Deciphering three diplomatic letters sent by Maximilian II in 1575

Abstract This article presents three newly rediscovered encrypted Habsburg letters that were sent by Maximilian II to his Polish delegates in 1575. We describe the process of deciphering and the principles and peculiarities of the cipher from a cryptographic perspective. Furthermore, content and historical and linguistic context of the letters are explained. The records are held at the Österreichisches Haus-, Hof- und Staatsarchiv and were collected and deciphered in the context of the interdisciplinary and international research project “DECRYPT – Decryption of historical manuscripts”. For cryptanalysis the open-source e-learning program CrypTool 2 was used. The article is the result of a joint effort of a computer scientist and a historical linguist.


Introduction
Deciphering encrypted historical political corresponces can reveal new insights on historical events. When our colleague Benedek L ang (2020) visited the € Osterreichisches Haus-, Hof-und Staatsarchiv (HHStA) (State Archive of Vienna), he was searching for original historical encryption keys used by the Austrian Empire. Together with hundreds of such keys he also discovered a few original encrypted manuscripts. Later, Anna Lehofer took high resolution photos and uploaded the documents to DECODE (Megyesi, Blomqvist, and Pettersson 2019), a database for historical manuscripts related to cryptology. One of the encrypted manuscripts caught our eyes in May 2020 and we started transcribing, analyzing, and deciphering it. We discovered that it was a diplomatic letter sent by Maximilian II. Maximilian II was a member of the Austrian House of Habsburg and from 1564 to 1576, the Holy Roman Emperor. In addition, we found two more documents encrypted with the same key in the DECODE database. In the end, we successfully deciphered three encrypted letters sent by Maximilian II in 1575. After we started to decipher the letters using a ciphertext-only cryptanalysis approach, we also discovered the original encryption key in the set of keys collected in the DECODE database.
This article summarizes our methods for and the results from transcribing, analyzing, codebreaking, and translating these three encrypted letters. It demonstrates how a combined interdisciplinary effort of historians, linguists, philologists, computer scientists, and cryptanalysts can be fruitful. The work presented here, is a direct outcome of the interdisciplinary research project DECRYPT , that aims at collecting, transcribing, analyzing, and deciphering original historical encrypted manuscripts. Moreover, the tools created and used for the DECRYPT project are published and available online in order to give others with interest in historical cryptology the opportunity to decipher similar encrypted manuscripts on their own.
The article below is structured as follows: Section 2 briefly presents related work also dealing with Habsburg cryptography. Section 3 gives an overview of the three letters and their transcriptions. Section 4 discusses the cryptanalysis of the letters. We first discuss the cryptographic peculiarities of the cipher and then show how we broke the cipher used to encrypt the first letter using a ciphertext-only attack, amended the decryption with the original cryptographic key, and decrypted the two other letters. We briefly discuss open problems with regard to the decryption. Section 5 gives an overview of the content of the letters and their historical context. Section 6 presents the characteristic features of the historical written language and its linguistic peculiarities. Finally, Section 7 gives a brief outlook on future work.

Related work -Habsburg cryptography
Before this project, there has been only little research on Early Modern Habsburg ciphers. In existing literature on Habsburg ciphers, we have not found any information on the practices at the chanceries of Maximilian II. Two recent publications by Auer (2015) and Pecho (2015) and Ernst's research (Ernst 1992(Ernst , 1997 contribute to our knowledge about ciphers from the 17th and 18th centuries. Kahn (1996, 163-165) describes an era of advanced cryptographic practices by Vienna's Black Chamber (Schwarzes Kabinett) in the 18th century. A good summary on Habsburg ciphers can be found on Satoshi Tomokiyo's website Habsburg Codes and Ciphers 1 . However, there is no information about the late 16th century.
In connection with his work collecting cipher keys and code tables at the HHStA for the DECODE database, L ang (2020) provides an overview of encoding practices in Austria from the early 16th to the 19th century. On the basis of a comprehensive review of almost 500 keys and codebooks, he concludes that the chancery's cryptographic practices became more professional around mid-18th century. This professionalization was achieved not only by technically improved and more complex ciphers, but also by more concrete and sophisticated instructions for the scribes (L ang 2020, 91). Finally, the period of Maximilian II is also peripherally covered in L ang (2018), however, with a main focus on Hungarian cryptology.
The three letters discussed in the present article contain diplomatic instructions for Habsburg ambassadors in Poland (see Section 5). According to Ortlieb (2019), such diplomatic correspondence was commissioned by the Privy Council (Geheimer Rat) and issued by the chancery that, as a consequence, was responsible for the encryption (cf. Gross 1933, 112).

