How it began
Abu Yusuf Yaqub ibn Ishaq al-Kindi was born in 801 in Kufa or Basra, in present-day Iraq, and died in Baghdad in 873. He moved to Baghdad and worked under the protection of Abbasid caliphs beginning with al-Mamun. Around 850 he wrote A Manuscript on Deciphering Cryptographic Messages, which contains the oldest known description of cryptanalysis by frequency analysis. It has been suggested that close textual study of the Quran first showed that Arabic has a characteristic letter frequency.
How it works
In any stretch of written language some letters occur more often than others, and the pattern is roughly the same across samples of that language. The analyst counts the frequency of each letter in the ciphertext, counts the letters of a normal text in the same language, and compares the two lists. The most frequent cipher letter probably stands for the most frequent plain letter. With a few exchanges a plausible text emerges. More advanced use counts pairs and triplets of letters.
How it spread
Frequency analysis was widely used in European states by the time of the Renaissance. Cipher makers responded with countermeasures: homophonic substitution, which gives common letters several alternatives, polyalphabetic substitution, which Leone Alberti seems to have been the first to propose, and polygraphic schemes that encrypt pairs or triplets of letters as units.
What changed first
Al-Kindi noted that the relative frequency of a letter in a given language tends to settle at a stable value, and he realized that this was enough to decrypt substitution ciphers. A Columbia University lecture observes that publishing such work around 850 implies he had already met sophisticated methods of encryption. His book has also been described as the earliest known use of statistical inference.
Where it stands today
Letter counting and analysis are now done by computer software in seconds. With modern computing power, classical ciphers are unlikely to provide any real protection for confidential data, and the method al-Kindi described remains the standard first attack on them.
