As I mentioned here and indeed here a few days ago, my usually-Early-Renaissance-focused thoughts have of late been turning slowly to the Zodiac Killer Ciphers, in particular to the unsolved 340-character cipher known as “Z340”. Unusually as cipher mysteries go, we also have an earlier cipher called “Z408” (no prizes for guessing its length) by the same person, one that was quickly cracked (using the crib “KILL”). Z408 turned out to be a homophonic simple substitution cipher (but with spelling mistakes, copying mistakes, and a few subtly odd features); and there are plenty of good reasons to think that Z340 will share many of these same basic aspects (but made somewhat harder to crack).

Even though it was originally a crib which helped to crack it, Z408 has other weaknesses, most notably the way it sequentially cycles through homophones (“multiple ciphertext shapes for the same plaintext character”). For example, plaintext ‘t’ maps to the four ciphertext homophones HI5L, and appears in the text as the sequence HI5LHI5ILHI5LHI5LHI5LHI5LI5LHL5IIHI. If you count each successful letter-to-letter transition matching the modulo-4 sequence [HI5L] as a 0.25 success event (=26) and each non-match (=8) as a 0.75 failure event, I believe you get a raw probability of less than 1 in a billion (i.e. of at least 26 successes from 34 events). Please check my maths, though – I used this online binomial calculator with N = 35-1, k = 26, p = 0.25, q = 0.75. For more on these homophone sequences, Zodiac ciphermeister Dave Oranchak kindly pointed me at a full list of Z408 homophone sequences.

Incidentally, the top few match counts are:-
e -> ZpW+6NE – N = 54-1, k = 38
t -> HI5L – N = 35-1, k = 26
s -> F@K7 – N = 20-1, k = 15
o -> X!Td – N = 27-1, k = 13
n -> O^D( – N = 23-1, k = 20
i -> 9PUk – N = 44-1, k = 35
a -> GSl8 – N = 26-1, k = 10

It would be great to tell you how statistically significant these sequences are, but I know enough stats to know that it’s not quite as easy as it looks (for a start, we’re preselecting the best order of letters to use) – any passing statisticians, please feel free to leave a comment. I’m also quite surprised that nobody has apparently tried to use this weakness as a direct way to find the Z340 cipher’s homophones (in fact, John Graham-Cumming also blogged about this in June this year), but – as I’ll show shortly – I suspect trying just that on its own wouldn’t be enough.

Taking a brief step sideways, I’m always intrigued by mistakes in ciphers, because these often point to how the cipher was constructed. One interesting feature (but which I’m still trying to understand to my own satisfaction) is the solid triangle cipher shape in Z408, and how it appears to encipher different letters at different times. The view often put forward elsewhere is that this varied due to copying errors, perhaps arising because the Zodiac Killer’s pen was too thick, causing him to misread his draft version. As for me, I’m not so sure, because the solid triangle decrypts to a curious sequence:-
* “A” in “bec-A-use”
* “S” in “mo-S-t dangerous”
* “A” in “an-A-mal”
* “S” in “mo-S-t thrilling”
* “A” in “with -A- girl”
* “S” in “if it i-S-”
* “E” in “my slav-E-s”
* “A” in “my -A-fterlife”

Of these, only the “A” in “an-A-mal” is possibly a copying error (“I” is enciphered by an empty triangle shape) as compared to just a spelling mistake (the Zodiac Killer has plenty of those). But even that seems a little unlikely when the whole ASASAS[E]A pattern that emerges – so very similar to the homophonic sequences discussed above – is pointed out. I haven’t yet figured out what this implies, but it’s pretty interesting, right?

Moving on to the uncracked Z340 cipher, I have to say that what strikes me most is the difference between its top half (lines 1-10) and its bottom half (lines 11-20). It turns out that back in 2009, FBI codebreaker Dan Olson pointed out to Tom at that lines 1-3 and 11-13 contained very few repeats: other people have wondered whether this points to some kind of block-level transposition going on. Me, I suspect there’s a far stronger inference to be made: that even though they share nearly all the same character shapes, I’m pretty sure that the top and bottom halves of Z340 use completely different cipher letter assignments, and hence may well need to be cracked independently. Further, I suspect that the Zodiac may well have intended to send them out separately (Z408 was sent as three independent sections), but (for some reason) ended up sending them both as a single cipher.

