Griffoynich: A Real Cipher That Mimics Voynichese

The Voynich Manuscript has been called the world’s most mysterious book, and with good reason.  An illustrated codex written on vellum carbon-dated to the early fifteenth century, it contains page after page of text in a unique and unidentified script, provisionally called “Voynichese,” that has frustrated efforts at decipherment by seasoned cryptanalists for many decades.  Here’s a sample (from the top of folio 9v):

In EVA—the most widely used Voynichese transcription alphabet—this passage would read something like fochor oporody opy shor daiin qopchypcho qofol shol cfhol daiin / dchor qoaiin chkaiin cthor chol chor cphol dy / oty qokaiin dy / ykey chor ykaiin daiin cthy otaiin oky / oeees daiin / yteytchy kaiin cthor otol oty toldy.  However, the spacing is frustratingly ambiguous, as is the identification of discrete glyphs.

If you’d like to see more, the Voynich Manuscript Voyager created by Jason Davies offers an excellent interface for navigating digital facsimiles of the manuscript, which otherwise lives in the Beinecke Rare Book and Manuscript Library at Yale.

Every now and then, someone claims to have discovered that individual Voynichese glyphs correspond to the sounds or letters of some natural language or writing system—for a few examples, check out the hypotheses of Nicholas Gibbs, Stephen Bax, and Gerard Cheshire.  However, none of the proposed keys yields anything like a consistently intelligible reading, and formal analysis of the script itself reveals a host of patterns conspicuously unlike those of any known natural language.  Voynichese has a penchant for repeating similar-looking “words” ad nauseam in close proximity, but it hardly ever repeats the same set of three “words” in a row.  Nearly every “paragraph”—text spanning multiple lines—begins with one of four similar-looking glyphs conventionally referred to as “gallows.”  The distribution of other glyphs follows oddly rigid rules that don’t seem consistent with a plausible distribution of linguistic phonemes.  Some “words” are extremely common, but there’s also an unexpectedly high proportion of unique “words” that turn up only once.  The list of such un-language-like characteristics goes on and on.

One explanation offered for all this has been that the Voynich Manuscript is a hoax, and that its odd patterns came about as a byproduct of the technique somebody used to generate long strings of gibberish.  Gordon Rugg has tried to make a case along these lines by simulating a method of composing pages using two-dimensional tables of Voynichese characters in conjunction with Cardan grilles—pieces of paper with square holes that ordinarily expose select parts of a written text on which they’re overlaid to expose a hidden message within it.  By moving Cardan grilles into different positions on the tables and copying the exposed glyphs, Rugg found he was able to compose pages of gobbledygook quickly and easily that share some formal features with Voynichese, leading him to conclude that the Voynich Manuscript itself was probably generated in the same way.  There are two strikes against his argument: (1) in itself, his grille-and-table method won’t replicate the puzzling un-language-like features of Voynichese noted above; and (2) there’s no other evidence of Cardan grilles predating 1550, or of them being used in the early modern era for any purpose like the one Rugg proposes, making his choice of tools and mechanism seem rather arbitrary.  On the other hand, there’s something to be said for trying to simulate the writing of Voynichese according to different hypotheses about how it works, and then comparing the results with real Voynichese.

Of course, another explanation for the patterns of Voynichese would be that they somehow arose from the workings of a legitimate cipher or code.  A great deal of sophisticated analysis and speculation has been carried out in this spirit, resulting in impressive statistics and intriguing conclusions about structure.  It makes for great reading if you like that sort of thing.  However, I don’t believe there’s yet been any empirical confirmation that a writing system with the quirky formal characteristics of Voynichese could embody meaningful messages in a way that people of the fifteenth century could plausibly have written and read.

So, taking a page from Rugg’s strategy manual, I set myself the task of inventing a real cipher that would mimic Voynichese as closely as I could manage.  First, I reviewed the morphology of the glyphs and the rules of the “grammar,” brainstorming about how these might have functioned within some coherent scheme, just as so many others have done.  Then I took a few mutually compatible hypotheses, constructed an experimental cipher around them, and tried using it.  That led to an iterative process of trial and error, during which I repeatedly tweaked my system in an effort to make its output appear more Voynich-like, as well as to make it more practically usable.  Pretty soon, I was getting ciphertext that doesn’t perfectly mimic every aspect of Voynichese, but that does mimic some of the characteristics which people have been hardest-pressed to explain—in particular all those weird repetitions.  I’ll share what I’ve come up with so far below.

Let me be clear: I’m not claiming to have discovered how the Voynich Manuscript was composed.  In fact, the system I describe here may well have nothing whatsoever in common with the real mechanisms of Voynichese.  To underscore this point, I’ve decided to give it a distinctive name of its own: Griffoynich (Griffonage + Voynich).  But even as a fanciful modern creation, I think it has some heuristic value:

  • Gordon Rugg argues that because nonsense text resembling Voynichese can be generated with tables and Cardan grilles, the Voynich Manuscript is probably gibberish.  But meaningful text enciphered using Griffoynich resembles Voynichese too.  Score one for the “not a hoax” side of the debate?
  • Spending a few hours writing and reading Griffoynich might help steer neophytes away from assuming that Voynichese is just a straightforward phonetic script for Chinese (or Nahuatl, or Hebrew, or Klingon, or whatever) by fostering a practical engagement with its un-language-like patterns.
  • Even truly serious Voynich researchers whose qokeedies I’m unfit to opchol might find it interesting to explore how the actual text of the Voynich Manuscript is and isn’t compatible with the principles of Griffoynich.

