Methodology

This page explains how we test theories, score results, and determine whether a cipher approach has been eliminated.

The K4 Ciphertext

All 26 letters of the alphabet appear at least once. Sanborn has confirmed the plaintext beneath two spans, 24 characters in all.

0 10 20 30

O B K R U O X O G H U L B S O L I F B B W F L R V Q Q P R N G K S

· · · · · · · · · · · · · · · · · · · · · E A S T N O R T H E A S

40 50 60

S O T W T Q S J Q S S E K Z Z W A T J K L U D I A W I N F B N Y P

T · · · · · · · · · · · · · · · · · · · · · · · · · · · · · B E R

70 80 90

V T T M Z F P K W G D K Z X T J C D I G K U H U A U E K C A R

L I N C L O C K · · · · · · · · · · · · · · · · · · · · · · ·

Those 24 characters are the foundation of the scoring below. They also fix the internal key values at those positions, which is what makes whole families of cipher and key testable at all.

Scoring: Crib Matching (0–24)

For any proposed method and key, we count how many of the 24 known plaintext positions come out right. That is the score. A random key and a 26-letter alphabet would land fewer than one of them by luck, so even 6 is far beyond chance, and the bands below are set conservatively.

Scoring bands against the random-key baseline

The copper line is what a RANDOM key scores, and it is not flat. A periodic key forces every crib position sharing a residue class to take the same key value, and a search picks whichever value satisfies the most of them, so longer keys buy free matches. At period 7 the baseline is 8.1 of 24 and a real result stands out. By period 24 it is 19.2, inside the SIGNAL band, so a "significant" score there means nothing at all.

The dip is not noise. K4’s known letters sit in two blocks, at positions 21 to 33 and 63 to 73, and how those blocks collide under a given period decides how many residue classes there are to spread across. Period 21 leaves only 13 classes and the baseline falls back to 13.4; period 24 leaves 19 and it climbs to 19.2. Read the chart, not the number.

The practical rule: scores are only discriminating at period 7 or below. Above that the threshold is chasing the baseline, and at 24 and up the baseline has overtaken it. The curve is computed from the real crib positions rather than transcribed; the derivation is in ops/site_builder/build.py.

Bean Constraints

In 2021 Richard Bean published additional constraints on the K4 keystream. They all come from one observation: the ciphertext letter P appears at both position 27 and position 65, and the confirmed cribs say both decrypt to R.

One equality, 242 inequalities

Same ciphertext letter, same plaintext letter, so the key value at those two positions has to be identical. That single fact, propagated across the 24 known positions, forces 242 pairs of key positions to DIFFER, drawn faintly below the axis, plus 101 linear relations not shown. Together they cut the admissible keystreams at those 24 positions from 26 to the power 24 down to exactly 624.

The constraints hold whichever variant is in play, Vigenère, Beaufort or Variant Beaufort, provided the cipher uses an additive key model (CT[i] = f(PT[i], K[i]) mod 26). A lookup table, a physical overlay or a grid-based system is outside their reach.

Combined with a counting argument about repeated key values, they show that no repeating key of any length can produce the K4 plaintext under direct positional correspondence and additive-key assumptions. That is a deterministic proof, reproducible from the codebase. It says nothing about a transposition layer that reorders positions before substitution, or about a non-additive cipher.

Two-System Model

Jim Sanborn stated at the Kryptos dedication that “there are two systems of enciphering the bottom text.” Scheidt stated that he “masked the English language so it’s more of a challenge” and that solvers need to “solve the technique first and then go for the puzzle.” The “two systems” quote is public evidence. Any specific interpretation of that quote is a hypothesis, not a fact.

Pure transposition is independently impossible: the ciphertext contains only 2 E’s, but the known cribs require 3. Therefore at least one layer must be substitution. Beyond that, the architecture remains open. Current live project surfaces include:

Layered classical models: heavily tested in bounded structured families, but not globally exhausted.
Procedural or physical constructions: still live, but only as explicit, finite, testable procedures.
W-delimiter segmentation: the five carved W positions explain the old width-21 anomaly. As of April 2026 the single-layer construction is saturated (80+ tested, no signal) and is now admissible only as a multi-layer component; the interpretation is otherwise still open.
Null extraction: still possible in principle, but the old score-conditioned null-palette result is retired and cannot be cited as evidence.

The April 2026 audit explicitly rejected treating any single two-system story as the project’s established model. The correct public stance is: K4 likely involves a technique beyond straightforward single-layer classical encryption, but the exact composition is unknown.