[Incidentally, I also don’t believe that the last few letters of the bottom half of Z340 are genuinely part of the ciphertext to be cracked: they seem to spell “ZODAIK”, which is just a touch too coincidental for me. 🙂 ]

Right now, I think that a constructive first big step would be to search for statistically significant homophone sequences in the top and bottom halves of Z340, because we can be reasonably sure that the most frequent letters will probably have four or more homophones, just as with the Z408 cipher: trying this out may well yield some surprisingly revealing results. Any takers at the FBI? 😉

32 thoughts on “Thoughts on the Zodiac Killer Z408 and Z340 ciphers..

  1. The paper “An Algorithmic Solution of Sequential Homophonic Ciphers” by John C King describes an efficient attack that exploits sequential homophones to reduce homophonic substitution ciphers to simple substitution ciphers. King applied the technique to the 340 with little to no success. I think the main weakness of his approach is that it does not take into account the various imperfections of the homophone sequences used by the Zodiac killer.

    I wonder if you can estimate the statistical significance of discovered homophone sequences by counting the total number of ways that such sequences could occur with the same “bag” of symbols. For instance, how many different ways can you re-arrange the symbols in the 340 (preserving their frequency) such that a given homophone sequence appears? Intuitively, a longer sequence of repetitions implies greater significance, so perhaps an exact combinatorial calculation is not necessary.

  2. David: as I wrote, the main thing is that I think the two halves of Z340 are quite different, and so trying to shoehorn them both into a single unitary test (as almost everyone has done in the past, I believe) would likely lead nowhere. Furthermore, I don’t for a minute think that given just the right algorithm an answer would pop out – as you point out, there are too many confoundingly noisy elements at play there too, and from what we’ve seen the Zodiac killer doesn’t tend to follow any rule slavishly. Rather, I think that by following the process carefully you might well see a small handful of distinctive homophone clusters pop out – not enough to solve Z340 directly, but enough to give us confidence that we’re starting to reach some kind of statistically significant signal through all that noise. Fingers crossed! 🙂

  3. Hi Nick,
    Are these sequences statistically significant?

  4. Tony: calculating the statistical significance of the appearance of individual sequences (or, as in your case, similar-looking patterns) is an exercise fraught with great difficulty. There’s a big difference between what I call “raw probability” and “statistical significance”, which largely comes down to experiment design: in my experience, most stats you’ll find in the wild are bad stats because the underlying data suffer from multiple sampling biases. Similarly, statistical confidence is affected by sample size and sampling methodology, making relatively short cryptograms problematic.

    The case I describe in the post is a little unusual because the repeating n-character cycle allows you to predict what the next character will be (i.e. to model the sequence), which (I think) gives the kind of pretty-much-independent pass-fail conditions you need for binomial calculations. For example, reading characters at random or in the wrong grid direction shouldn’t give you any noticeable modelled sequence at all. Having said that, you still have to select the best order of letters, which I suspect reduces the effective overall probability by 2^n or perhaps 2^(n-1): but I’m more of a practical statistician than a theoretical one, so this is quite esoteric stuff for me. 🙂

  5. Tony: having said all that, can you tell me what the (presumably homophonic?) sets are in the image you linked to and where it’s from?

  6. Nick,
    The image gives the possible homophones whether they cycle sequentially or not i.e. after using his 4 substitutes HI5L he repeats using the same 4 substitutes but in any order.
    In the image lower case letters represent the backward capitals – asterix crosshairs – diamond triangle with dot – the other 2 represent the double J with a dot.
    I agree the ZODAIK on the bottom line is too much of a coincidence especially as it is preceded by NPKS (backward P) – as most of his plaintext letters include the phrase ‘Zodiak speaking’ – This suggests to me that it was written like the image on the cerial packet, having completed his message there are lots of blank spaces to fill and he noticed he could make it similar.
    It’s also interesting to compare the 480 with Poe’s cipher – both use the homophones sequentially and both deteriorate in their accuracy towards the end.

  7. “Of course, plenty of people have already tried to crack the two halves independently and failed. . . .”

    You so certain of that Einstein? Says who?