I’d like to express my gratitude to Gabriel Landini for designing the Voynichese font I’ve used in my experiments (the mappings in the other well-known font designed by Glen Caston don’t fit my scheme very well), and also to the many intrepid Voynichologists whose work I’ve found inspiring, including but not limited to Nick Pelling, René Zandbergen, Jorge Stolfi, and Torsten Timm.  Of course, these upstanding folks bear no individual or collective guilt for any whimsical cryptological fantasies I’ve indulged under the influence of this Rorschach Test of a codex.

Note: Griffoynich is somewhat cumbersome to read and write, although I don’t think it would have been any more cumbersome in 1430 than it is in 2019.  I’ve tried to double-check the various reading examples given below a couple times to make sure each is enciphered correctly, but I suspect I’ve probably made at least one mistake somewhere.  Kindly let me know if you discover one, and I’ll try to fix it so that others won’t waste their time.


Round One

Griffoynich 1.0 makes use of a physical game board consisting of a 10×10 grid laid out with dark and light squares in a checkerboard pattern.  The light squares are blank, but the dark squares have letters written in them.  The board has a single moveable marker on it which can only occupy light squares (as in the game of checkers), and which starts out on a highlighted “home square” near the center of the board.  I’ll call this a jeton, borrowing a term traditionally used to refer to the counters used on medieval and early modern counting-boards.

To make it easier to explain the system and show how it works, I’ve designed a simpler 6×6 demonstration board containing only eighteen letters, which I’ll be using for my examples in this first round.  I’ll introduce a full 10×10 Griffoynich board in Round Two.

With the jeton positioned on its home square, we can encipher any one of the four letters written in the four dark squares immediately adjacent to it.  First we should tap the jeton once on its home square to mark the act of selecting it.  There are two ways of representing this tap in writing: as a c-curve or as a backslash.  Then we select the square with the letter we want to encipher and record its direction from the jeton by drawing a corresponding flourish on the tap-mark: curled around the right for “right,” upward from the top for “up,” in a kind of figure-eight loop for “left,” and downward for “down.”

On the other hand, if we want to encipher some other letter, we first need to move the jeton to a black square adjacent to a white square containing that letter, after which we record the direction of the letter from the jeton’s new position.  The jeton can move in two directions: straight right (skipping over intervening light squares) or diagonally down and to the right.  Conceptually, we need to treat the board as though its right side were joined to its left side and its top were joined to the bottom (or as though there were multiple identical boards arranged into a larger grid), such that if the jeton moves off the edge of the board, it reappears in the logical spot on the opposite side.

We move the jeton one square at a time, tapping it physically on the board once per square as an aid to counting, with any diagonal movement coming first and any horizontal movement coming second; and we always tap it once in its current position before moving it anywhere else.  We record each tap along the path using c-curves for diagonal steps and backslashes for horizontal steps.

Of course, a tap on the jeton’s current position doesn’t involve either vertical or horizontal movement, which is why we can use either shape to represent it.

The whole sequence of events extending from a starting tap through the next encipherment of a letter is known as a turn.

Whenever a c-curve is followed immediately by a backslash, these two marks can be combined into a form that resembles a lower-case a.  Pairs of c-curves can also be joined, typically at the top.  To avoid confusion, however, it’s best not to join tap-marks if one of them has a flourish.  It’s forbidden to join a pair of c-curves if one has an “up” flourish, for a reason I’ll explain momentarily; and it’s also forbidden to join tap-marks across a turn boundary, which means that the first tap-mark in a joined pair should never have a flourish either.Based on what I’ve described so far, the maximum number of taps it would take to move the jeton from any square on the full 10×10 board to any other square should be fourteen: a starting tap, nine diagonal steps, and four horizontal steps.  It could get tedious to write out as many as ten c-curves in a row, so let’s define an abbreviation: two c-curves joined at the top, with a plume above the join, will be equivalent to—and can be substituted for—four c-curves.  The maximum possible diagonal distance on a 10×10 board can thus be written compactly as two pairs of joined c-curves with plumes followed by two unjoined c-curves, the final c-curve carrying an encipherment flourish.  (This sequence turns up exactly once in the actual Voynich Manuscript, on folio 49r.)

Because a doubling-plume looks just like an “up” flourish, we should make sure never to connect two c-curves if either of them has that kind of flourish.

But wait, there’s more!  We also have the option of rotating the board so that squares that would otherwise take many steps to reach can be accessed in just a few.  To trigger a rotation, we use a so-called “gallows” glyph.  The bottom part of the glyph specifies the direction of rotation: two parallel lines for clockwise, two perpendicular lines for counterclockwise.  Meanwhile, the amount of rotation is shown by the number of loops at the top, in 90° increments: one (90°), two (180°), three (270°), and so on, although there’s never any practical need to use more than two, and no standardized way of drawing more loops than that.  With a 180° rotation, which simply turns the board upside down, the clockwise-counterclockwise distinction isn’t meaningful, so it doesn’t matter whether we draw parallel or perpendicular lines in that case, although we have to choose one or the other.

