Vigenère Cipher in Python, how secure is this?

Question

The program starts of with the password() function first, which gets the keyword or key that you want to shift your string with. Then you go into the choice() option, where you can either encrypt() or decrypt() your string.

The script converts each character of the key and string to a corresponding number, and then shifts the string based on the value of each character in the key. The values are listed in a separate python file, which I have appended below. Is It also logs all encryptions and decryptions along with their password into a log.txt file.

My question is, are there any flaws with my calculations? Given a sample key: "jabbathehut" and a sample message: "This is a secret message", could the original string be brute-forced within a week if someone knew the output and the encryption process, but not the key/password used?

try:
   import pyperclip
except ImportError:
    pass
finally:
    import dll
    from dll import alphabets, numbers, date

def encrypt(numlist, string, code):
    encoded_num = []
    encoded_str = []

    #Converting string to encoded numbers and adding shift based on password
    n = 0 
    for i in string:

        if n > len(numlist) - 1:
            n = 0
        try:
            encode_num = alphabets[i] + numlist[n]
        except KeyError as detail:
            dict_error("encrypt", numlist, code, detail)

        while encode_num > 90:
            encode_num = encode_num - 90

        encoded_num.append(encode_num)
        n += 1

    #Convert encoded numbers to encoded words (in list)
    for i in encoded_num:
        encode_str = numbers[i] 
        encoded_str.append(encode_str)

    #Display encoded result to the user
    encoded_display = "".join(encoded_str)   
    print("\nYour string has been encoded and copied to the clipboard:\n{}"
          .format(encoded_display))
    input("")

    #Attempts to copy encoded result into the clipboard
    try:
        pyperclip.copy(encoded_display)
    except NameError:
        pass

    #Save information into log file
    f = open("log.txt", "a")

    #f.write() does not write on a new line!
    f.write(date)
    f.write("\nEncrypted: {}".format(encoded_display))
    f.write("\nPassword: {}\n\n".format(code))

    f.close()
    choice(numlist, code)


def decrypt(numlist, enc_string, code):
    decoded_num = []
    decoded_str = []

    #Converting string to decoded numbers and subtracting shift based on password
    n = 0 
    for i in enc_string:

        if n > len(numlist) - 1:
            n = 0
        try:
            decode_num = alphabets[i] - numlist[n]
        except KeyError as detail:
            dict_error("decrypt", numlist, code, detail)

        while decode_num < 1:
            decode_num = decode_num + 90

        decoded_num.append(decode_num)
        n += 1

    #Convert decoded numbers to decoded words (in list)
    for i in decoded_num:
        decode_str = numbers[i] 
        decoded_str.append(decode_str)

    decoded_display = "".join(decoded_str)   
    print("\nYour string has been decoded:\n{}".format(decoded_display))
    input("")

    f = open("log.txt", "a")

    f.write(date)
    f.write("\nDecrypted: {}".format(decoded_display))
    f.write("\nPassword: {}\n\n".format(code))

    f.close()
    choice(numlist, code)

def choice(numlist, code):
    dll.clear()
    print("\n\tPassword: {}".format(code))
    option = input("\nWhat would you like to do?[1]Encrypt [2]Decrypt [3]Reset pass" 
                   " [4]Color [5]Exit: ")

    if option == "1":
        string = input("\nEnter string here: ")
        encrypt(numlist, string, code)  

    elif option == "2":
        enc_string = input("\nEnter encrypted string here: ")
        decrypt(numlist, enc_string, code)  

    elif option == "3":
        password()

    elif option == "4":
        print("")
        dll.choose_colour()
        choice(numlist, code)

    elif option == "5":
        pass

    else:
        choice(numlist, code)

def password():
    #It's confusing but code is the password, and numlist is the password in number format in a list
    dll.clear()
    numlist = []
    code = input("\nSet the password: ")
    codelist = list(code)

    for letter in codelist:
        try:
            numlist.append(alphabets[letter])
        except KeyError as detail:
            dict_error("password", numlist, code, detail)

    if code == "" :
        print("\n\tError: Your password cannot be empty!")
        input("")
        password()

    choice(numlist, code)