The letters and their transcription
When we started the analysis of the three letters, their transcriptions were not available. All we had at that time were high-resolution photos. Therefore, the first step was to transcribe the letters based on the photos. Transcriptions are needed since our cryptanalytic algorithms use text data as input to perform cryptanalysis.
At the beginning of the research, we examined only the first of the three letters, since we did not know at the time that other letters share the same encryption key. For each ciphertext symbol, we chose a different UTF-8 letter to represent it. We transcribed cleartext passages with the syntax defined in the DECRYPT transcription guidelines (Megyesi 2020).
In the following, we give a short overview of the three letters that we analyzed.
1. The first letter is identified in the DECODE database as "Chiffrenschl€ ussel_fasc_20_kt14_200-204" and is held at the HHStA under "Staatskanzlei Interiora, Chiffrenschl€ ussel,  In the following, we refer to this letter as "letter A". Letter A consists of eight full pages with ciphertext symbols and a ninth page with only two small lines of ciphertext symbols. Letter A consists of about 9,500 ciphertext symbols.
2. The second letter is identified in the DECODE database as "Chiffrenschl€ ussel_fasc_20_kt14_194-198" and is held at the HHStA under "Staatskanzlei Interiora, Chiffrenschl€ ussel,  In the following, we refer to this letter as "letter B". Letter B also consists of eight full pages of ciphertext symbols and a ninth page with only six small lines of ciphertext symbols. Letter B consists of about 7,300 ciphertext symbols. 3. The third letter is identified in the DECODE database as "Chiffrenschl€ ussel_fasc_20_kt14_174" and at the HHStA under "Staatskanzlei Interiora, Chiffrenschl€ ussel, Kt. 14. Fasc. 20. f 174". 4 In the following, we refer to this letter as "letter C". This is the shortest letter. It consists of two full pages of ciphertext symbols and a third page with only five small lines of ciphertext symbols. Letter C consists of only about 1,600 ciphertext symbols.
Thus, the three letters contain a total of about 18,400 ciphertext symbols. The symbols are different graphic signs and can be described as a mixture of astrological signs, Greek letters, and esoteric symbols. Letter A was the first letter we analyzed, followed by letter B and letter C. Coincidentally, letter A was actually written before letter B, as we were able to establish after deciphering the dates. We provide details on the content of the plaintext of the letters, the dates they were sent, and their historical context in Section 5. Additionally, we discuss the letters' plaintext language in Section 6.
We did transcription and cryptanalysis of the letters in parallel. Every time we had transcribed a new paragraph of the letter, we used our cryptanalysis software to analyze it. This also helped us to find transcription errors. For example, we had initially wrongly assigned what later turned out to be different ciphertext symbols, to the same transcription symbol. Using linguistic approaches, we were able to improve the transcription by finding errors in the transcribed and deciphered words. The overall transcription process lasted six hours for the first letter. After gaining some experience with the first letter, the transcription of the second letter was faster. Finally, the third (and shortest letter) was transcribed in only two hours.
The handwriting of the ciphertext symbols in the letters is mostly clear and easy to read. Therefore, we did not have much difficulty transcribing these. Figure 1 shows the first page of letter A. As an example, we show here a transcription of the first page of letter A. Each line in the transcription corresponds to an original line in the ciphertext:

Cryptanalysis
This section describes in detail how the three letters were cryptanalyzed and the used cipher was broken. As we did not know the used key in the beginning, we had to perform a ciphertext-only cryptanalysis. Using the methods and algorithms described below in detail, we were able to decipher about 80% of the ciphertext of letter A. After finding the original key in the DECODE database, we were able to decrypt about 95% of the letters. Only a few nomenclature elements (e.g. code words for names and places) were and are still missing in our decryptions. In the following, we first describe the cryptographic peculiarities of the used cipher. After that, we discuss the ciphertext-only cryptanalysis as well as the ciphertext decryption using the original key and present the reconstructed as well as the original key. Finally, we present some open problems with respect to decrypting all of the three letters.

