "pivots" occurring by chance
• Experimental results of generating pivots from large collection of plain text

Transpositions and other possible variations

Is the 340 cipher unsolved because it is not a simple homophonic substitution cipher like the 408 cipher? I began an attempt to rule out specific encipherment schemes here:

Hypothesis Testing

Here is an older collection of considered possibilities:

• Oxcart - Does the 340 cipher's plaintext follow an "ox cart" path; that is, does it read alternately from left to right, then right to left?
• Vigenere
  • Vigenere encipherment prior to homophonic substitution
• Playfair
  • Playfair encipherment prior to homophonic substitution
• Bifid
  • Bifid encipherment prior to homophonic substitution
• Did the killer encipher the message, then re-arrange its lines?
• Many-to-many (one cipher symbol maps to multiple plaintext letters)
• Multiple encryption stages (examples: homophonic that has been rehomophoned, homophonic that has been transposed)
• Phonetic / nomenclator
• Was the cipher intended for use by its author only?
• Jarlve's tests
  • At the above link, Jarlve has documented the following variations: Cardan grille variant, stacked directional transformations, spirals, double spirals, column flips, double directional transformations, rail fence, row flips, and row flips in a 20 by 17 grid.
• Heiko's transposition ideas (more info)

Halloween Card

• Does the Halloween Card, mailed by the killer a year after the 340 cipher, contain clues about the 340?
  • Jos Kirps' article about interesting coincidences between the Halloween card and the 340 cipher

Timeline of arriving at the solution (times reported are in Eastern time in the USA)

Wednesday, December 2nd, 2020

• 04:14PM: Began running 655,088 ciphers, the cumulative collection of all cipher enumerations and decimations Sam Blake has sent me to date, through AZDecrypt v1.19 with default settings (except for loading jarlve's reddit 6-grams). Had run many of them before, but this time I wanted to be more careful about sorting the results based on the cipher lengths (some manipulations remove parts of the cipher, which sometimes leads to azdecrypt reporting higher scores compared to ones for ciphers of length 340).

Thursday, December 3rd, 2020

• 12:04PM: Reported an interesting result to Sam from one of his older vertical 3-split decimations (z340_vertical_3splt_decimations_9_9_1_19_2.txt).
  • AZdecrypt generated partial plaintext, with only a few interesting legible phrases:
    • HOPE YOU ARE
    • TRYING TO CATCH ME
    • SHOT WHICH BRINGS UP
    • OR THE GAS CHAMBER
    • HE HAS NOTHING THEN THEY
  • Phrases were more noticeable due to the auto-whitespace feature Jarl added for v1.19.
• 03:25PM: Determined the transposition (decimation) steps that were performed for that cipher among Sam's batch.
• 07:50PM: Sam provides details on the 9,9,1,19,2 enumeration, which is actually split into 4 vertical groups of size 9, 9, 1, and 1. A decimation of 19,2 is applied to each group.
• 09:36PM: I reported to Sam my solution to the first 9 lines, obtained by isolated those 9 lines, feeding them into AZdecrypt, but locking in cribs for some of the interesting phrases discovered earlier. Appearance of phrase "THAT WASNT ME ON THE TV SHOW" locked this in as a solid lead towards a real solution. Second 9 lines yielded from the same key have a relatively high score (compared to random plaintext or gibberish) but is somewhat garbled. Also noticed the word DEATH appearing at the very end of the last line of the entire cipher, using same key as the one discovered for the first 9 lines. Asked Sam for help to figure out the remaining 11 lines.
• 10:04PM: Notified Jarl to also ask for his help.

Friday, December 4rd, 2020

• 08:04AM: Ran several other decimations from Sam to try to isolate other schemes that might lead to a solve for the remaining 11 lines.
• 09:29AM: Completed a search of over 400,000 AZdecrypt results and determined that the phrase GAS CHAMBER appears in no other result.
• 10:10AM: Ran some more decimations from Sam. Didn't notice anything substantial in the results.
• 11:19AM: First response from Jarl, "It looks genuine!"
• 02:17PM: I report reversed words in the last 2 lines to Sam and Jarl
• 02:23PM: Jarl independently reports reversed words in the last 2 lines.
• 02:31PM: I interpreted the garbled 2nd section to read like this:
  • BECAUSE ? SLAVES TO WORK FOR ME WHERE EVERYONE ELSE HAS NOTHING WHEN THEY REACH PARADICE SO THEY ARE AFRAID OF LETTING ?? BECAUSE I (VOW?)...
• 02:40PM: Refined 2nd section:
  • BECAUSE ??? HAVE ENOUGH SLAVES TO WORK FOR ME WHERE EVERYONE ELSE HAS NOTHING WHEN THEY REACH PARADICE SO THEY ARE AFRAID OF LETTING ?? BECAUSE I (VOW?)...
• 02:58PM: Jarl reports his refined solution:
  • I HOPE YOU ARE HAVING LOTS OF FUN IN TRYING
  • TO CATCH ME THAT WASNT ME ON THE TV SHOW
  • WHICH BRINGS UP A POINT ABOUT ME I AM NOT
  • AFRAID OF THE GAS CHAMBER BECAUSE IT WILL
  • SEND ME TO PARADICE ALL THE
  • SOO HEN BECAUSE EOOW HAVE ENOUGH SLAVES TO
  • WORK FOR ME WHERE EVERYONE ELSE HAS NOTHING
  • WHEN THEY REACH PARADICE SO THEY ALRE UFA AID
  • I OF DET TH IF AM NO EA FREA ID BN CA AISE IV
  • YO WT SHAT MR NEW
  • EFIL WILL EB NA EASY E
  • NONI ECIDARAP DEATH
• 03:18PM: I report my finding about the errors on line 15 (the 6th line of the 2nd section). Several errors are happening on the same line, suggestive of a systematic mistake.
• 03:23PM: Jarl reports his interpretation of the plaintext:
  • SO THEY'RE ALL AFRAID OF DEATH I AM NOT AFRAID BECAUSE IT ...
• 04:19PM: I'm considering sending our partial solve to the FBI so they can help us work out the rest of it
• 05:47PM: Decided against reporting the solve early, to give our team more time to work it out. Developed a visualization of the errors on line 15 (6th line of the 2nd section).