def dict_error(caller, numlist, code, detail):
    if caller == "password":
        print("\n\tError: the key {} in your entry cannot be used as a password".format(detail))
        input("")
        password()

    elif caller == "encrypt" or "decrypt":
        print("\n\tError: the key {} in your entry does not support encryption.".format(detail))
        input("")
        choice(numlist, code)

password()       

dll.py contains these:

import datetime

date = datetime.datetime.now().strftime("%d %B %Y - %I:%M%p")

alphabets = {
    "a" : 1, "A" : 27, " " : 53, "0" : 79,
    "b" : 2, "B" : 28, "." : 54, "1" : 80,
    "c" : 3, "C" : 29, "?" : 55, "2" : 81,
    "d" : 4, "D" : 30, "!" : 56, "3" : 82,
    "e" : 5, "E" : 31, '"' : 57, "4" : 83,
    "f" : 6, "F" : 32, "'" : 58, "5" : 84,
    "g" : 7, "G" : 33, ":" : 59, "6" : 85,
    "h" : 8, "H" : 34, "-" : 60, "7" : 86,
    "i" : 9, "I" : 35, "/" : 61, "8" : 87,
    "j" : 10, "J" : 36, ">" : 62, "9" : 88,
    "k" : 11, "K" : 37, "<" : 63, "(" : 89,
    "l" : 12, "L" : 38, "=" : 64, ")" : 90,
    "m" : 13, "M" : 39, "," : 65,
    "n" : 14, "N" : 40, "@" : 66,
    "o" : 15, "O" : 41, "#" : 67,
    "p" : 16, "P" : 42, "$" : 68,
    "q" : 17, "Q" : 43, "%" : 69,
    "r" : 18, "R" : 44, "^" : 70,
    "s" : 19, "S" : 45, "&" : 71,
    "t" : 20, "T" : 46, "*" : 72,
    "u" : 21, "U" : 47, "[" : 73,
    "v" : 22, "V" : 48, "]" : 74,
    "w" : 23, "W" : 49, "_" : 75,
    "x" : 24, "X" : 50, "~" : 76,
    "y" : 25, "Y" : 51, "\\" : 77,
    "z" : 26, "Z" : 52, "|" : 78
    }

numbers = {
    1 : "a", 27 : "A", 53 : " ", 79 : "0",
    2 : "b", 28 : "B", 54 : ".", 80 : "1",
    3 : "c", 29 : "C", 55 : "?", 81 : "2",
    4 : "d", 30 : "D", 56 : "!", 82 : "3",
    5 : "e", 31 : "E", 57 : '"', 83 : "4",
    6 : "f", 32 : "F", 58 : "'", 84 : "5",
    7 : "g", 33 : "G", 59 : ":", 85 : "6",
    8 : "h", 34 : "H", 60 : "-", 86 : "7",
    9 : "i", 35 : "I", 61 : "/", 87 : "8",
    10 : "j", 36 : "J", 62 : ">", 88 : "9",
    11 : "k", 37 : "K", 63 : "<", 89 : "(",
    12 : "l", 38 : "L", 64 : "=", 90 : ")",
    13 : "m", 39 : "M", 65 : ",",
    14 : "n", 40 : "N", 66 : "@",
    15 : "o", 41 : "O", 67 : "#",
    16 : "p", 42 : "P", 68 : "$",
    17 : "q", 43 : "Q", 69 : "%",
    18 : "r", 44 : "R", 70 : "^",
    19 : "s", 45 : "S", 71 : "&",
    20 : "t", 46 : "T", 72 : "*",
    21 : "u", 47 : "U", 73 : "[",
    22 : "v", 48 : "V", 74 : "]",
    23 : "w", 49 : "W", 75 : "_",
    24 : "x", 50 : "X", 76 : "~",
    25 : "y", 51 : "Y", 77 : "\\",
    26 : "z", 52 : "Z", 78 : "|"
   }

Answer 1

After Ludisposed has correctly pointed out in his answer that the Vigenere cypher is probably not very secure, here are some pointers on your actual code.

---

The mapping characters to numbers and back in your dll.py can be greatly simplified by using the built-in module string. It contains very helpful constants, like string.ascii_lowercase, string.ascii_characters and string.printable. The last one contains all ASCII characters which can be printed in a terminal (including the upper- and lower-case alphabets, numbers, punctuation and all kinds of whitespace).