Cipher type and cryptographic peculiarities
We analyzed the three different letters one by one. During the cryptanalysis of letter A, we initially did not know the original key. Therefore, we had to perform a ciphertext-only cryptanalysis to recover the key. Later, still in the process of analyzing letter A, we found the original key (see Figure 7) in the DECODE database. 5 Thus, we could improve our decryption of letter A on the basis of the original key. The following two letters could be decrypted more easily using the key we recovered from the cryptanalysis of letter A and the original key we found in the archives.
The first step in our cryptanalysis effort was a frequency analysis of the ciphertext. Figure 2 shows the distribution of the 40 most frequent ciphertext symbols in letter A and the corresponding plaintext letters which we found later. Null symbols are indicated with 0. The cipher is a homophonic substitution cipher 6 with nomenclature elements. Letter A contains a total of 79 distinct ciphertext symbols.
Embedded in the ciphertext are Latin cleartext passages, e.g. "Benigni" and "Ater" in letter A or "animum et mentem" in letter C. These cleartext passages are the nomenclature elements of the cipher. For example, "Benigni" decrypts to Archduke Ernest of Austria. The HHStA in Vienna keeps this original key in a folder (Kt. 13) which is different from the folder where the three cryptographic letters (Kt. 14) are kept. So their connection was unknown before. Thanks to the metadata recorded together with the documents and the search possibilities in the DECODE database we were able to find the matching key. 6 With a homophonic substitution cipher, plaintext letters are represented by more than one ciphertext symbol. For example, the plaintext letter A may be encrypted as either 01 or 02.
Thankfully for the cryptanalyst and a revealing security flaw is the fact that there are spaces between words, that is, after each sequence of symbols representing a word in the original plaintext. That simplified the cryptanalysis, since frequently-used words like the German articles "der, die and das" could be easily identified. Nevertheless, the usage of the "old" 16th century German language made the cryptanalysis more challenging.
During the cryptanalysis, we soon realized that homophones encrypt not only single letters, but also duplices (bigrams) and even a word, the frequently-used und (English: 'and'). Also, we saw that both pairs (the letters "U" and "V" and the letters "I" and "J") share the same ciphertext symbol, respectively.
Another peculiarity of the cipher worth mentioning is the handling of umlauts ( € A, € O, € U) in the plaintext. In several places in the ciphertext, the two dots of the umlauts are also added on top of the ciphertext symbols. For example, the homophone symbol for plaintext letter " € A" is the same as the homophone for the plaintext letter A, but with the two umlaut dots on top.
The cipher includes 13 distinct null symbols. The nulls are rarely used in letters A, B, and C, and they occur only in a few places with two exceptions: the beginning and ending of the letters. The first two letters (letters A and B) begin with the name of the sender ("Maximilian"), but his name is embedded in multiple null symbols (e.g. nulls are added before, between, and after the symbols that compose the name). For example, letter A begins with "###MAX#IMILI#AN##" (see Figure 3), where each "#" stands for a null symbol, thus, the name is hidden between seven null symbols. The same is done at the beginning of letter B, where even more nulls are used: "####MAX#IMI#LIAN######". In fact, that made the identification of the sender challenging for the ciphertext-only cryptanalysis, since the plaintext letter "X" rarely appears in the letters and we were not sure which symbols are nulls. On the backdrop of the letter's content, we suspected that the sender was Maximilian II but we could establish he was indeed the sender only when we found the original key in our database.
The second exception is the extensive usage of nulls at the end of the letters, where the sending dates are hidden between many null symbols. For example, letter A contains the date written as "####DAT#PRAG DEN 5##IULII####1#5#7#5####" (English: "Prague, the 5th of July 1575"). The digits of the year appear as cleartext in the ciphertext as shown in Figure 4.