The two parallel “legs” of a clockwise rotation-glyph are ordinarily inserted together wherever in the sequence the rotation is supposed to occur, but if the glyph has two loops at the top—specifying two 90° increments—it’s also permissible to separate them, in which case the board still gets rotated 90° twice, but at different times, wherever in the sequence each of the two “legs” falls.  (Voynichologists call the results “split gallows.”)

A rotation can occur midway through a sequence of diagonal or horizontal steps, in which case the steps before the rotation will be in a different direction from the steps after the rotation.  Here the rule is to treat the first tap-mark after a rotation-glyph simultaneously as the final tap of the old orientation and the first tap (in starting position) of the new orientation.  This is equivalent to thinking of the rotation-glyph as specifying a rotation that will happen during the following step, but that isn’t yet in effect to govern the direction of that step; its message is something like “a rotation is pending.”  For clarity, it’s helpful to draw a guideline connecting the tap-mark in question to the tap-mark immediately preceding the rotation-glyph as a reminder of the double duty it’s doing.  (Voynichologists call these joined structures “pedestals.”)

To keep things manageable, the preference is to limit movement before a rotation to diagonal steps and to save horizontal steps until afterwards, so the first tap-mark after a rotation-glyph is almost always a c-curve.  However, since the form of the tap in current position is arbitrary, the choice of a c-curve or backstroke immediately after a rotation-glyph should technically be understood as determining the direction—diagonal or horizontal—of the last step before the rotation.

Rotating the board greatly increases the number of potential paths that exist between each pair of light squares on the board, as well as varying the relative positions of the squares themselves, exponentially boosting the opacity of the cipher.  Indeed, at this point we have so many different options for getting from any square to any other square, or even re-invoking the same square (by moving away from it and then right back to it again), that the likelihood of the same plaintext word being enciphered in the same way twice in a row is remote, even if we don’t factor in the complication that the path to the beginning of the word—that is, its first letter—depends on the prior position of the jeton.  By the same token, the exact same sequence of glyphs could encipher (say) fog, ick, pun or aid depending on the jeton’s location beforehand, so any recurring patterns in the ciphertext will tend to be red herrings—not coincidences, necessarily, but artifacts of the strategic arrangement of letters in the key.

But the cumulative nature of the cipher is also somewhat risky.  If the writer or reader makes a mistake at any point—say, by miscounting steps—this can impact not only a single letter, but also any subsequent letters enciphered relative to it.  Thus, it’s helpful periodically to reset the board, returning it to its default orientation and returning the jeton to its home square.  The reset-mark used to trigger this action resembles the numeral 4, as seen at the beginnings of the following typical “words”:

As a reader, if you run into any seemingly garbled text, you can just scan ahead to the next reset-mark and resume decipherment there.

A verbose cipher is one in which each plaintext letter is mapped to two or more ciphertext characters.  Griffoynich is arguably a verbose cipher in the sense that every letter requires a minimum of one tap-mark and one enciphering flourish, but it often enciphers a letter using something that Voynich researchers have conventionally treated as a single glyph (e.g., EVA o, y, s, r, and d, which we might call glyphoids).  Overall, Griffoynich ciphertext tends to contain significantly more glyphs or glyphoids than the corresponding plaintext, but if we think of it as specifying actions rather than enciphering letters per se, it’s not verbose on that level: every tap-mark, every flourish, every plume, and every detail of a “gallows” glyph has its own independent (and consistent) meaning.

Exercise 1.  Using the 6×6 demonstration board as your key, first decipher each of the expressions shown below starting from the home square, and then re-encipher the same word in a different way.  Pay no attention to the spacing: each square enciphers only a single plaintext word.  (Extra credit for advanced Voynichologists: which of these expressions would pass for good Voynichese, and which wouldn’t?)

Excercise 2.  Once again using the 6×6 demonstration board, apply the rules of Griffoynich to the following passage from the Voynich Manuscript.  Don’t expect the decipherment to be intelligible; it won’t be.  We’re just interested in confirming that the mysterious script makes sense as a set of mechanical instructions.

Round Two

Now that we’ve had some practice with basic operations, here’s a full-scale 10×10 board on the same pattern for us to try out:

This board obviously represents only one of many possible arrangements of letters.  I didn’t spend much time designing it, but I did make an effort to place letters that often appear next to each other adjacent to each other on the board, ideally sharing a corner so that they can both be accessed from two different jeton positions.  By leaving some of the squares blank, we could also encipher spaces, but I’ve opted not to do so.  Since spacing in the ciphertext doesn’t carry any special meaning, we could always make plaintext word breaks coincide with some of the ciphertext spaces if necessary.  Of course, we could also insert a few nulls—values to be ignored during decipherment—or letter combinations, or Arabic numerals, or whatever else strikes our fancy.

The square to the right of the home square, marked above with an asterisk, needs to serve some special purpose if we’re successfully to mimic certain tricky patterns of Voynichese using the system I’ve described so far.  I can think of a few strategies for managing this, but in Griffoynich 1.0, let’s tentatively define that square as enciphering an abbreviation marker used to show that whatever letters immediately follow constitute an abbreviation of some kind.  Granted, our usual modern convention is to mark an abbreviation by placing a period afterwards (e.g., “e.g.”), but during the fifteenth century it was common to place a mark over an abbreviation—often a horizontal line known as an “overbar.”  This was a well-nigh universal element of fifteenth-century plaintexts that would have seemed natural at the time to encipher, and a mark over a letter could be enciphered just as well before the letter as after it.

