The ambassador’s cipher

“Ie ne veulx plus demeurer icy gueres longuement.” That is the reading proposed here for a line of cipher in a letter that Michel de Seure, Henri II’s ambassador in Portugal, sent from Lisbon on 12 December 1558. In it he tells de Fresne, one of the king’s secretaries, that he does not wish to stay there much longer.De Fresne was highly likely Florimond Robertet, seigneur de Fresne, the secretary of state whose department covered Spain and Portugal. Potter (2014) cites Seure’s letters to “Secretary Robertet de Fresnes” from February to April 1559. Accounts date Robertet’s appointment variously to 1557, September 1558 and October 1559. He sent four other letters home that month, each with passages in cipher. All five are now bound in one volume in the Bibliothèque nationale de France, fr. 3151, where this one is number 39. Three of the others are copies of one letter to the king.

The answers are bound beside the questions. Two decipher sheets made at the time give the plain text of all four, one for the letter sent three times and one for the fourth letter. A clerk marked one letter and its decipher sheet with the same capital A, in the margin beside the first line of the cipher and of its plain text (Figure 1). Letter 39 is the only one of the five with no decipherment.The reason letter 39 alone has no decipherment is unknown. Desenclos (2018), writing about French cipher letters of the period, says the state office wrote decipherments on incoming letters, while the sheets on which recipients deciphered letters themselves “could easily be lost”. De Fresne may have deciphered letter 39 himself and lost his sheet. The other four letters also have their decipherments on separate sheets, however, so this does not explain why letter 39’s alone is missing.

the cipher, fo. 84r

the decipher sheet, fo. 85r

Side by side, the other four letters and their decipherments show which sign stands for which letter. Cryptographers call this known plaintext, and there is enough of it here to rebuild the key. The rebuilt key reads a hundred words of letter 39. Besides wanting to leave, Seure says in them, less surely, that he is in need.

Keys built from the decipher sheets also fit two more cipher passages, in a despatch Seure sent the king in February 1559. Their plain text has been in print since 1895, when Edmond Falgairolle printed it as the rest of the letter. He does not say that it is a decipherment, and as far as searches in October 2026 could find, no one has said so since. In one of the passages Seure urges the king to send a fleet to sack Puerto Rico and San Domingo.

Two years in Lisbon

Seure came from the lesser nobility of Brie. He was a Knight of Malta and had served at sea before he became ambassador in Lisbon in June 1557.Potter (2014), introduction. He was later ambassador in London, and Potter’s edition is of his correspondence from there of 1560–1561. Letter 39 is in ordinary French except for a block of twenty lines in cipher, 405 signs in all. Read with the key, the block ends like this, with two doubtful readings in brackets.

… I shall be glad to learn the decision on it, for we are beginning to approach the time when […] two years. Here we have taken the peace as [concluded?]; I do not know what will come of it, which made me doubt all the more. I do not wish to stay here much longer, and at worst I want only to complete my two years here. I am in need, and have had a great many [debts?] …

When Seure wrote, the peace was not yet made. Envoys of Henri II and Philip II of Spain had begun talks at Cercamp in October to end the Italian War of 1551–1559, but they adjourned at the end of November and met again only in February, at Cateau-Cambrésis. They signed the treaty there in April 1559, nearly four months after the letter. Seure’s two years would be up around June 1559.

Seven weeks after letter 39, Seure said much the same to the king in ordinary French, and gave his reasons. In a letter of 30 January 1559, which Falgairolle printed in 1895, he asked for a successor “parce que n’y puis gueres demeurer, à cause que ces seigneurs et gens de deça sont si contraires que à merveilles” (because I can stay here hardly any longer, the lords and people of these parts being so very hostile). The historian David Potter, who quotes the passage, counts Seure among the few ambassadors of the century whose recall was forced by their hosts, and adds that he seems to have found Lisbon too expensive. That letter played no part in reading letter 39.

Lines 11 to 19 of the block are read without a gap, but none of the reading is certain. Every word in Figure 2 is graded high, medium or low by the strength of its evidence, and the grades suggest that about two words in three are right, likely fewer, for reasons given below.Each grade is a judgement that combines the word’s class with the evidence for its signs and the rival readings. The decoder sorts words into classes by the evidence for their signs in the known plaintext and by whether their readings change with the weight given to French spelling, and the test of Figure 7 measures how often each class is right. High, medium and low are meant as roughly an 85%, a 60% and a 30% chance of being right, but the grades themselves were not tested. Of the 100 words, 45 are graded high, 39 medium and 16 low, so the grades predict that about 66 are right, 45 × 0.85 + 39 × 0.6 + 16 × 0.3. The decoder’s classes alone, applied to its own reading of the block, would make about 65 of its 107 words right, 61%, and that is an upper bound.