Saturday, December 5th, 2020

• 01:26AM: Jarl reports progress on the plaintext, resulting from a possible "skip" in the 2nd part. Jarl's latest plaintext:
  • I HOPE YOU ARE HAVING LOTS OF FUN IN TRYING
  • TO CATCH ME THAT WASNT ME ON THE TV SHOW
  • WHICH BRINGS UP A POINT ABOUT ME I AM NOT
  • AFRAID OF THE GAS CHAMBER BECAUSE IT WILL
  • SEND ME TO PARADICE (ALL THE)
  • (SOO HEN) BECAUSE I NOW HAVE ENOUGH SLAVES TO
  • WORK FOR ME WHERE EVERYONE ELSE HAS NOTHING
  • WHEN THEY REACH PARADICE SO (THEYRE ALL) AFRAID
  • OF DEATH I AM NOT AFRAID BECAUSE IT
  • (YO WT SHAT MR NEW)
  • EFIL WILL EB NA EASY ENO
  • NI ECIDARAP DEATH
• 02:16AM: Jarl reports more detail on the skip in the 15th row, and the skip seems isolated to that row. But still some garble happening after that is fixed.
• 02:41AM: Jarl reports discovery that skipping cleartext "LIFEIS" in upper right section of the 2nd block fixes the remaining garbles. Plaintext now only has a few errors remaining.
• 02:50AM: Jarl reports full plaintext:
  • I HOPE YOU ARE HAVING LOTS OF FUN IN TRYING
  • TO CATCH ME THAT WASNT ME ON THE TV SHOW
  • WHICH BRINGS UP A POINT ABOUT ME I AM NOT
  • AFRAID OF THE GAS CHAMBER BECAUSE IT WILL
  • SEND ME TO PARADICE (ALL THE)
  • (SOO HER) BECAUSE I NOW HAVE ENOUGH SLAVES TO
  • WORK FOR ME WHERE EVERYONE ELSE HAS NOTHING
  • WHEN THEY REACH PARADICE SO THEY ARE AFRAID
  • OF DEATH I AM NOT AFRAID BECAUSE I KNOW THAT
  • MY NEW LIFE IS
  • EFIL WILL EB NA EASY ENO
  • NI ECIDARAP DEATH
• 03:44AM: Jarl reports details on steps that were required to fix the 2nd section:
  • Right-offset the RATENYRNOSRVSH fragment by 1 becoming HRATENYRNOSRVS. I think he skipped the H by mistake (during homophonic step) and then realized his error going into the 7th row and added the H back in at the end of the 6th row.
  • Skip the positions of the "LIFEIS" fragment during untransposition.
  • Now after transposition it will result in:
  • (SOO HER) BECUASE E NOW HAVE ENOUGH SLAVES TO
  • WORV FOR ME WHERE EVERYONE ELSE HUS NOTHING
  • WHEN THEY REACH PARUDICE SO THEY ARE UFRAID OF
  • DEATH I AM NOT AFRAID BECAASE I VNOW THAT MY NEW
  • Fixing a few errors:
  • (SOO HER) BECAUSE I NOW HAVE ENOUGH SLAVES TO
  • WORK FOR ME WHERE EVERYONE ELSE HAS NOTHING
  • WHEN THEY REACH PARADICE SO THEY ARE AFRAID OF
  • DEATH I AM NOT AFRAID BECAUSE I KNOW THAT MY NEW
  • Since the "LIFEIS" fragment was skipped it can be added in somewhere else, and I think it has to be at the end:
  • (SOO HER) BECAUSE I NOW HAVE ENOUGH SLAVES TO
  • WORK FOR ME WHERE EVERYONE ELSE HAS NOTHING
  • WHEN THEY REACH PARADICE SO THEY ARE AFRAID OF
  • DEATH I AM NOT AFRAID BECAUSE I KNOW THAT MY NEW (LIFE IS)
• 07:56AM: I completed a PDF report of our solution and submitted it to my contacts at the FBI crypto lab.
• 08:02AM: First response from FBI crypto lab, unofficial confirmation
• 08:48AM: Second response, unofficial confirmation
• 08:49AM: Third response, further confirmation, phone call

Not sure about further timing on this day, but during the day the FBI took action on the solution, notifying others in the agency as well as working on a report of the solution to submit back to SFPD, the original requestor. Submission also planned to SF FBI.

Sunday, December 6th, 2020

FBI San Francisco received the solution in the evening. Waiting for contact with FBI National Press Office to coordinate release of this news.

Monday, December 7th, 2020

Talked to FBI National Press Office in the afternoon to discuss release plan. Allowing for all victim notifications to take place prior to releasing the news.

Thursday, December 10th 2020

Talked to FBI National Press Office in the afternoon and was informed that final notifications will be completed by the end of the day and that the best time for the news release will be Friday.

Friday, December 11th 2020

• 06:00AM: Explainer video (Let's Crack Zodiac Episode 5) switched to Public. I posted the news on many social media outlets and forums, and emailed the LCZ mailing list.
• 01:03PM: First news report by SF Chronicle, announced by long time Zodiac reporter Kevin Fagan
• 02:21PM: FBI San Francisco makes a public announcement of the solution on their twitter account.