Besides, abbreviation should probably be a fairly common practice when writing in Griffoynich, philosophically speaking.  I don’t mean this in the cop-out sense that something like “ldsrtknbts” can be read as “ladies are taking baths,” lowering the bar ridiculoulsly low for decipherment claims.  Rather, I mean that Griffoynich should encipher plaintexts that are abbreviated about as intensively as typical fifteenth-century plaintexts were—which is, in turn, a lot more than twenty-first-century plaintexts tend to be.  Among other things, abbreviation can help compensate for the effective verbosity of the cipher.  But there are a few specific cases in which we’ll want to employ it regularly and methodically in Griffoynich 1.0, always aiming to replicate certain distinctive features of the Voynich Manuscript in ways that make logical sense.

By their nature, abbreviations tend not to reflect the usual plaintext distributions of letters.  Imagine, for instance, the plight of someone trying to solve a simple substitution cipher representing a plaintext full of strings such as Mrs., etc., and LMAO.  Since abbreviations might be marginally more likely to thwart “cracking” than unabbreviated text, let’s try to make them coincide with the weakest point in our cipher: namely, the reset points.  Since a reset moves the jeton back to its home square, which is right next to the square containing the abbreviation marker, this is easy to do; indeed, resets and abbreviations are well suited to go hand in hand.  To mix things up a bit further, it’s also a good idea for us to rotate the board immediately after enciphering the abbreviation marker.  When we combine a reset, an abbreviation marker, and a counterclockwise rotation, we get “words” that look like these (already shown in Round One):

Exercise 3.  Using the 10×10 board given above, decipher the following.  (Extra credit for advanced Voynichologists: how are the sequences of similar-looking words like or unlike the sequences that have attracted attention in the Voynich Manuscript, and how and why do they arise in my cipher?)

Exercise 4.  Using the same 10×10 board, apply the rules of Griffoynich to the following passage from the Voynich Manuscript.  As before, don’t expect the decipherment to be intelligible; we’re just interested in mechanics.  Does everything seem to work?  Is anything ambiguous or impossible?  Are there any instructions that seem redundant but could nevertheless help increase security and obfuscation?

Round Three

Reading Griffoynich ciphertext shouldn’t require much mental effort once you’ve internalized the rules, markings, and motions.  But writing Griffoynich ciphertext is another matter.  It’s always possible to get the jeton from any square on the board to any other square on the board simply by taking some straightforward combination of diagonal and horizontal steps.  But the design of the cipher assumes that the person doing the enciphering will also take advantage of rotation to get to out-of-the-way squares more efficiently, as well as to introduce variation for its own sake, perhaps by regularly choosing inefficient paths.  The encipherer therefore needs to exercise constant discretion and ingenuity, which could get pretty fatiguing after a few dozen pages.

I can think of a couple different strategies for making Griffoynich 1.0 less taxing to write.

The first is to draw upon previously written ciphertext as a source of inspiration.  Coming up with novel paths between squares takes some effort, but once these have been devised, most paths can be used again and again in new contexts, either “as is” or with slight modifications.  Thus, while we’re writing, we might make a point of referring regularly to an earlier page of ciphertext, or even to earlier passages on the same page we’re working on, looking for ideas to repurpose.  This strategy will have the side effect of increasing the repetition of similar-looking glyph sequences, and it might be able to account for the phenomena noted by Torsten Timm.

The other strategy is to cultivate a set of default paths for getting between particular positions, so that it isn’t necessary to think too much when confronted with common situations.

Here a brief digression is in order.  As I began playing around with Griffoynich 1.0, I made some interesting observations.  I often came up with “words” that actually appear in the Voynich Manuscript, as well as “words” that don’t but that look remarkably like words that do, and that probably fit most previous morphologies of the Voynich “word” (e.g., crust-mantle-core).  But the frequencies were skewed.  In particular, I found I was often generating “words” that simply instruct the jeton to move one single square before enciphering something.  Some “words” on this pattern exist in the Voynich Manuscript, but they’re highly uncommon.  So I turned to the idea of cultivating default paths as a possible explanation.  It rather quickly dragged me into the weeds, and in retrospect I’d say this is where Griffoynich 1.0 jumped the shark.

My working principle was that the default paths to related (but different) points shouldn’t use the same logic as each other.  Consider the following situation:

To encipher the letter in position 1, an obvious path would be one tap in place, three horizontal steps to the right (looping around to the other side of the board), and a “right” flourish.  So I proposed we adopt this as our regular method of handling that scenario.  To encipher the letter in position 2, a similarly obvious path—perhaps even more obvious—would be one tap in place, one horizontal step to the right, and a “right” flourish.  But if we’re putting a premium on variety, we could instead make a conscious habit of enciphering any letter in position 2 in some other way—say, by taking two diagonal steps, rotating 90° clockwise, taking another diagonal step, and drawing a “down” flourish.  The result would be to make the first two expressions below relatively common and the third expression below relatively rare (as it is in the Voynich Manuscript).

I generalized further to say that we should avoid any turn in which the jeton moves only one square, either horizontally or diagonally, with no rotation of the board.  Thus, for each turn, I proposed that we aim (1) to keep the jeton in its current position or (2) to move it at least two squares or (3) to rotate the board before moving it just one square.