Eight signs for e

In a cipher with one sign for each letter, counting the signs is enough. In French the commonest letter is e, so the commonest sign probably stands for e. Counting like this is called frequency analysis, and Seure’s cipher is built against it. It gives each common letter several signs, called homophones, and the encipherer may use any of them. In the deciphered letters e is 17.5% of the text, but its commonest sign, labelled ff in the transcription, is only 4.3% of the signs.The transcription labels each sign by its shape: ff looks like a double f, # like a sharp sign, 3s like a 3 with a stroke through it. A label says nothing about the sign’s value. In the spelling of the time u and v are one letter, and so are i and j.

Seure’s own line shows how. In ie ne veulx plus demeurer (I no longer wish to stay), e is written with three different signs, and u, l and r with two each.

The key has more than an alphabet. It has signs for syllables, such as R for de, a few for whole words, among them navires (ships), and 27 nulls, which stand for nothing. In the full key (Figure 3), each sign’s width shows how often it stands for its key value.Each key value has a confidence grade based on its count. It is high if the sign occurs at least 8 times and takes the value in at least 75% of them, medium at 4 and 60%, and low otherwise. That gives 46 high, 30 medium and 83 low. Of the low ones, 51 occur fewer than 8 times.

Because the encipherer chooses among the homophones, the same words come out differently each time. The letter to the king of 12 December was enciphered three times, as letters 44, 41 and 43. In one passage Seure calls what Philip II drew from the Americas “tout le nerf et tout le moyen qu’il a desormais de maintenir la guerre contre vous” (all the sinew and all the means he now has of keeping up the war against you). Figure 4 sets the first six words of that phrase from all three copies.

Rebuilding the key

Between them, the four letters with decipherments have 8,361 transcribed signs. If every sign stood for one letter, the key could be read off by pairing each sign with its letter. But the cipher has no word divisions, some signs stand for two or three letters, and others for nothing. The decipher sheets also abbreviate, reword and contain slips, so the pairing and the key have to be found together.

Figure 5 pairs letter 40, which Seure wrote to the king on 27 December, with its decipher sheet. The sheet opens on a sum of 200,000 écus that had belonged to a churchman and had been confiscated. A dagger marks a sign paired with something other than its key value.The cause may be a slip of the pen, a misreading, a rewording on the decipher sheet, a label with more than one value, or an incorrect pairing.

the decipher sheet, fo. 74r: its first lines

‹ › lines 1–4 of 44

1. fo. 73r, line 1 B sTo i†J esO ts c†Cs eP ql ue†## ibar ·d uA ·†# s1 ·†+ q†Ve u†s e†z sCa ·ff a†7 ·g p6 ·†h r100 ·ff es ·† si est ce que jusques a pre-
2. fo. 73r, line 2 W sii ·9 exx nM ·+ t†x i†1 lz†f nt e†7 ·= nd on†ooo t6 p†ff e^ u#b a– t†Aq t+f ro aCz p†xx p†9 eHr rVe que†R de6 ·† -sent ilz nen ont peu attrapper que de-
3. fo. 73r, line 3 3 um x†s cef n# s+ m†+f i†Ob l#1 e†z s+ cd un zN quiff e#1 s†ae toi†ff e= nVe to a^ umm nz g†d h†B o†7 · -ux cens mil escuz qui estoient a ung ho-
4. fo. 73r, line 4 ## mm†1 eR deCx gcc l†# i†W s3s eE le# sP qk uel†n zz sPb of nooo tx c†Phi onf†sl iW sPt quen zuT l†Nf a6 r†#1 o -mme deglise lesquelz sont confisquez la ro-

On these lines 71 of 109 signs take their key value; over the whole block, 749 of 1,082.

ff, two tall uprights with a crossbar and a hooked top (like an "ff"/"ft" ligature), takes nothing here. The key gives it e, in 297 of its 359 places in the known plaintext; elsewhere nothing 12, a 9, the word mais 5, l 3, others 33.

under each sign, what the alignment gives it; · nothing † not the sign’s key value – a letter left without a sign

