Solving a Mystery From the Thirty Years’ War

In 2013, an unsolved encrypted message was presented in a Czech cryptogram solving competition. This message was sent by Karel Rabenhaupt ze Such´e to Amalie Elisabeth von Hanau-M¨unzenberg, Land-gravine of Hessen-Kassel at the end of the Thirty Years’ War. During the following years, many crypto enthusiasts tried to solve the cipher without success. Finally, in 2020, the authors of this paper were able to reveal the content of the encrypted message. Here we present the decryption of the encrypted message, including the historical background of the communication. We also present an analysis of the used encryption system.


Introduction
The history of the European nations is deeply interconnected. European aristocratic families played crucial roles in military and international diplomacy. Through a web of correspondence, the historical mosaic can be reconstructed and presented in various aspects.
Archives of European aristocratic families still contain many unsolved secrets. In our project, we focus on historical archives of families who lived in the former Austro-Hungarian Monarchy. The nobility had strong ties in the whole Central European region. As such, the study of encrypted correspondence found in any middle-European archive is not self-contained, but instead requires additional materials from many different archives in multiple countries (Hungary, Austria, Czechia, Poland, Germany, ...).
In the present paper, we focus on a story of a specific encrypted message. We want this story to demonstrate the need for interconnected research in historical cryptography, and the need to have a platform for efficient sharing of encrypted (and decrypted) materials and keys.

Historical Background
Our focus is an encrypted message created during the Thirty Years' War in the Rhine region and now deposited in The State Regional Archives in Pilsen (SOA v Plzni,FA Trauttmansdorff,inv. nr. 125) in the Czech Republic.
The encrypted message is a part of the correspondence of Karel Rabenhaupt ze Suché with Amalie Elisabeth von Hanau-Münzenberg, Landgravine of Hessen-Kassel. In this section, we briefly summarize the historical background of the sender of the encrypted message.
Karel Rabenhaupt ze Suché (see Figure  1), was born in 1604 as the son of the Bohemian Protestant nobleman Zikmund Rabenhaupt (Robmháp) ze Suché, the owner of the land estates Lichnice and Třemošnice, 1 and KateřinaŽehušická z Nestajova (Engelbrecht, 1989; Genealogical-heraldic collection of Wunschvitz,inv. nr. 921). In 1620 he took part in the defense of Bautzen against the army of John George II, Elector of Saxony. After the defeat of the Bohemian Revolt on Bílá Hora he emigrated to the Netherlands because of his faith. He began to study fortress construction at the Leiden University (Woringer, 1913;Engelbrecht, 1989).
He fought in the Dutch army, and he was promoted to the rank of lieutenant in 1627 after the siege of Groenlo. Later on, he became famous in his military service. He joined William V, Landgrave of Hessen-Kassel. From 1633 he was the commander of the Schaarkopf cavalry regiment. After the death of William V in 1637, Amalie Elisabeth (see Figure 2) took over the government as the regent of William VI (Engelbrecht, 1989; After the Thirty Years' War Rabenhaupt stayed in Hessian service and gained high military posts there. In 1668 he left the service and moved to his estates in the Netherlands. Rabenhaupt became a national hero in the Netherlands in 1672, after defending the city of Groningen. 2 He not only defended Groningen against the Münster army, but he was also able to break through and recapture one of the most modern and powerful fortresses of its time, Coevorden. He became Coervorden's governor. In 1673 he was promoted to the status of a baron by the Emperor, now an ally of the Netherlands, for his services in defending the Netherlands. He died on August 12, 1675(Woringer, 1913Engelbrecht, 1989).