When I tried putting this rule into practice, I found it ended up making things a lot more complicated—even downright annoying.  I’d want to move the jeton to encipher a nearby letter, but the most convenient path would be blocked, and I’d have to wrack my brain to come up with a different one.  Maybe, I thought, time and experience would help, as I hypothesized it might have helped the composer of the Voynich Manuscript.  I’ll return to this matter of avoiding single-square moves later.

Other “stylistic preferences” I proposed at this point have fared better in practice.  For example, I wrote earlier that it doesn’t matter practically whether we use a c-curve or a backslash to encipher a tap on the jeton’s current location, but the choice still needs to be governed by some stylistic constraints if we hope to mimic Voynichese at all convincingly.  Here are the rules I devised for Griffoynich 1.0:

  • If we’re just tapping once in place and not moving the jeton, we should always use a c-curve to encipher a letter to the left or right, and never a backslash (except maybe at the end of a line).
  • The first tap of any sequence of taps should usually be a c-curve as well, unless we’ve just used another c-curve to encipher a letter to the right (and often then too).
  • If in doubt, just use a c-curve to encipher any tap on the jeton’s current position, and you’ll never go wrong.
  • We should also avoid beginning any turn with an isolated c-stroke.  If we’re already avoiding turns in which the jeton moves just one square, we’ll go a long way towards observing this other rule.  But there are two additional scenarios to bear in mind.  The first involves moving a jeton one diagonal step followed by multiple horizontal steps, since the second c-stroke will then want to combine with the first backslash to form the glyphoid that looks like a lower-case a, stranding the first c-stroke at the beginning of the turn.  So we avoid doing this (although it’s a pain to do so).  The second scenario involves the practice of joining a pair of c-curves on either side of a rotation-glyph.  If we’d ordinarily be writing two c-curves before the rotation-glyph, linking the second c-curve forward across the rotation-glyph would mean stranding the first c-curve at the beginning of the turn.  Since the joining line serves only as an aid to reading, and doesn’t change the meaning at all, I figured it would be okay to omit it under these circumstances.

From the standpoint of Griffoynich 1.0, one glyphoid I concluded was never technically required was the backslash with a “left” flourish attached to it (EVA m or j).  We don’t need to use this when the jeton is staying put in its current location, since we can always use a c-curve instead.  Nor is there any situation in which we technically need to apply a “left” flourish to a backslash that belongs to a sequence of multiple steps.  Since the backslash represents a step rightward, we could always encipher the same value more efficiently by taking one less step and applying a “right” flourish instead.  By using the backslash with a “left” flourish, we end up overshooting the target letter and catching it from the other side.  On the other hand, it’s always possible to overshoot in this situation, and doing so provides a nice way of filling out the end of a line of ciphertext—so in Griffoynich 1.0 I proposed we make a point of using it in that position whenever an opportunity arises (thereby mimicking the notorious preference of m for the ends of lines). Moreover, two horizontal steps followed by a “left” flourish offered yet another alternative to one horizontal step followed by a “right” flourish—a path I was already looking for ways to avoid.

Whenever two plaintext letters appear frequently next to each other as a digraph, it seems strategically desirable for them to appear on the board in squares that share a corner, as I noted earlier.  And if we choose to design our board in that way, we’ll very often find ourselves wanting to encipher two diagonally adjacent letters.  This is another case where I thought it might be helpful to develop regular habits to reduce the long-term cognitive strain of writing (and to mimic specific features of the Voynich Manuscript into the bargain).

Depending on how the Griffoynich 1.0 board is rotated, any digraph will correspond to one of four different geometric vector types.  So I proposed we settle on preferred ways of handling three of them, reaching them along a diagonal as shown below, while usually choosing to rotate the fourth as needed to convert it into one of the other three types.  I also proposed we settle on preferred ways of writing the instructions in each case, routinely favoring a c-stroke or a backslash for the arbitrary second element in the pair.  This will give you some idea of how far down the rabbit hole I went with this line of thought.  But it would account for the commonness or rarity of particular glyphoid pairs in cases where these couldn’t be predicted from the basic structure of the cipher itself.

Not everything I experimented with got quite this abstruse, and sometimes I felt more like I was engaging in a fun new type of word puzzle.  For example: sometimes plaintext letters repeat, as in words such as “apple” or “beer,” and Griffoynich gives us several cool options for concealing the repetition.  The expressions shown below all encipher the same value twice in a row, whatever it might be.  Can you think of others?

And then there are some other kinds of patterns to consider besides, related less to the cipher itself than to the contexts in which it’s being used.  In many cases, we’ll want to encipher a nice, long string of continuous text, in which case the instructions for moving the jeton around the board will be cumulative throughout (with occasional resets).  To mix things up from the start, I’ve decided to make it standard procedure to begin every extended ciphertext (“paragraph”) with a rotation, usually—for no particular reason other than aesthetics—a counterclockwise one (as we see in the Voynich Manuscript).  But in other cases, we’ll want to encipher short, unconnected bits of text such as labels for illustrations or entries in a chart.  These ciphertexts (“labels”) need to be read independently, starting from the jeton’s home square and the default orientation of the board.  They also need to fit into relatively confined spaces.  Meanwhile, their content is usually addressed in nearby paragraphs where there are fewer constraints on length.  Thus, many labels can take the form of abbreviations.  For example, a page of text discussing a snapdragon and a figwort might be accompanied two illustrations labeled snp and fgw (or even just s and f) for purposes of disambiguation, while a chart might contain abbreviations such as Mo, Tu, We, Th, Fr, Sa, Su.  In all such cases, each label needs to begin with the abbreviation marker, which under these conditions will ordinarily look like a lower-case o.  (The majority of labels in the Voynich Manuscript begin that way.)