Start from a rough key, since an empty key gives no basis for pairing signs with letters. Line up each block of cipher with its plain text, keeping both in order. This alignment pairs signs with letters to match as many key values as possible, with a cost for every sign read differently and every letter left without a sign.A sign read at its key value costs nothing. A sign read as another letter or a letter with no sign costs 2, and passing over a null costs 0.2. The full schedule is in the project’s METHOD.md. A difference in cost of about 2 means one sign more or less at its key value. The costs were set by hand, with the plain text in view. Give each sign the value it was paired with most often, then repeat the alignment under the new key until no value changes.Letters and their decipherments are a standard source for rebuilding a key. Tomokiyo’s Cryptiana gives the keys of a dozen of Henri II’s ciphers, some rebuilt this way. These rounds use a hard form of expectation-maximisation, repeatedly choosing an alignment and updating the key. Knight, Nair, Rathod and Yamada (2006) apply expectation-maximisation to decipherment. Bruton and Megyesi (2025) align historical homophonic ciphers with their plain text by program to extract keys. The decoder in Figure 7 uses beam search to keep the best candidate readings at each step and a character n-gram model to score sequences of letters, as Nuhn, Schamper and Ney (2013) do. It searches plain texts with the key fixed, while they search keys.

The first test was whether a key made from one letter could read another. A program that needs no starting key made a rough key from letter 40 alone, and that key already fitted letter 44 nearly as well as its own letter. In the first round, 60% of the signs in letter 44’s first block of cipher took their key value, against 66% of letter 40’s. Against shuffled controls, the same key fits letter 39 as well as it fits letter 44, so letter 39 is in the same cipher.Decoded with this key, the first 350 signs of letter 44 score 8.6 and 11.3 standard deviations better than two controls: the same signs in shuffled order and the key’s values shuffled among its signs, six runs of each. The differences are measured against the variation among control scores. Letter 39, which has no decipher sheet, scores 14.8 and 11.9, so the key fits it as it fits letter 44. From this rough key, the procedure settles in three rounds (Figure 6) on a key slightly different from the published key used in the figures here.The procedure changes nothing when started from the published key. The key settled on from the rough key differs from the published key in 10 of 159 signs. Those ten occur 214 times, 2.6% of the 8,361 signs, and nine of them are of low confidence. The settled key costs a little less, 5,512.2 against 5,522.5. Neither key is a proven best, and the published key is kept because the figures here were computed with it. The key’s values are counted from 7,304 signs. The other 1,057 signs form the postscript kept back for the test below. They are aligned in every round, including Figure 6’s, but never count towards a value. The appendix sets out the counts.

When the procedure stops, 70% of the 8,361 signs take their key value.Some labels still take more than one value. The sign labelled #, for one, is an s in 136 of its 338 occurrences and an i in 81. Many occurrences of + paired with r or l are probably the similar-looking signs +f and +d. Five labels were each split in two when their occurrences, sorted by the value they were paired with, showed a visible difference. Of the labels that occur at least 30 times, 21 take their key value in fewer than 60% of their occurrences. Those 21 account for 2,091 signs, a quarter of the known plaintext. No clear visual distinction could be found for several of the commonest, including #, + and 6.

How good is the reading?

A program called the decoder proposed most of the words read in letter 39. It scores readings by their fit to both the key and a statistical model of French spelling.None of pis aller, pour faicte, plein de, gueres demeurer, faisoit encores and plus de doute occurs in the text the model was trained on, so the decoder is not reciting it. A reading must also make sense and fit the manuscript, so it can depart from the key where the sense demands it.Of the 100 words, 83 can be matched sign for sign with the cipher, and 22 of those take at least one sign for something other than its key value. The other 17 cannot be matched so, because they pass over a sign that has a value, leave a letter without a sign, or are partly doubtful. In veulx the sign that is an m in demeurer is read as an x, which it is in only 7 of its 64 occurrences in the known plaintext.

To see how well a key like this reads a text it has never seen, the project used a postscript. The letter to the king of 12 December ends with a postscript of 441 letters, enciphered in all three copies in 1,057 signs, and the decipher sheet gives its plain text. The key was built without the postscript, and the decoder read each copy without the decipher sheet, at three settings of the weight it gives French spelling against the key.The beam search keeps the best 300 candidate texts at each step. It scores each by the signs’ fit under the key plus a weight times the log-probability of the text under a character 7-gram model. The weights were 0.3, 0.4 and 0.5, and Figure 7 shows 0.4. The model was trained on Falgairolle’s edition of the despatches of Jean Nicot, Seure’s successor (1897), about 600,000 characters of scanned text, and on the plain text of letters 40 and 44. The raw scan includes the editor’s introduction and notes in modern French. The settings were compared on two of the three copies, so on those two the test is not blind, though accuracy was flat around the settings used. A word counts as right if it occurs in the true text within 25 letters of where the decoder put it. This is lenient for short words: a word of two letters at a random place would pass about half the time, and across the postscript’s words the average chance of passing at random is about one in five.

