Finding the key length of a Vigenère cipher with the index of coincidence

AA HLAI HL Ambitious Also in: Probability, Statistics

Research question

Why does the probability that two randomly chosen letters match reveal the key length of a Vigenère cipher, and how long must the ciphertext be for the method to work?

Adapt it: change the place, the data or the comparison until the question is yours.

Free: the A–E checklist an examiner uses, by email ↓

Why it makes a good exploration

The index of coincidence is a beautiful probability argument that broke a cipher once thought unbreakable. You can derive it, test it, and measure its limits.

The mathematics you'll need

Probability that two letters match: Σ pᵢ²
Expected index of coincidence for English and for random text
Splitting text into columns; averaging
Testing the method against ciphertext length
HL: variance of the estimate

Course labels show where a technique sits; using maths from outside your course is fine if you explain it clearly and say it is new to you.

Where the data comes from

Use public-domain texts from Project Gutenberg as plaintext; encrypt with keys you choose.

Project Gutenberg — 70,000+ free public-domain books as plain text — ideal for letter and word frequency counts.
Desmos graphing calculator — Free graphing and regression (y₁ ~ ax₁ + b) — fit models to your data and show residuals.

Cite every source in a footnote where you use it and in your bibliography. Check the licence of any dataset you download.

A possible outline

Explain the cipher and why Caesar attacks fail.
Derive the expected index for English and for uniform letters.
Compute the index for each candidate key length.
Measure how reliably the true length is found for different lengths of text.
Reflect on long keys and non-English text.

Pitfalls that cost marks

Quoting the index for English without calculating it from data.
Testing only one key.
Not explaining why the columns behave like Caesar ciphers.

Showing personal engagement

Use a language you speak.
Choose keys that make the method fail and explain why.
Break a message a friend encrypts.

See Criterion C: personal engagement for what examiners look for.

Which course is it for?

Course	Fit	Maths to lean on
AA SL	Not a natural fit	The core technique sits in the AI course or at HL; an AA SL student could use it only as clearly explained new mathematics.
AA HL	Good fit	Probability that two letters match: Σ pᵢ²; Expected index of coincidence for English and for random text
AI SL	Not a natural fit	The mathematics is mainly AA or HL (calculus or proof beyond AI SL); an AI SL version would need a data-driven, technology-based approach.
AI HL	Good fit	Probability that two letters match: Σ pᵢ²; Expected index of coincidence for English and for random text

Level: Ambitious. Suits confident students; expect to learn some mathematics on your own. See how the IA differs between AA and AI, SL and HL.

How this idea reaches the top bands

Personal engagement (C)

Build and break your own small cipher or code, invent examples to test each result, and record the conjectures you made and the ones that turned out to be false.

Reflection (D)

Reflect on what each result guarantees and what it doesn't: which errors a check digit misses, which attacks a cipher survives, and how the answer depends on the size of the numbers. For this idea, start with: quoting the index for english without calculating it from data — say how it affects your answer.

Use of mathematics (E)

SL: Counting principles, probability or frequency statistics used correctly; any number theory (modular arithmetic, primes) introduced with your own small worked examples and explained, not quoted.

HL: Rigorous proofs (by contradiction or induction) of the number-theory facts you rely on, counting arguments made general, or a statistical attack tested formally.

Criteria A and B (presentation and communication) work the same way for every idea: see the guides to Criterion A and Criterion B.

Taking it further

Recover the full key with chi-squared on each column, or study why a key as long as the message defeats the method.

Extending it for HL

This idea already has HL mathematics in it: variance of the estimate. Prove the key result in general (why the check digit catches every single-digit error, why the decryption undoes the encryption) rather than checking examples.

See a complete IA, marked

Our annotated exemplar How long does a game of Snakes and Ladders last on my grandmother's board? (AI HL) asks a different question, but shows how a complete cryptography exploration is structured and marked, with an examiner's comment on every criterion. Free excerpts and the full marking table are on its page.

Before you start: the checklist an examiner uses

Every check for Criteria A–E in a 4-page PDF, the mistakes that cost the most marks and a self-assessment grid. We'll email it with a short IA tip every few days, timed to your deadline if you give it. Free — no account, no payment.

Get the free checklist

Turn this idea into your IA

Plan this IAOpens the planner with this question, the maths and data sources filled in. Criteria checklistCheck your plan or draft against the A–E descriptors and self-grade before you hand it in. AI feedback on a draftCriterion-by-criterion feedback with evidence from your own text. Coaching, not rewriting. Examiner reviewPete, an IB examiner, reads your draft and talks it through with you (€100).