Exercise 5. Using the 10×10 grid shown in Lesson Two, encipher the words SNOW, CAST, and ANT, trying to observe all the horribly complicated stylistic guidelines noted above.


I’d got to this point in developing Griffoynich when it suddenly dawned on me that I didn’t actually need to design my own customized board for it.  Instead, I could repurpose one of the best-known historical cipher keys: the Polybius Square, which has the advantage of unquestionably having been a part of the late medieval cryptological landscape.  In its original Greek form, which dates back to classical antiquity, it looks like this:

The idea here was to fractionalize the letters of the alphabet so that they could be represented by a smaller number of characters (the numerals 1-5): in this way, alpha becomes “11,” beta becomes “12,” zeta becomes “21,” and so forth.  A Polybius Square based on the version of the Latin alphabet current in early fifteenth-century Europe comes out like this:

Alongside its traditional use, this same square can also be used as a key for the cipher I’ve just described with only a few minor adaptations (Griffoynich 1.1):

  • There are two squares left over without letters in the bottom right-hand corner.  We can use the first one as the jeton’s home square.  The second one, to the right of the first, is unassigned.  We could continue to use it as an abbreviation marker in the way I described previously.  However, a more elegant solution might be to treat it as enciphering a null—a value to be ignored in decipherment.  I opted not to do that before because introducing a null felt like a cop-out when I was designing my own key, but I’m going to give it a try in the Polybius variant of Griffoynich, since a null is arguably built into it from the start.  We’ll also want to cultivate a couple of associated habits: (1) encipher a null after most resets; and (2) begin most labels with a null.  The home square will likewise encipher a null if it’s invoked.
  • When we use a Polybius Square instead of a checkerboard, the jeton might as well move one space horizontally at a time, without jumping over anything.

The result is a perfectly viable cipher.  But when I tried to apply additional “stylistic” rules to it such as avoiding a single-square move, as needed to mimic Voynichese, I found the experience even more aggravating than before.  I kept finding myself barred from moving the jeton in the ways I most wanted to move it, and this just didn’t feel natural.

So I designed the board and protocols of Griffoynich 2.0 expressly to remove the motives for moving the jeton just one square horizontally or vertically.  We start with a 5×5 Polybius square, but this time the jeton doesn’t move among the lettered squares themselves.  Instead, it moves among the corners of the squares, marked below with circles:

The green circle is the jeton’s “home base,” since I can’t call it a square any more.  For this version, we’ll say the jeton can move straight right (c-curves) or straight down (backslashes).  Rotating the board is no longer navigationally advantageous in the sense of providing shortcuts, unless we rotate it 45°, and then I’m afraid it would be troublesome to keep track of the diagonal paths where they cross over the edge of the board.  But even 90° rotations still scramble the relative positions of the letters, so let’s just leave the rules of rotation exactly the same as they were before.

Meanwhile, the encipherment flourishes can no longer mean “up,” “right,” “down,” and “left,” but need to be reassigned to “upper left,” “upper right,” “upper left,” “lower left,” and “lower right,” tentatively like this:

Let’s consider what happens if the jeton moves just one step within this new framework.  If it moves one step to the right, the same letters previously available on the right will become available on the left.  And if the jeton moves one circle down, the same letters previously available on the bottom will become available on the top.  Either way, the move will have gained us only two new letters.  We need to move at least two spaces to access a full complement of four new letters—the two we’d reach in one space, plus two more—and there will never be any advantage to be had from moving just one space, unless we’re thinking ahead to future letters multiple turns away.  The rule never move the jeton just one space without rotating the board is now perfectly agreeable and, indeed, might arise naturally out of experience.

Exercise 6.  Based on the foregoing, decipher the well-known passage below into its eleven-word Latin plaintext.  I haven’t used any resets, so be careful!

Towards Griffoynich 2.1

I wouldn’t say I’m yet proficient in any of the draft cipher systems I’ve described here.  If I were, I might be more comfortable doing things like introducing rotations in the middle of turns, remembering to introduce periodic resets, and so on, which I think would make my results look and feel more Voynich-like, as well as more varied.  But even without such proficiency, I find that the ciphertext I’m generating displays gratifying similarities to Voynichese, such as its tendency to repeat similar-looking “word” forms—a feature which Voynichologists have traditionally considered particularly baffling and incompatible with known cipher systems.  I should emphasize that I’m not consciously trying to generate similar-looking forms.  It just happens.