Rabenhaupt on the Rhine
In 1640, Count Kaspar von Eberstein became the commander-in-chief of the army of Hessen-Kassel. In the same year, Rabenhaupt, in Eberstein's presence, conquered the town of Kalkar, which lies on the lower Rhine near the border with the Netherlands. From there he made raids along the Rhine to the south (Warlich, 2021).
In 1642, the Protestants conquered Kempen, Linn, and Neuss. The city of Neuss, near Düsseldorf, fell to the Hessians. The same year, Rabenhaupt became military commander of Neuss, and made the city his base for military actions, especially on the left bank of the Rhine. On the opposite side, one of the important Imperial strongholds in this area was the fortified city of Zons, which belonged to the Electorate of Cologne, and was located about 14 km southeast of Neuss. In the following years, neither side of the rivals gained a significant advantage, and the fighting devolved into smaller skirmishes, partial raids and tactical shifts (Löhrer, 1840). Rabenhaupt was captured in April 1644 but was released again in the summer (at the latest). In the autumn of the same year, Eberstein died, and after his death, Johann von Geyso temporarily became the head of the Hessian troops (Warlich, 2021).
In 1645, Rabenhaupt tried unsuccessfully to conquer Zons (Woringer, 1913;Warlich, 2021). He was more successful in the autumn when the Hessian army managed to conquer the city of Euskirchen, which belonged to the Duchy of Jülich-Berg and was located about 60 km south of Neuss. From there, the Hessians controlled the entire adjacent area (Hofmann, 1882).
At the beginning of 1646, Colonel Rabenhaupt was appointed major general 3 (HLA-HStAM, Best. 4 h, Kriegssachen, Nr. 1810). The Hessian army on both sides of the Rhine was again engaged mainly in smaller battles. During February, Rabenhaupt managed to occupy numerous settlements in Jülich-Berg and later moved to the right bank of the Rhine for a time, as he was to be in Wipperfürth on March 2. From the west, however, the allied French army approached, led by Marshal Henri de La Tour d'Auvergne de Turenne, and from the east and north, the Swedes. The two armies tried to unite. The enemy forces were led by Imperial General Peter Melander von Holzappel, who changed sides during the war. It is interesting that until 1640 he was the commander in chief of the Hessian army. After his resignation, he was replaced by the aforementioned Count Kaspar von Eberstein. Melander's deputy was Otto Christoph von Sparr. He was also at this time the main opponent of Rabenhaupt, and also successfully prevented Marshal de Turenne from crossing the Rhine (von Schroetter, 1899;Warlich, 2021).
Rabenhaupt has been preparing for the siege of Zons since the summer or maybe has even besieged it directly for some time, as Rommel (1843) states. In early July, Rabenhaupt made a military move against Bonn to ease the pressure on Euskirchen. Rabenhaupt has described this successful operation in details in his report, which was preserved in a manuscript in the library of Wolfenbüttel (Löhrer, 1840;HAB, Cod. Guelf. 11.8 Aug. 2°, ff. 368-369).
In this situation, an encrypted letter, which is the main subject of this article, was created. Thanks to its decipherment (see Section 5), we know that Rabenhaupt's main goal at this time was indeed the conquest of Zons and that he probably hoped for the help of Marshal de Turenne (SOA in Pilsen, FA Trauttmansdorff, inv. Nr. 125). We know from 3 General-Wachtmeister other sources that de Turenne eventually refused to help Rabenhaupt with the siege of Zons. Apparently, he did so because it would keep him from the main task of uniting with Swedish troops, in which he succeeded at the turn of July and August 1646. Although he could not cross the Rhine in the south, he went north to Wesel and met the Swedes in Hessen. This operation was very swift. Sources show, that while he was supposed to be at Ahrweiler on July 12, he had managed to cross the Rhine at Wesel on July 15. Even after de Turenne's departure from the area, Rabenhaupt continued to dominate the left bank of the Rhine. General Melander, therefore, tried to get the Hessians from the Rhine by making a diversionary assault against their capital Kassel. However, at the end of September, Rabenhaupt attacked Zons again, forcing Melander to return (von Rommel, 1843;von Schroetter, 1899;Salm, 1990).
The siege of the city began on September 24, 1646, and on September 28, heavy artillery was launched, which greatly damaged the city. According to some sources, the walls had already been broken and negotiations for a possible surrender had been initiated. On October 6, however, Melander crossed the Rhine and the Hessians had to withdraw to Neuss. Melander then went on to conquer Euskirchen. Later in October, Rabenhaupt was reported to be with Geyso in Wesel. As early as 1647, Rabenhaupt operated in Neuss, but was then assigned to General Königsmarck's Swedish army and left with him. In May he was already with Königsmarck near Vechta in northern Germany (Wassenberg, 1647;von Rommel, 1843;Hofmann, 1882;Warlich, 2021).
The area of Karel Rabenhaput ze Suché's operations on the Rhine is marked in Figure 11 (in the Appendix).