Figure 7 compares the decoder’s reading of each copy with the decipher sheet and strikes through wrong words. The table under it sorts the decoder’s words into classes and gives how often each class was right. A word’s class depends on whether it comes out the same at every setting and on what share of its letters come from well-attested signs. A sign is well attested if it occurs at least six times in the known plaintext, at least 60% of them with one value.

The decoder got 58.9% of the letters right, too few for a reliable reading, but its classes go some way to telling right words from wrong without the decipher sheet. Words in the best class, whose letters all come from well-attested signs at their usual values and which stay the same at every setting, were right 51 times in 59. Words that changed with the setting and came from weakly attested signs were right only 19 times in 76.

Letter 39’s grades rest partly on these rates and predict about 66 right words. The true number is likely lower, because the test was generous to the decoder and the postscript is closer to the text the key was built from than letter 39 is.The decoder’s classes were tested on one postscript of 441 letters, scored leniently for short words. The class thresholds were set by hand with the known plaintext in view, and the decoder’s settings were compared on two of its three copies. The postscript ends the letter of 12 December, whose body helped build the key, so it shares an addressee and subjects with that text, while letter 39 went to someone else.

Nine lines of cipher follow

A search for an earlier reading of letter 39, or for more of Seure’s cipher, led to his other letters in NAF 6638. This nineteenth-century handwritten volume copies the despatches sent from Portugal by Seure and his successor, Jean Nicot, from 1559 to 1561. The originals are in Peter Dubrovsky’s collection in the National Library of Russia, and the copyist drew the cipher sign by sign. In a despatch to the king of February 1559 the cipher comes in two blocks, a short one on p. 29 and a long one on pp. 35–43. Between them are six pages of ordinary French, and they begin on the line where the short block ends (Figure 8).

In 1895 Falgairolle printed the despatch as two letters, in a life of Seure. After the first letter’s ordinary French he gave the note “Suivent neuf lignes chiffrées” (nine lines of cipher follow), then printed the six pages of ordinary French as the rest of that letter. He left the long block in the second letter undeciphered.NAF 6638 shows the short block in 16 lines, whose breaks need not match the original’s. Falgairolle printed from the St Petersburg volume (Potter 2014, note 33), but it is unknown whether he used originals or a transcript, and so unknown where his nine lines were counted. In Gallica’s machine-read text the note stands as a footnote at the foot of a page; where its call mark falls in the text has not been checked against the page image. He does not say that the text after his note is the decipherment,His wording was read in Gallica’s machine-read text of the volume, views 129–133, without a check of the printed pages. and nor does Chichkine (2021), who identified the two letters as one despatch of 12 February 1559.

The copyist’s notes in the margin show that the six pages begin a new leaf of the original, fo. 10, and fill fos 10–11, between the two blocks. To test whether they are the blocks’ plain text, the project lined up each block with the six pages as Figure 5 does letter 40 with its sheet, but kept the key fixed, so that it could not be fitted to NAF 6638. Under the key from fr. 3151, 72.5% of the long block’s signs take their key value, about as many as the 70% of fr. 3151’s own known plaintext. With the same words in random order, the long block costs about twice as much in each of twenty tries, so the true text fits far better.A lower cost means a better fit, with a penalty for every sign off its key value. The long block costs 2,856.6 against its text, with 3,088 of its 4,261 signs on their key value. Against the same words shuffled, it costs 5,887.4 ± 10.8 over 20 runs, the lowest 5,858.8. The short block, first tested with letter 40’s key alone, costs 252.5, with 162 of its 264 signs on their key value, against 358.6 ± 4.6 shuffled and 369.2 to 383.7 for the 14 equal-length stretches of ordinary French before it. The words after it therefore fit better than any of those stretches. In a working run that the release does not reproduce, the long block’s alignment was left free to start anywhere in the six pages, and it started by itself at n’apporte, the first word after the short block’s text. The copyist put part of the long block’s plain text in a footnote on p. 31 about the sack of San Domingo and Nombre de Dios. Leaving the footnote out raises the long block’s cost by 74.8, to 2,931.4. The 72.5% does not measure transcription accuracy, because the copyist made sign shapes more uniform and labels were assigned to his shapes by convention. The six pages are the plain text of both blocks, so a decipher sheet was likely bound at fos 10–11, as the sheets of fr. 3151 are bound among their letters. The first 71 words belong to the short block and end mid-sentence, while the other 1,143 continue with the long block’s text.