Meanwhile, here are the next steps that would be on my to-do list for further refining the cipher itself, not necessarily in order:

  • Variously try enciphering Latin, French, Italian, etc., in their fifteenth-century forms, including the abbreviations that were conventional at the time.
  • Increase the size of the Griffoynich 2.0 board to 7×7 to accommodate EVA aiiin and aiiir, or at least 6×6 for aiin and aiir.
  • Fill in the resulting extra squares with letter sequences that were commonly abbreviated in the fifteenth century, such as CON, ER, PER, and PRO.
  • Make the letters of more common digraphs share corners to increase the likelihood of EVA dy, or, ol, ody, and so forth, which has been harder to achieve than I’d expected.  This should also tend to produce more appropriate variety in the first glyphoids of lines of text, which will have a better chance of being a continuation of a digraph (or trigraph, etc.).  In general, structure a key so that more letters can be enciphered in a row without moving the jeton—or include nulls in the grid as a last resort.
  • Come up with some better rules for choosing a c-curve or backslash for enciphering a letter without moving the jeton.  Maybe the choice could be constrained by the direction of the previously enciphered letter, or the direction of the path by which the jeton reached its current location, or something like that.
  • Use the “doubling plume” as an abbreviation for three c-curves rather than four, to make it a better fit for a 7×7 board.  Or maybe find some other interpretation for it in which it functions as an ordinary encipherment flourish (with which it’s formally identical, apart from position).
  • Instead of rotating the board, try having the gallows glyphs control a separate spinner with two hands on it, like a clock face with an hour hand and a minute hand.  One hand will specify the direction of c-curves, and the other will specify the direction of backslashes.  The gallows glyph would then mean: “during the next turn, move the jeton, but then also move the hands of the spinner.”  This way the relative positions of the letters would remain the same, which could impact digraph statistics, depending on the board layout: it would be feasible to make EVA dy more common than yd this way, for instance, and to make dr and rd uncommon, consistently associated with improbable combinations such as T+D, P+B, K+G, Z+S, and Q plus anything but V.  Maybe allow for 45° angles?  Also consider whether the gallows might simultaneously count as rotation-glyphs and “taps” in their own right; might not be cumulative, and could instead apply only to the vector immediately following; and might point consistently upward (t, k) and downward (p, f, practically useful only for longer moves), to reflect the disparity between te/ke (common) and pe/fe (ultra-rare).
  • Experiment with different ways of handling repeated encipherments made without moving the jeton.  To replicate sequences such as ororor and dydydydy, try using a jeton with the four encipherment flourishes marked on it, 90° apart; when it’s moved to a new square, turn it so that the designated flourish is 180° from the designated letter.  Then, for additional encipherments made without moving the jeton, specify their direction based on the flourish that is now beside them.  If the markings o/r and d/y are opposite each other, this would result in alternating symbols for the same value, which seems more plausible than an alternating plaintext.
  • Brainstorm about measures that would more reliably generate “words” that begin with EVA o plus gallows (which could lead in turn to a new treatment of qo), the group which EVA would render dain/daiin/daiiin (maybe part of the board layout problem), the end-of-line preference of m and g (as distinct from d and j), and so on.
  • Rethink the relationship between o and a to accommodate scribal ambiguity between them (reflected in frequent disagreements among transcribers); maybe choin ~ chain and ain ~ oin, but that introduces some complications and paradoxes for which I have yet to find a satisfactory solution.  Does ai entail just one step, and does the o in oi not encipher anything?  Or does the o encipher a value and then “continue” the turn (perhaps with Sh doing something similar), while a does the same thing without enciphering any value “along the way”?  Does o/a do for backslashes what an initial c-curve does for c-curves: setting up a potential movement in a particular direction but not yet taking any steps in it?  In or, ol, on, om, should the r, l, n, or m be read independently or in conjunction with the o?


The broad structure of Voynichese appears to be consistent with a legitimate complex cipher, judging from how much I’ve been able to mimic it with a real cipher of my own—not in all its particulars, certainly, but well enough to generate ciphertext that’s starting to share some of its most famously perplexing properties, as well as to permit virtually all real Voynichese to be parsed in terms of the same alphabetic key.  Voynichese could seemingly contain a meaningful plaintext if we interpret it as follows:

  • The marks I’m calling c-curves and backslashes represent Euclidean vectors in a two-dimensional coordinate system.
  • The marks I’m calling flourishes represent actions of different kinds taken at the endpoints of the vectors, and the purpose of the vectors is to specify where the actions are to be taken.  The actions correspond to selecting values for enciphering or deciphering.
  • The marks commonly known as “gallows” represent changes to the coordinate system (or how it’s navigated) that can be made before or during the execution of a vector with differing results.

It’s possible to imagine many different ways of implementing a cipher based on this abstract structure.  I’ve described and demonstrated a few above, but I’m sure none of them was actually used to compose the Voynich Manuscript—that would be too huge a coincidence, given the number of variables in play.  At the same time, I can’t help but wonder whether a similar system might not have been used to compose it, recognizing that there are many potential types and degrees of similarity.

Like Rugg’s grille-and-table method, the system I’ve laid out lacks any historical corroboration (as far as I know), but I assume that if any cipher or code described openly in early modern literature were a good match for Voynichese, it would long since have been identified as such.  As it stands, none of the individual elements of my system strikes me as blatantly anachronistic for the 1400s.  The Polybius Square dates back to classical antiquity.  The checkerboard was readily available as a model by the fifteenth century.  The principle of working out intellectual problems by moving jetons physically around a counting-board was a mainstay of medieval accounting practice.  Simple substitution ciphers were then just starting to give way in Europe to more sophisticated systems, implying an effort to thwart cryptanalysis, and hence also implying that people had begun engaging in cryptanalysis, thereby creating a fresh demand for heightened security.  David Kahn dates the first homophonic substitution cipher (offering a choice among multiple ciphertext characters for enciphering each plaintext vowel) to 1401, and the first nomenclators (simple substitution ciphers mixed with code-word lists and nulls) to 1379 (The Codebreakers, 1967 edition, pp. 106-7).  The system I’ve outlined is far more elaborate than either of those.  But at a time when there was a newly practical need for hard-to-crack ciphers, and no guidelines yet available for creating them—I don’t believe homophonic substitution or nomenclators had yet been widely disclosed as strategies—we might expect all kinds of quirky homegrown systems to have arisen, bearing no resemblance whatsoever to the more enduring cryptographic practices that were to take root over the next century or so.