An Unsolved Cryptogram From the Thirty Years' War
In 2013 an unsolved encrypted message was presented in a Czech journal  as part of a cryptographic competition. Here, we summarize the most important facts known at that time: The object of the competition was an encrypted message (see Figure 12), which is now deposited in The State Regional Archives in Pilsen (SOA v Plzni, FA Trauttmansdorff, inv. nr. 125). The encrypted message was a part of a correspondence of Karel Rabenhaupt ze Suché with Amalie Elisabeth von Hanau-Münzenberg, Landgravine of Hessen-Kassel, from 1646.
Beside the encrypted message, a second (unencrypted) message was found.
These two messages were intercepted near Arnsberg and were never delivered. After the interception, the encrypted message was directly investigated by the military commander Alexandre de Bournonville, but he was unable to solve it. Alexandre de Bournonville, on July 20, sent a copy of the messages from Hamm to Maximilian von Trauttmansdorff, who was the envoy of Emperor Ferdinand III to peace talks in Münster. He hoped that somehow Maximilian von Trauttmansdorff would be able to find the corresponding encryption key.
The encrypted message is dated to 11 (or 13) 4 of June 1646. The second (not encrypted) is dated July 13, 1646. Both messages were written in German language and were sent from Neuss. The date of the encrypted message is probably not correct. Due to the fact that both messages were intercepted together in the same place, it is more possible that the encrypted message was also written in July. It is also probable that Alexandre de Bournonville would not have sent the report about the encrypted message a month after the interception. So it is more probable that Bournonville's scribe made a mistake copying the message SOA v Plzni, FA Trauttmansdorff, inv. nr. 125).
The unencrypted letter tells about movements of Marshal de Turenne's troops, that were presumably referenced in the previous letter sent on July 11th. The unencrypted letter also references other army movements in the Rhine valley around Zons and Wesel. The encrypted letter contains cleartext parts, but the important information is encrypted with numbers and symbols. The preliminary analysis points to the possibility that a nomenclator encryption scheme was used.

Nomenclator Encryption System
A nomenclator is a special encryption system consisting of several different simpler encryption sys-tems used together during the encryption.
A nomenclator 5 mostly contains a monoalphabetic or homophonic substitution in a combination with bigram and/or trigram substitution, code word substitutions and nulls (Mírka, 2012;von zur Gathen, 2015;Antal and Mírka, 2018). The basic encryption key of a nomenclator is frequently represented in a table. Additional codes used in a nomenclator can grow its size to several pages. The cipher text alphabet is very often represented by numbers (mostly due to the large number of possible code words and homophones). 6 In addition to digits/numbers, special symbols/glyphs were used as well 7 (Antal and Mírka, 2018;Dunin and Schmeh, 2020). This type of encryption was very popular and was used for a long time period from the fourteenth to the nineteenth century (Dunin and Schmeh, 2020;Meister, 1906;. After taking a closer look at some available nomenclator constructions (Mírka and Vondruška, 2013;Antal and Mírka, 2018;Dunin and Schmeh, 2020) we can conclude that many nomenclators were poorly designed: cipher text numbers (or letters) were assigned in an alphabetical or numerical order (see Figures 3, 4 and 5). The nomenclator key could be also used incorrectly (Dunin and Schmeh, 2020). Another possible drawback of some nomenclator keys was that they have been used for a long time period, and have been reused by several different persons. On the other hand, this means that some nomenclator copies have survived in various archives.