  8. Without actually being Einstein-like, I’m certain of what I said because I’ve been talking with people online (Dave Oranchak, glurk and others on the forum) who have done just that and told me so. The main impetus for trying to split Z340 into two came from Dan Olson at the FBI, who in 2009 pointed out that the repeat value pattern had lulls at lines 1-3 (which you’d broadly expect from a homophone substitution cipher) as well as at lines 11-13. If this is indicative of what’s going on inside the cipher, the reasoning goes, then it must be either a rearrangement (i.e. the correct line sequence is 1, 11, 2, 12, 3, 13, or something similar) or two separate ciphers (as I suspect to be the case). However, running each half through zkdecrypto doesn’t produce anything worthwhile, so there’s more going on there than just a simple split.

    By the way, thanks for bringing your pointed cynicism to bear on my lowly blog, it’s a skill that many Zodiac authors would do well to assimilate into their research repertoire. 🙂

  9. This is by far my all time favorite start to a 340
    cipher solution conversation. Thank you for your
    efforts and work. Do you feel at some point it would be beneficial to include in the conversation ideas about coding in acceptable tolerances representing in the least,
    variables in gramatic structures, message content
    acceptability, (patterned) anagraming …,ie, Morse code is sent with less content and focuses on minimal subject transmission. Less nouns..incomplete words. abbrs. and the such?

    If in a narrsasistic rant Z enciphered in a morse code
    style, statistics are altered radically. The consanant
    vowel relationships get skewed off published
    statistics (cvccvc…for 6 letter words) subsequently our effort would be hindered (including the sequences you mention,Dave) using existing decipherment algorithms,
    as may be exampled in the first 10 lines at my site.
    My algoritm looks for those changes and I often wonder if my mile high observation isn’t actually from somewhere further out in space with regards to improving our aim at a solution.

    To ‘Z’,
    Have you been to The non solutions
    site. These are not the solution. They are highly
    accurate solves, representing cracking technique
    possibilities.There are two very good examples of two different keys with readable results. After I spoke with Dan Olsen about the article mentioned above years ago, I immediately re-wrote my algorithms to search for
    single and double keys. Of course its possible, every
    thing is until ‘science’ says it isn’t…and science
    often changes its mind about widely accepted knowledge, even math.


  10. John King on January 28, 2013 at 11:20 pm said:

    I was thinking along the same lines (more or less) and have been working with a friend on it, but I don’t know any hardcore cipher geeks. I also noted the cyclical substitution in the original 3 part, and also how it is suddenly altered when he gets into the 18 character noise at the end of it. Why even *place* random padding at the end of a substitution code? I think it’s there for a purpose.
    And moving on to the Z340, it’s clear to me that if he’s sticking to his normal habit (cyclical rotation of substitution characters), it’s obviously been transposed as well as substituted. the “(+)ZO^AIK” at the tail end tells me that he’s fairly screaming it. The ^ says “it’s a substitution” and the “AI” says it’s a transposition.
    It’s obvious that he’s not using the original alphabet. There are new characters introduced and some old characters retired. Most importantly, the frequencies don’t match. Especially with the + character, which previously represented E in rotation, but now appears twice as often as any other symbol.
    So here’s my thinking: If this message means anything at all, then we have to go on the assumption that he wanted it to be solved. Accordingly, the answer is simple enough for an intelligent and clever person to figure it out.
    My guess (what I’m working at now) is that this is not only a substitution, but also a keyword transposition. The 18 character garbage at the end of the 420 is (or at least contains) the keyword to the 340 and the almost-plain text “zodiacXX” at the end of the 340 is the pad. After that (if my theory is correct) it should be as easily solvable as the 420 was.
    If any of you can offer me assistance or advice on this, I’d be very grateful!

  11. John,

    There is good evidence that the cipher author simply copied several groups of symbols from earlier in the 408-character cryptogram:

    I’m satisified with the explanation that Zodiac simply wanted equally-sized parts to mail to each newspaper, and his message wasn’t exactly the right length; so, he ended up copying random junk into the last portion of the third section to pad it out. But nobody really knows for sure — there could still be some undiscovered purpose to those extra symbols.