Of course, the mechanism I’ve been experimenting with here is just one possibility out of many.  I could imagine a numerical cipher in which the script gives instructions for arranging multiple jetons on a counting-board and the value hinges on the result of the calculation (e.g., 5-3=2 → B).  Or one based on one-dimensional movement backwards or forwards in an alphabet (e.g., with the alphabet ABCDEFGHIKLMNOPQRSTVXYZ, B could be +1 or -22).  Or a system in which two game pieces are independently moved along the edges of a board, one horizontally, one vertically, and the value hinges on where the occupied row and column intersect.  Or in which one axis specifies consonants and the other axis specifies vowels (with conventions for enciphering C, V, CV, CCV, CCCV, VV, CC, etc.).  Or a game board, navigated similarly to what I’ve described, but in which each individual square contains multiple letters or letter combinations and the encipherment flourish indicates which of them to pick (this approach isn’t as conceptually elegant as the other, but it could eliminate a lot of dilemmas in board design while simultaneously accommodating positional preferences for certain glyphoids).  At the end of the day, there’s no harm in speculating about—and modeling—such mechanisms, however unlikely any one of them is to have played a part in the creation of the Voynich Manuscript.  Indeed, I’d suggest that tying the patterns of Voynichese to concrete mechanical actions of any kind stands a chance of illuminating them in ways that purely abstract morphological study hasn’t.

A few closing questions:

  • If the Voynich Manuscript had contained a meaningful text in one of the specific ciphers described and demonstrated above (which it doesn’t), would any of the previous cryptanalytical attacks on it have succeeded?
  • If we were to suspect something was written in a Griffoynich-like cipher, without knowing either the rules or the key, how would we go about trying to “crack” it, either manually or via computer?
  • Is it possible to design a simpler cipher than Griffoynich that mimics Voynichese equally well or better?
  • As an aside, is it possible to design a competitive board game in which Voynichese would consistently specify valid moves?  (Imagine, for a start, a notation for chess in which each piece is uniquely identified and movements are recorded relative to each move’s starting position rather than by the coordinates of the square to which it moves.)

Finally, let’s take a parting glance at the Voynich Manuscript itself, turning to folio 57v:

This image caught my attention when I took another look through the manuscript partway through my experiments with Griffoynich.  It has sometimes been identified with the Wheel of Fortune (e.g., here and here).  But—just letting my imagination run rampant for a moment—could the central “rosette” represent a square with a jeton on it, and could the figure on the right be holding another jeton, reaching out to place it on the board?  Might the four figures facing in different directions with outstretched arms, together with the nearby lines of text, characterize positional letter encipherments, the jeton’s permitted movements, and/or the practice of rotating the board?  Is this, in other words, a picture showing how to read a cipher?

Solutions to Decipherment Exercises (provided I didn’t make any embarrassing mistakes on my end!)

Exercise 1

Exercise 3
3. MR. R. MRS. Z. AND DR. P.

Exercise 6

4 thoughts on “Griffoynich: A Real Cipher That Mimics Voynichese

  1. Pingback: All Griffonage That On Earth Doth Dwell | Griffonage-Dot-Com

  2. Hi Patrick, I’m afraid I couldn’t follow precisely. I have no cryptography experience and I’m bad at math! But I have done a semiotics analysis of the Voynich (article pending) and I am very interested in the Polybius square because I’ve been getting hints of fives as a pattern throughout. So I matched Voynichese characters to rosette spheres symbolically, which took forever. Months.

    Then I followed sequences of letters on 57v, connecting one to another on the rosette page, and I am getting pentagrams! Backwards, forwards and upside down, I’ve been getting results that closely follow what seem to be rules of relationship along gridlines similar to Voychinese patterns of character relationships.

    This means more than one character glyph or set of glyphs occupies each of the five pentagram positions if I pile them on top of each other. For instance, the rounded x figure is also possibly co. Thus if we read co8 or co9, we’d really be reading x8 or x9. But the relationship rules in each pentagram mean we have to follow the gridlines of that one for endings, middles and ends.

    I hope this makes sense. In a nutshell, we might actually be only looking for five numbers for the polybius square, but each number 1,2,3,4,5 can be represented by sets of 1-5 voychinese (3, for instance, might be x, co, a, longline c, iii, a gallows )characters, themselves circumscribed by rules of relationship in individual pentagrams. Each glyph or set then matches with another 1-5 to give us the polybius letters?

    Before I work on this, you seem to be an expert – would this make sense to you? I’d really appreciate some advice!

    • I certainly wouldn’t claim to be an “expert” in this — just one of many interested parties. But if you’ve got some numerical solution to the Voynich Manuscript in mind, particularly one involving the Polybius square, I’d encourage you to pursue it — and I’ll look forward to seeing that article you mention once it’s available so that I can understand more about your take on rosette spheres, etc.

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.