The long block is mostly a plan of war. During the peace talks at Cateau-Cambrésis, Seure advised the king to send “dix ou douze bons navires de guerre” (ten or twelve good warships) in May to sack and burn Puerto Rico and San Domingo, then go on to Nombre de Dios, where all the year’s silver from Peru would be waiting. Seure thought this would put “toutes les Indes en tel effroy” (the whole of the Indies in such fear) that for two or three years, and perhaps as long as the war lasted, not a sou would come from them.Potter (2014), citing the letter to the king of 30 January, says that Seure was quick to form “a strategy for France to undermine Spanish and Portuguese power in South America”. The cipher of 12 February sets out such a plan.

Where Gallica’s machine-read text of Falgairolle’s edition and NAF 6638 differ, the cipher can decide between them at two places, and both times it sides with NAF 6638 (Figure 9). In the machine-read text a whole clause is missing, between one Barselonne and the next, and so is the word assez from “assez desnuez d’hommes” (fairly bare of men). Whether the printed page lacks them too, or only the machine reading does, has not been checked against the page images.

More text did not make the decoder measurably better. The long block adds 4,261 signs of known plaintext, about half as many as fr. 3151 provides, but the copyist made sign shapes more uniform, so it was used only for nine signs that are unmistakable even in his hand. It confirmed five values and revised four, including the two on which letter 39’s pour faicte (the peace taken as concluded) rests. The revised values are kept beside the published key and used in reading letter 39. The decoder’s score on the postscript hardly moves with the revisions, because those signs are rare in it. Its accuracy is limited by the noise in reading the signs and by the ambiguity built into the cipher, as well as by the key.

What would settle it

Of letter 39’s 405 signs, 36 are unread.Letter 39’s block was transcribed twice, independently. Before the two were reconciled, the transcriptions gave the same label to 341 of its 405 signs, 84%. Every disagreement was rechecked against the image, and 17 signs were changed, two to a reading neither transcription gave. Au pis aller (at worst) rests on one of those two. The other letters were transcribed once, so their misreadings remain in the key’s counts. Of the 159 values in the key, 83 have low confidence, most because the sign is rare. In letter 39, one sign, Rr, occurs nowhere in the known plaintext and has no value. No second encipherment of letter 39, and no decipherment of it, is known to check the reading against. Searches on 4 and 12 October 2026 found no earlier reading of it, though an article of 1969 by Joaquim Veríssimo Serrão on two of Seure’s letters, which Potter says printed his despatches of late 1558, was not seen.

An independent reading of letter 39’s block from the manuscript would settle how much of it is right, and someone who has not seen the postscript’s decipher sheet could try the grading on it blind. More known plaintext in this cipher, in the original hands, or a decipherment of letter 39 would also settle it. Desenclos counts 179 cipher tables among the papers of the Bibliothèque nationale de France, and Seure’s key may be among them.Other places not looked at: the originals of NAF 6638 in St Petersburg; BnF fr. 15871, Seure’s letters of 1559 from Lisbon in ordinary French, which Potter says Matos printed; the papers of his embassy in London, where he was ambassador from 1560; and the archives of Simancas and Lisbon.

The Dubrovsky collection in St Petersburg also holds a letter Seure wrote to the king on 18 April 1559, with some of it in cipher. Chichkine prints a photograph and reads only the ordinary French, saying that Seure’s key has not been found. If the cipher is Seure’s, the letter gives more text to try the key on. In it Seure asked for a safe conduct through Spain.Barthélemy printed part of this letter in 1877 under the year 1555 (Chichkine 2021, note 42). Potter (2014, note 33) also dates it to 1559. In the end he left Lisbon by sea, on a Breton ship, in May 1559, without waiting for his successor.

@misc{seure-cipher,
  author = {Devin O'Keefe},
  title  = {The ambassador’s cipher},
  year   = {2026},
  url    = {https://devinokeefe.com/seure-cipher/}
}