    Keyword transposition is an interesting possibility. I think to explore this avenue thoroughly, you have to generate test cryptograms that closely resemble the 340, but are constructed via your transposition hypothesis. If you have a way to cryptanalyze and crack the test cryptograms, then failures to crack the 340 the same way will give you confidence that it isn’t constructed using the supposed scheme. A tedious approach, but necessary to confidently exclude some possibilities.

  12. Stacey Stanislaw on September 10, 2013 at 7:43 pm said:

    if the 13 digit cipher read “PATRICIAROGER” the message you get with the Z408 might make some sense.

  13. Stacey Stanislaw on September 10, 2013 at 10:46 pm said:

    I agree in general with Nick and others, there are two systems at work in the Z340 cipher. The system of the Z408 cipher was a clue and training device used by the author for understanding the later Z340 cipher. While the characters used in both overlap, only a subset of the later cipher can be decoded using the Z408 rules. Z340 relies on Z408 being decoded successful and allows some of Z340 to be decoded but not much of it. Some of the reused symbols in Z340 follow a new set of rules, but importantly, this encoding method relies on at least some of the rules from Z408 applying to at least some of Z340.
    By splitting the encoding rules into two different encoding methods yet sharing the same symbology between ciphers, the author makes Z340 much more difficult to solve (if not impossibly difficult at the time) without first solving Z408. To solve Z340, one can use the Z408 solution as a guide to one character subset and assume some other characters in Z340 follow a second rule set.
    As everyone knows but might forget when approaching this problem, a key to understanding this authors cipher method coupled with the timing of the ciphers is to understand that these codes we intentionally meant to be decoded, it’s not like these were secret communication intercepts, these were game pieces between the author, the general public, and decoding experts. Also, everyone knows now, including the author of these codes at the time, that Z408 was (would be) fairly easy to decode. I submit this was intentionally so by the author, Z408 was a stepping stone to decoding Z340 but not a solution for it.
    Could it have seemed obvious to the author of the ciphers that Z408 would be used as an aid to decode Z340 but not directly as a solution? I think so judging by the 13 symbol cipher “my name is” letter (Z13) inquiring about the effort to decode Z340. The author could easily assume that Z13 could never be decoded on its own without first decoding Z340, rather than be a game piece or provide a clue to the decoding methods of Z340, this 13 symbol cipher is an incentive to keep trying to decode Z340. Nothing important has come from applying Z408 rules alone to Z13, because it’s the combination of Z408 and Z340 rules that would be necessary to decode this short cipher. Z13 would also serve as “proof” of identity of Zodiac if Z340 was never cracked, since filling in Z13 would be a solution key for Z340, providing the critical clue for linkage of Z408 and Z340.
    I’m convinced, Z13 doesn’t contain anything directly implicating the author of the ciphers, but rather, the next puzzle piece to this mystery. It’s also, in my opinion, one reason no other ciphers (confirmed attribution to Zodiac) were sent after Z340; the difficulty decoding Z340 suited the authors sense of superiority and as proof to him that he was somehow better than everyone else. In this case, no other ciphers would be needed until Z340 was solved. This perspective of the Zodiac might be further evidenced by the “shutout” he liked to brag about SFPD=0, Zodiac=37.
    Challenge: Is Z340 solvable using known Z408 and Z13 = PATRICIAROGER?

  14. mr 4488N on November 27, 2015 at 3:40 pm said:

    The 340 has been solved about a week ago
    By me ,it is a simple worded one much like the 408 Id say it is a 3rd grade level thing word wise but adult in message
    I am no cipher master ,it was my 1st one ,but I found the code key
    Will be released soon ,looking for the most bang for my work

  15. mr 4488N: that would depend on whether you define “bang” as money, fame, or whatever.

    For what it’s worth, I’d add this: unless the plaintext helps identify the Zodiac Killer in some way, or unless you used a unusually insightful way of getting to that plaintext, or unless this was the culmination of a lot of other Zodiac Killer research, it probably isn’t externally worth a great deal.

  16. boyfriend , Champollion,,. :-) on November 27, 2015 at 8:22 pm said:

    Friends. I have to disappoint you. Zodiac never not find. He had perfect coverage. He worked for the Agenci. He made a mistake just once. He had to take a picture. Nice photo.