What Has Been Exhaustively Tested

Over 532 experiments spanning 671.1B+ individual hypothesis evaluations have been run (with overlaps across experiments), eliminating:

All repeating-key ciphers (every variant, both alphabets, all key lengths): proven impossible under direct positional correspondence and additive-key assumptions (Level A)
All self-keying ciphers (every variant, all primers): proven structurally impossible under additive-key assumptions (Level A)
Many structured substitution + rearrangement combinations (~1.2 billion evaluations): 14 rearrangement families under the registered bounded search programs
All Cold War-era cipher models (VIC family): extensively tested across multiple variants
All letter-pair ciphers (Four-Square, Playfair, Two-Square): apparent high scores are overfitting artifacts
Every specialized cipher we could find: Gromark (8.74 billion keys), plus Feistel, Gronsfeld, Porta, and more
Running key from 60,000+ public texts (106 billion position-checks): zero signal. A narrower follow-up (April 2026) found that running-key × columnar widths 6/8/9 is blocked by the current 242-inequality Bean constraint set regardless of source text; other transposition families and non-English sources are not covered by that result.
Two-layer compositions tested (105,692 branches): additive × transposition, transposition × periodic substitution, 6 stateful families — zero Bean passes, max crib score 6/24 within the registered layer families and default keyword sets
Three-layer non-columnar compositions tested (838,350 branches, April 2026): {additive, Vig, Beau} × {myszkowski, rail fence, route, block transposition} × {additive, Vig, Beau} — max crib score 7/24. This covers the enumerated layer registry with default parameter generators; non-registered outer families (e.g., homophonic, bifid, four-square as composition outer) are not included.
All rearrangements of the 73-character text: 4.5 million rearrangements tested with each cipher variant
Sculpture reading paths as keys: 10,777 paths tested, all noise
Grid-position-based keys: key derived from position on the grid, zero signal
Morse code hypotheses: multiple Morse-based encoding schemes, all noise

73-Character Hypothesis

The carved text has 97 characters. One working model proposes that 24 characters are nulls (97 − 24 = 73 real ciphertext characters). This is a hypothesis, not a proven fact.

The strongest current public support is not the old null-palette result; that evidence was retired in April 2026. The cleaner live structural observation is that the five carved Ws create a bounded segmentation hypothesis. Even that does not prove nulls. The 73-character idea remains open, but it currently lacks independent, model-neutral quantitative support.

Note: The number 24 also appears in other K4 contexts (24 crib characters, Berlin Clock has 24 facets, K3 chart has 24 rows). These coincidences are not evidence; many small integers recur naturally. They are documented here only because they are frequently mentioned in community discussions.

The Null Palette (Retired April 2026)

A score-conditioned null-palette result was once treated as a key observation. It is retained in the repo only as a cautionary historical case.

Matched controls disproved the palette’s specificity. The apparent convergence advantage was generic to restrictive palette-constrained search and did not justify treating that letter set as real evidence about K4.

Palette constraints remain useful as a computational technique in some search programs, but the site no longer treats any retired palette identity as a cryptographic clue.

What Remains

Null mask + periodic substitution is proven impossible for ANY choice of 24 filler positions at every repeat length from 1 to 23. The algebraic argument depends only on how many filler letters fall in each of the three known-plaintext segments, and every possible split fails. (Repeat lengths 24–26 are too long to be decided either way on a 73-letter text.) If the 73-character model is correct, the cipher operating on the extracted characters must use a non-periodic key: a running key from an unknown source, a bespoke procedural method, or a one-time key.

On 2026-04-08 we ran an adversarial internal audit of the scope of our own testing and reclassified the frontier into “testable now” (bounded, reproducible campaigns we can run), “weakly testable” (requires better detection apparatus, not more compute), and “untestable under current clues” (requires new primary-source evidence). We are aware that classical cipher space is infinite and cannot be literally exhausted; this classification describes the scope of what we have tested under our specific assumptions, not a claim about K4 as a mathematical object. Full audit and record are in the internal status audit (docs/exhaustion_audit_2026_04_08.md in the research repository).

If you have an idea we have not tested, the Submit a Theory page is the direct path. We want to be wrong about anything we have classified as ruled out.

Validation Criteria

A candidate solution is not accepted unless it passes all of the following simultaneously:

Crib score: 24/24
Bean constraints: PASS
Text quality: letter patterns must match normal English (measured by how common its 4-letter sequences are)
Letter frequency: must match the statistical profile of English text
Readability: must produce meaningful English with recognizable words (human review required)

How to Read Claims on This Site

Two questions decide how much weight a claim carries: how strong it is, and how thorough the search behind it was.

Strength	Level	Tier	What it means
Proven	A	1	Mathematical proof or complete enumeration, conditioned on stated assumptions. Disagree with the assumptions and the proof does not apply.
Exhausted	B	2	Every configuration in a defined space tested, all noise. Does not extend to untested variants or multi-layer combinations.
Descriptive	C	3	A pattern found after the fact, or a search that sampled rather than covered. Does not show how K4 was encrypted.
Open	D	4	A conjecture, or a method never properly tested.

Level and tier line up exactly at A/1 and B/2. Lower down they drift: C and D describe a finding, tiers 3 and 4 describe coverage.

Claims also carry a provenance tag, which is a separate question from strength. [PUBLIC FACT] is reputable reporting or a primary source, [DERIVED FACT] a deterministic consequence of one, [INTERNAL RESULT] our own output with a repro command, and [HYPOTHESIS] a claim that ships with a test plan instead of a result.

P-values here are uncorrected for the project’s roughly thousand experiments unless stated. Across that many tests, individually “significant” results are expected by chance. They are documented for transparency, not offered as proof.

Reproducibility

Every elimination includes a reproduction command you can run yourself. The entire codebase is open source. Clone the repo, install Python 3.11+, and run any experiment with PYTHONPATH=src.