The Solution of the Cryptogram
The cryptogram was made publicly available in 2013 as a part of a Czech cryptogram solving competition. Antal and Zajac (2013) tried to solve it within the competition but without success. Despite to additional popularization of the encrypted message in conferences and blogs, nobody was able to directly solve this mystery. In fact, a correctly used nomenclator scheme can remain unbreakable even with modern computing power, especially if the analyzed cipher text is short. However, there was still a hope that the nomenclator key may have been preserved in some archive.
We have searched for additional documents related to Karel Rabenhaupt in the Hessian State Archives in Marburg. Unfortunately, the studied collections did not contain nomenclator keys. After the cipher challenge was published on Klaus Schmeh's site (Klausis Krypto Kolumne, 2020), one of his readers (using the Thomas nickname) directed us to the HSTaM 4d collection in this archive. The collection contains a lot of different nomenclator keys from the seventeenth and eighteenth century, and as we found out, it also contains the key that was used to encrypt Rabenhaupt's letter.
In fact, there are three almost identical nomenclator keys, which fit our cryptogram (one of the keys in Figure 13). Two of them have also an inverse key. 8 To date the keys, we use the fact that they contain notes with names. Probably the first of the series is from 1641 and was created as a new key to communicate with Lieutenant-General Count von Eberstein Interestingly, the name of Karel Rabenhaupt is not present on these keys. 9 There is also a possibility that there were even more users of this nomenclator than mentioned on the nomenclator itself. Note that the latter story of Rabenhaupt's letter shows that the Emperor's agents were unable to read the encrypted parts of the letter in 1646, and perhaps later. This means that even with multiple users of the key, the key management was relatively secure.
Having found the (correct or related?) nomenclator key, we used it to decipher the encrypted parts of the letter. The obtained result contains dozens of typos/mistakes. Such mistakes can also make potential decryption harder. These mistakes could have been caused either by Rabenhaupt or more probably by a scribe while copying the original document.
After the corrections, the final version of our solution is the following (the deciphered parts in the text are marked in bold): Copia Durchleuchtige, Hochgeborne Fürstin, Gnädige Frau.
Dießen Morgen empfang ich Andtwortschreiben von Mareschall de Turenne, so gestern in Eusskirchen gewesen undt daherumb gelegen, dass er heutte marchiren undt also morgen vor Zoons sich setzen wolte. We have created a rough translation of the deciphered message to English, presented in Appendix B. The original text is difficult t o t ranslate, and without further context, some passages can be interpreted in various ways. We tried to preserve the nuances of the original text to avoid potential shifts in the meaning of the text.

Analysis of the Cryptogram
In this section, we revise to and extend the preliminary analysis of the cryptogram from Antal and Zajac (2013), and point out some weaknesses of the used encryption method.
The encrypted message contains both encrypted and unencrypted parts. The whole text consists of 34 rows: 13 rows are fully encrypted, 13 rows are encrypted partially and 8 rows contain only plain text (not encrypted) parts.

= Feuermörsel
Rows containing both encrypted and unencrypted passages are very valuable. This property can be useful to guess the content of the encrypted part. As an example, the second row starts with the German sentence "Dießen Morgen empfang ich Andtwortschreiben von . . ." (This morning I received a letter of reply from . . .) and continues with cipher symbols. From the meaning of this passage, it is clear, that the text should continue with a name of a person. From section 2.1 we know that Rabenhaupt was in Neuss at the time of the writing of the document (in July 1646) and the army of Vicomte de Turenne operated nearby Rabenhaupt. His name is also present in the second (not encrypted document). In fact, the solution of the first encrypted passage is directly "MARESCHALL DE TURENNE" (see section 5).
The encrypted part of the document consists of numbers, letters (uppercase and lowercase), and special symbols/glyphs. 11 These units are mostly divided by dots. 12 Dots were commonly used in nomenclators as separator chars. In the document, a dot is the most frequent symbol and really serves as a separator char. The transcription of the cipher text is in Appendix A. After splitting the text by the separator char, 13 the encrypted part of the document contains 118 unique cipher text units and is 369 symbols/letters/numbers long. 14 There are: • 145 numbers (51 unique), • 105 symbols (30 unique), • 72 lower case and 24 upper case letters (24 unique), • and 23 double letters (13 unique).
Based on a large number of cipher text units and on the relatively flat frequencies (Figure 6), Antal and Zajac suggested (2013) that the nomenclator consists of a homophonic substitution, bigrams, codes, and nulls. The possible way of solving such 11 The first row contains the word Copia, the document is probably only a copy of the original document. This is the reason why many transcription errors (typos) occurred during the copy, see section 5. 12 In some cases the dot separator is missing, but there is a wide space between the cryptogram units so they can be distinguished. 13 We added several dots in case it was not present to unify the structure of the cipher text.
14 Numbers and double letters are counted as one cipher text unit, e.g. 110, pp. a complicated nomenclator is to guess/separate the nomenclator sub-ciphers, guess the most frequent cipher text units, or try to find something that was incorrectly used during the encryption.
If we examine the frequency characteristic separately for numbers, symbols, and letters we can find some interesting properties. The frequency characteristics of the lower case letters (Figure 7) is similar to a frequency distribution of a simple substitution (the index of coincidence of these letters is also high). This means it can also be a row in a homophonic substitution table. The letter u has the highest frequency and can stand for the plain text letter e.
The number frequencies ( Figure 8) are relatively flat, only the number 59 has a relatively high frequency. If 59 is also obtained in the homophonic cipher, it can stand for a frequent letter such as e. From the symbol frequencies ( Figure 9) we were unable to find any useful details.
In (Antal and Zajac, 2013) the authors also investigated the cyclic structure of homophones.
Although the used nomenclator is relatively strong, we can see that there are some mistakes that allowed Antal and Zajac (2013)  • letter u stands for plain text letter e, • number 5 (that is in fact a symbol very similar to number 5) stands for plain text letter n, • number 59 also stands for plain text letter e. Unfortunately, these suggestions are not enough to solve the cipher by analysis. The used nomenclator key is complicated and was designed carefully. The letters are used as homophones and nulls as well. The numbers are used to encrypt homophones, code words, and nulls. The symbols are used both as homophones and to encrypt common bigrams.
The used homophonic substitution is very strong -each set of homophones (assigned to a plain text letter) consist of 8 to 11 elements and consist of numbers, lower case single letter, upper case double letters, and symbol. The fre-quency characteristic of the used cipher text elements is flat (except for few elements from the homophones). We expect that to solve such a homophonic substitution an impractically large number of cryptograms would be required.

