The following analysis looks at two neighboring runes. Whenever two identical runes appear one after another, the number sequence will print a “1” on dark background. Rune difference looks at the shortest distance between two neighbors. Maximum value is 14 if they are farthest apart. The value is zero if they are identical.
Note: Hover on a cell to see the offset in the file.
__SEC_DOUBLE__Quick IoC recap: Normal english IoC is about 1.77. Values below 1.4 are highly unlikely to be anywhat meaningful. Predicting english text with IoC gets worse if the text is very short.
Here we are considering to either ᚠ being an interrupt; or it's inverse ᛠ. The numbers (1–32) represent the key length. With a key length of 5, every fifth rune will be decrypted with the same alphabet.
Note: the darker the cell, the better the prediction. The runes per length columns influences the results of the other columns; so if this is low, the other columns are not reliable.
__SEC_IOC__This sections explores the idea of multiple alphabets alternating. For example, have two or three Vigenere ciphers that switch after each rune. A Vigenere with key length 3 (ABC) plus another Vigenere with key length 5 (DEFGH) will generate a pattern that only repeats after 30 runes (ADBECFAGBHCDAEBFCGAHBDCEAFBGCH). So the first group will represent every 2nd rune starting with the first, and the second group will contain every 2nd rune starting with the second.
There are two main distinctions. Interrupt-first-then-mod assumes that an interrupt will pause the alternation between the different groups. Mod-first-then-interrupt assumes that an interrupt will pause the key alternation within that group. Lets look at the example Vig(3) + Vig(5). With the first, the decryption sequence is: Vig(3)[0], interrupt, Vig(5)[0], Vig(3)[1], etc. With the second, the decryption sequence is: Vig(3)[0], interrupt, Vig(3)[1], Vig(5)[0], etc. Note that the second decryption still switched to Vig(5) but was ignored because it was an interrupt.
Note: The row header format is {interrupt}.{mod}.{offset}. “ᚠ.2.0” means, assume the interrupt is ᚠ, divide the data into two sets, then look at the first set (rune at index 0, rune at index 2, etc.). The column shows the keylength for which the IoC was calculated. In the previous example, with a key length of 7, indices 0, 14, 28, ... are part of one alphabet, and indices 2, 17, 30, ... are part of another alphabet.
__SEC_IOC_MOD__This section perfoms a running IoC with a window size on the whole text. For example, a window size of 50 will look at the first 50 runes and calculate the IoC (high). This will be the first value in the list. The text is offsetted by one and the next 50 runes are evaluated. This contiunes to the last set of 50 runes.
Same rules apply as to normal IoC; an IoC on 20 runes is just too small to get a meaningful result. But it helps to get the bigger picture ;).
__SEC_IOC_FLOW__