This change will break backwards compatibility, because the order will be different than your manual numbering.

import string

numbers = dict(enumerate(string.printable,1))
alphabets = dict(zip(numbers.values(), numbers.keys()))

The second argument to enumerate tells it to start counting at 1, instead of 0, like in your code.

---

Your try..except clause in the imports does not need the finally clause. Since you pass on an ImportError, the code will continue executing after this. So you can just write:

try:
   import pyperclip
except ImportError:
    print("Could not import module 'pyperclip'. Copying to the clipboard will not be supported. You can install this module using `pip install pyperclip`.")

import dll
from dll import alphabets, numbers, date

I also added a helpful message telling the user what it means that pyperclip is not installed and how to fix that problem.

It is also very confusing that you call your module dll, from which you import some constants, but you also seem to be having another module called dll, which contains functions to make terminal interactions nicer (like dll.clear() and dll.choose_colour()).

---

Your main code will at some point run into a problem. Python has a maximum stack size of 1000 (by default, it can be increased, but not removed in normal Python). This happens because whenever you call the choice function at the end of one of your functions, this function does not end (until that function you called finishes). So every call to choice increases the stack size by one (and then by one again, when choicecalls the next function), and so on. Have a look at this SO post for why Python was designed like this (thanks to Ilmari Karonen for pointing me to this link in the comments).

You can avoid this, by writing a main function that handles calling the choice function and then the chosen function and loops infinitely (or, until the user quits).

For this to work, your other functions might need to return their results, instead. Your choice function, for example`, could return the function to execute (and maybe any additional arguments).

While you are at it, you should separate your concerns. One concern is en/decrypting a string with a given password. It is a totally different responsibility for the result of this to be printed, written to a file or copied to the clipboard. These things should got into separate functions or be called in the main function. Just return the en-/decrypted string.

You should protect this main call with a if __name__ == "__main__": guard.

When done, this could look something like this:

from datetime import datetime
import string

# Allow all printable characters, except for the last 5 (\t\n\r\x0b\x0c)
characters = string.printable[:-5]
indices = {c: n for n, c in enumerate(characters)}


def encrypt(text, password):
    # Re-calculate the shifts here, for the function to be more independent
    shifts = [indices[char] for char in password]
    # Converting string to encoded numbers and adding shift based on password
    encoded_num = [(indices[char] + shifts[n % len(shifts)])
                   for n, char in enumerate(text)]
    # Convert encoded numbers to encoded characters
    return "".join(characters[i % len(characters)] for i in encoded_num)


def decrypt(text, password):
    # to be implemented by you
    raise NotImplementedError

def ask_password():
    # to be implemented by you
    return "foo"


def save_to_clipboard(text):
    """Copy information to cipboard"""
    # ^ This is a docstring documenting this function
    try:
        pyperclip.copy(text)
        print("\nYour string has been copied to the clipboard:\n{text}")
    except NameError:
        pass


def save_to_log(file_name, mode, text, password):
    """Save information into log file"""
    with open(file_name, "a") as f:
        # f.write() does not write on a new line!
        # Custom format strings are supported by f-strings:
        f.write(f"{datetime.now():%d %B %Y - %I:%M%p}")
        f.write(f"\n{mode}: {text}")
        f.write(f"\nPassword: {password}\n\n")


def main():
    password = None
    while True:
        # This will loop infinitely, or until the user chooses `5`, where the loop is broken or the user presses CTRL-C
        if password is None:
            # password not yet set or reset
            password = ask_password()
        print(f"\n\tPassword: {password}")
        option = input("\nWhat would you like to do?[1]Encrypt [2]Decrypt [3]Reset pass"
                       " [4]Color [5]Exit: ")
        if option == "1":
            string = input("\nEnter string to encrypt here: ")
            encrypted = encrypt(string, password)
            save_to_clipboard(encrypted)
            save_to_log("log.txt", "Encrypted", encrypted, password)
        elif option == "2":
            string = input("\nEnter string to encrypt here: ")
            decrypted = decrypt(string, password)
            save_to_clipboard(decrypted)
            save_to_log("log.txt", "Decrypted", decrypted, password)
        elif option == "3":
            # this is all that is needed to reset the password
            # the user will be asked for a new password in the
            # next loop iteration
            password = None
        elif option == "4":
            # to be implemented by you
            raise NotImplementedError
        elif option == "5":
            print("Good-bye")
            break
        else:
            print("Not a valid input, please try again")


if __name__ == "__main__":
    main()