Conclusions
Nomenclator encryption systems were used extensively in European warfare and diplomacy. Some of them were used and designed incorrectly (see section 4), so they could be solved. On the other hand, correctly designed (and used) nomenclators provide strong encryption which is almost impossible to solve correctly.
Our case study shows that historians and historical cryptography enthusiasts have an alternative method of solving encrypted historical documents. We can try to "connect the dots" and search for original keys (or their copies and related documents) in historical archives.
In our present paper, we focused on the story of a specific encrypted message, that resisted classical cryptanalytic attempts. As we have shown in the paper, the nomenclator used in the communication between Karel Rabenhaupt ze Suché and Amalie Elisabeth von Hanau-Münzenberg, Landgravine of Hessen-Kassel was designed carefully (see sections 5 and 6). It contains a strong homophonic cipher, common bigram encryption, code words, and a large selection of nulls. Despite the presence of unencrypted parts between the encrypted parts of the document, the cipher text does not contain enough information for relevant cryptanalysis.
The search for the decryption key was quite complicated as well. The encrypted document was found in the State Regional Archives in Pilsen, Czech Republic. However, the correct nomenclator key was preserved in the Hessian State Archives in Marburg, Germany. This particular situation was caused by the fact that the encrypted message was intercepted during the Hessian war and sent for analysis to Emperor's envoy von Trauttmansdorff, who has stored the (unsolved) letter in his family archive. This situation might not be unique, and archives of one side of a war can contain intercepted messages of the other side, with keys remaining in the opposite archives. Furthermore, documents in family archives were passed down during centuries and moved to different locations.
The goal of our story was to demonstrate the need for interconnected research in historical cryptography. To efficiently analyze and solve historical cryptograms, researchers need to have a platform for efficient sharing of encrypted (and decrypted) materials and keys. We hope that collaboration efforts such as the DECODE 15  database and the HCPortal Cryptograms 16 (Antal and Zajac, 2020) database can result in further joint projects and connected open data platforms and tools available for both researchers and crypto and history enthusiast all over the world.

B English Translation of the Deciphered Message
Copia Enlightened, highly noble Princess, a gracious Lady. This morning I received an answer from Marshal de Turenne, who was in Euskirchen yesterday and had a camp nearby. He wanted to march today and settle in front of the Zons tomorrow. So I do my math, I have 1,500 infantry with one battery of cannons and one mortar. With God's help, we'll do a short process with that [Zons]. And because I firmly believe that it is an advantage of the Allies that they endure [in the siege] longer than others, perhaps what is to happen will happen before the Marshal gets there. Therefore, I would like to ask your Princely Grace to order immediately that the levies from East Frisia and the borrowed cannons be sent to Wesel. I would like to do something important and arrange [for the army] good winter quarters. I hereby commend myself to the beneficial protection of Your Princely Grace and remain a subject to Your Princely Grace, an obedient servant Rabenhaubt Neuss, June 13th, 1646, to Landgravine of Hessen, Amalia Elizabeth