  17. Rick A. Roberts on November 28, 2015 at 12:34 am said:

    ZODIAC KILLER APRIL 20, 1970 SAN FRANCISCO CHRONICLE NEWSPAPER. ” MY NAME IS _ “. The cipher reads, ” A, E, N, Circle with Cross Centered in it, Circle with ” B ‘ in it, K, Circle with ” B ” in it, M, Circle with ” B ‘ in it, ” Double Hook Shaped Character “, N, A, M “. The deciphered message reads, ” T E N D on L on H on R N T H “, or ” DENTON LON HONRATH “.

  18. Rick A. Roberts on November 28, 2015 at 1:03 am said:

    408 SYMBOL CIPHER FINAL 18 LETTERS was, ” EBEORIETEMETHHITI “. Deciphered it is, ” ENEOLCESEOESTTECSC ” or ” ENE OL CE SE OUEST TEC SC “. ENA was (ECOLE NATIONALE ADMINISTRATION) established in 1945 as a French Civil Service School. There were 56,000 French Senior officials and 2,600 Foreigners who graduated from the ENA, This allowed civil servants in France to enter politics, science, or legal professions more easily than normal. There was a two part exam (verbal & written). It was also known as the Institut d’etudes Politiques de Paris.

  19. Rick A. Roberts on November 28, 2015 at 1:15 am said:

    Here is another cipher from the Zodiac killer. It has four lines in it. The first line of cipher starts with, ” L ” and ends with ” W “. The second line starts with, ” C ” and ends with ” T “. The third line starts with, ” W ” and ends with, ” B “. The fourth line starts with, ” N ” and ends with, ” A “. The deciphered message of the four lines of cipher read, ” SETS IN EAST FIVE IN SAINT SS (Saint Simeon) YOU ARE IN ONE END IN EAST “.

  20. Rick A. Roberts on November 28, 2015 at 1:28 am said:

    ZODIAC KILLER LOCATION OF BOMB Z32 CIPHER – MAPCODE CIPHER. This cipher has two lines. The first line begins with, ” C ” and ends in ” G “. The second line begins with, ” X ” and ends with ” TRIANGLE SHAPE “. The deciphered message reads, ” IS IN FRONT LEFT CORNER SUNLIGHT SETS ON BOX I DIE “.

  21. Rick A. Roberts on November 28, 2015 at 1:44 am said:

    ZODIAC CIPHER – Three lines of cipher. First line starts with ” + ” and ends in ” 9″. Second line starts with “> ” and ends in ” O “. The third line starts with ” TRIANGLE SHAPE ” and ends in ” + “. The cipher deciphers to, ” ENEONE EIEKEN IANNCS(IS)E “., or ” ANYONE KEYS IN IN A CASE “.

  22. Rick A. Roberts on November 28, 2015 at 1:52 am said:

    TWO LINE CIPHER ZODIAC KILLER. First line starts with, ” B” and ends in “.”. Second line starts with, ” BACKWARDS “C” ” and ends in ” “O” with line horizontally through center of it “. The deciphered message is, ” YOU ARE ONLY LENS I EVEN HAVE “.

  23. Rick A. Roberts on November 28, 2015 at 2:01 am said:

    ZODIAC CIPHER – It has two lines of cipher. The first line begins with, ” CIRCLE FILLED IN ” and ends in ” CIRCLE WITH CROSS CENTERED IN IT “. The second line begins with, ” END SIGN ” and ends in ” > “. It deciphers to, ” THE DAY I DIE ON END DEPENDS ALL EYES REST SEE KRNE “.

  24. Rick A. Roberts on November 28, 2015 at 2:14 am said:

    LOCATION OF BOMB – ZODIAC KILLER CIPHER. One line of cipher. It begins with, ” TRIANGLE SHAPE ” and ends with ” + “. It deciphers to, ” IANNCS(IS)E ” or ” IS IN A CASE “.
    LOCATION – One line of cipher. It starts with, ” H ” and ends in ” < ". It deciphers to, " TEWENNNNHNTN " or " TWO & FOUR IN HUNTINGTON ". Zodiac Killer could have been talking about his second and fourth victims in Huntington, Beach, California ?
    SINGLE LINE CIPHER – Starts with, " TRIANGLE SHAPE and ends in " I ". It deciphers to, " ISKREOT " or " RISKETO", " RISKY TO ".