---

Miscellaneous comments:

• print("") and print() do exactly the same thing
• Use the with keyword to ensure a file is always properly closed:

with open("log.txt", "a") as f:
    f.write(date)
    f.write("\nDecrypted: {}".format(decoded_display))
    f.write("\nPassword: {}\n\n".format(code))

• I don't like the dict_error function. It makes your code less explicit. I think just writing this code where it appears is way more readable:

try:
    decode_num = alphabets[i] - numlist[n]
except KeyError as detail:
    print("\n\tError: the key {} in your entry cannot be used as a password".format(detail))
    input("")
    password()

• If you are using Python >= 3.6, you can use the new f-strings, which simplify the above format, by using the locally-defined variables as keys directly:

print(f"\n\tError: the key {detail} in your entry cannot be used as a password")

• If you have to add a comment like #It's confusing but code is the password, and numlist is the password in number format in a list, then you should think of better names.
• Try to avoid magic numbers. Instead of while encode_num > 90:, use while encode_num > len(numbers):. Even better yet, use modular division and directly set encode_num %= len(numbers).

Answer 2

Security

My question is, are there any flaws with my calculations? Given a sample key: "jabbathehut" and a sample message: "This is a secret message", could the original string be brute-forced within a week if someone knew the output and the encryption process, but not the key/password used?

To sum up the key points:

The real security of Vigenère is difficult to quantify. A million character plaintext with a 10 character password is easy to break. But a 10 character plaintext with a 10 character randomly chosen password is essentially a one-time-pad and "theoretically" unbreakable.

– mikeazo @ CryptoExchange

Why is Vignere not secure?

Note that this works for most unsecure crypto's see my sorta related xor bruteforce for an example of how to brute-force such a thing

• An attacker, who knows (or can guess) as many consecutive characters of any plaintext message as there are in the key, can trivially recover the key and thus decrypt all messages. (In fact, the characters need not even be consecutive, they just need to cover the entire key, or at least most of it.)
• For most natural messages, it's fairly easy to guess the key length, for example by looking at correlations between characters n positions apart.
• An attacker who knows (or can guess) the key length can divide the ciphertext into blocks of this length and decrypt one block with the other as the key to obtain a linear combination of the two messages. This will often have enough structure to allow the original blocks to be (at least partially) reconstructed, which in turn allows recovery of the key. (Also, if there are multiple messages encrypted with the same key, or if the key itself is not completely random, other similar attacks may be possible even without guessing the key length.)

– Ilmari Karonen @ CryptoExchange

Thus it depends on both the length of the password and the length of the text. The longer the text becomes, the easier it would be to crack, because as @hoffmale stated, letter frequency analysis would be fairly simple.

Conclusion

It would be possible to break the key within less then a week. Depending on some factors. If you want to be secure, don't use Vignere, but use a different one-time-pad method. But as mentioned by @Martin Bonner, the problem with OTP is the difficulty of communicating the key.

As a rule of thumb, don't roll your own crypto. Those are likely to never be more secure as the tested cryptography functions. There are many good python crypto libraries that will encrypt data. For instance, pycrypto or pycroptography.

---

FINAL NOTE

I came acros this great challenge, that shows how easy Vignere cypher can be broken, if for instance the key is used multiple times. The krypto wargames from overthewire provide some good insights on low-level cryptography.

Answer 3

The question is answered several days ago, to add information, your password's length is 11. This means there are 3,670,344,486,987,776 possible keys combinations which a brute force attacker must test (because each letter of the password leads the number of possible keys, the attacker has to test, to be multiplied by 26). Testing 3,670,344,486,987,776 keys/passwords is a work of years for a modern (ordinary) computer. But this does not mean Vigenere cipher is advised to use in practice for serious business as pointed by @Ludisposed (and you may also check the short but good answer here)