  25. Rick A. Roberts on November 28, 2015 at 5:24 am said:

    ZODIAC KILLER CIPHER – One line cipher. It begins with, ” S ” and ends with ” CIRCLE WITH TOP HALF FILLED IN “. This deciphers to, ” AEEANAAEBNENEEGMI “, or ” BEGINNING A BIG GAME “.
    SECOND One Line Cipher. It begins with, ” OUTLINE OF SQUARE “, and ends with, ” A LARGE CIRCLE WITH A CROSS THROUGH THE CENTER OF IT, with four surrounding Smaller Circles with a Cross Through each one ( Each of these is evenly spaced around the largest one with one in each quadrant ). This deciphers to, ” YINHNDDDDD “, or ” HY FIVE IN SND “, or ” HIGH FIVE IN SAN DIEGO “.

  26. Davb here
    that site
    now he gives the 408 remainder cipher solution free
    I don’t see what it says ,
    but you masters to PHD’s should have it seconds

  27. Davb: I saw this a while back and thought it was probably nonsense, broadly of the type that tends to infest YouTube – and the person’s 408 remainder cipher decryption doesn’t now fill me with any confidence that the other attempted decryptions will be any better.

    Specifically, the problem with homophonic ciphers is that they give decryptors the ability to overfit a part of an (imagined) message to a corner of the ciphertext (in that case, the backwards “zodiak” at the top right), which often then leaves the rest of the message as a kind of weird language-like babble (as here). But this isn’t a real solution, or even a real way of solving homophonic ciphers: it’s just a way of not solving it, while thinking that you have. Happens all the time, sadly. 🙁

  28. but your wrong ,it is not homo but a polyphonoic code key .
    most solvings are not even words , let alone a sentence , this is .
    most make no sense as to the zodiac killer, this does.
    most have far.far fetched logic accompanying them to make any sense as to zodiac ( see your posts.)
    again this is not me saying, I think this symbol is a D.. or let me try it as a L .it is from a code key that I know it is __
    This is your blog and you can surely think and say what you want …..I just hate to see you waste your time
    No one wants the ciphers /zodiac solved …they want to solve it .

  29. Davb: do you mean “polyalphabetic”? “Homophonic” has a specific meaning in code-breaking: you say a cipher is homophonic if it uses multiple different (cipher) shapes for individual (plaintext) letters, which is exactly what the Zodiac Killer did in his Z408 cryptogram. Given the similar look and similar statistics his Z340 cryptogram presents, there would seem to be good reason for thinking that it, too, employs some kind of homophonic cipher.

  30. Okay ,polyaphabetic I have seen homophonic shown as one for one swap

    For what it’s worth, I’d add this: unless the plaintext helps identify the Zodiac Killer in some way, or unless you used a unusually insightful way of getting to that plaintext, or unless this was the culmination of a lot of other Zodiac Killer research, it probably isn’t externally worth a great deal.

    I can answer yes it does to those 3 questions above

  31. Davb: it doesn’t matter how many supportively good things you do if the core cryptology is broken.

    And when someone claims to have cracked a whole load of too-short cryptograms all at once, there are two basic scenarios: (a) this person is a self-taught cryptological genius, of the kind that comes along once in a generation, or (b) this person is (at best) delusional. Whether you like it or not, (a) is an exceptionally big claim, and requires more evidence than ‘PayPal me some money and I’ll show you’.

  32. (a) a cryto genius ,
    (b) has delusions , he’s ccrazzy
    or (c) a more realistic chance
    just what he said on the web page ,he did not say he solved all the ciphers by ESP or a vision ,etc.
    he says he found a code keys that gives meaningfull words in the ciphers

    you would least admit, that if the ciphers do translate into sentences like the 408 cipher … he Zodiac or an partner used a code key of sorts .
    very possibly a easy to remember one ….like his name
    why his name ? so he would get credit for it at some point in time .
    requires more evidence
    2+2 = hmm??? ..4 ,pretty sure
    alot of people can add that up ,
    you are 1/4 of the planet away from the zodiac scenes or maybe the zodiac himself
    some people are 1/4 miles away

Leave a Reply

Your email address will not be published. Required fields are marked *

Post navigation