Deciphering of the letters
This section first discusses the ciphertext-only cryptanalysis of letter A. After that, letter B and C could easily be deciphered using the key recovered via cryptanalysis, and the original key found in the archives. Finally, we describe the key.
Ciphertext-only cryptanalysis: Since we had no key at the beginning, we started with a ciphertext-only cryptanalysis. At this point, we also did not know the plaintext language, the time period and the fact that there exist two other letters in our database that were also encrypted using the same key. We made some initial assumptions regarding (1) the language, (2) the time period, and (3) the cipher type: 1. Based on a suggestion by Benedek L ang, we first assumed that the plaintext language might be French or Latin. French was one of the diplomatic languages 7 in the 17th century. Also Latin was used by the aristocrats at that time. We also hypothesized the possibility that the language might be German. 2. We assumed that the letter was written in the 17th century based on the dating given by the archivists for the folder in which the letters were found (Kt. 14). 3. Due to the large number of distinct ciphertext symbols (79 distinct symbols in letter A), we assumed that the used cipher was a homophonic substitution cipher, maybe also with nomenclature elements. At that time, we did not know that the Latin cleartext parts were actually the nomenclature elements.
To cryptanalyze letter A, we used the Homophonic Substitution Analyzer (see Figure 5) from CrypTool 2 (Kopal et al. 2014) and tried to obtain meaningful plaintext using the French and Latin language models Another important diplomatic language in the 17th century worth testing would have been Spanish. However, since the results in CT2 already after a few tests pointed to German as the plaintext language, we did not consider Spanish as well.
implemented in CrypTool 2. CrypTool 2 is an e-learning tool developed for teaching cryptography and cryptanalysis which we use to develop new techniques and tools for the cryptanalysis of historical documents. Kopal (2018) describes how cryptanalysis can be performed using CrypTool 2.
With letter A, the (semi-automatic) analysis with French and Latin language models did not produce any meaningful results, thus we finally switched the language model to German. With the German model, after a few restarts of the analyzer, (partial) German words and phrases started to appear. At that point, we were convinced that the plaintext language was German. Thus, we started a "detective work" by changing and correcting the results the analyzer produced and incrementally improved the deciphered plaintext as well as the key. After several iterations, and with the help of dictionaries for Early New High German, we were finally able to decrypt most parts of letter A. Still, the beginning and ending of the letter, as described above, were unreadable due to the many nulls used there. Figure 5 shows the partially deciphered letter A of Maximilian II (the digits mark the different parts of the user interface: 1 ¼ analysis details, The ciphertext-only cryptanalysis of letter A also helped us to improve the tool and the user interface of the Homophonic Substitution Analyzer of CrypTool 2. Kopal (2019) describes the analyzer and its algorithms in more detail. Here, we only give a short introduction of the analyzer's cryptanalytic algorithm, which is based on the simulated annealing-based optimization technique.
The analyzer starts with a random key (mapping homophones to plaintext letters). The maximum number of homophones for each plaintext letter can be defined, e.g. the user may configure that only 3 homophones for "E" are allowed in the key. After creating the initial key, the analyzer incrementally improves the key by changing single mappings of homophones to plaintext letters. The ciphertext is then deciphered with the modified key, and the resulting plaintext is evaluated using Modern German pentagrams as language model. The "best" key is kept for the next iterations. A dictionary, here a Modern German dictionary, may be used to "lock" found words. The analyzer has two different modes: (1) A fully-automatic and (2) a semi-automatic analysis mode: 1. With the fully-automatic analysis mode, the analyzer performs several restarts on its own and keeps track of the "best keys" found, with respect to the selected language model. 2. With the semi-automatic mode, the user can stop the automatic cryptanalysis at any time and make manual corrections, e.g. changing the mapping of one or more homophones. When the analyzer finds deciphered words in the dictionary, it automatically locks the corresponding mappings, thus, words are marked with a blue color. "Locked" homophones at other positions in the ciphertext, that are not part of a complete word, are marked with a green color. The best key the analyzer has found so far is displayed.
With the Homophonic Substitution Analyzer we were able to correctly decrypt about 80% of letter A.
Deciphering the ciphertext using the original key: During the ciphertextonly cryptanalysis, we were able to find the original historical key in the DECODE database. This only was possible after we had identified some mappings of homophones to plaintext letters. At the time of our analysis, we had stored more than 500 different key records from the HHStA in the DECODE database, making a search only having the ciphertext difficult. Also, most of the keys were not transcribed, thus, an automated search was not possible. A search could only be done manually by comparing our generated mappings with the shown mappings on the photos of the original keys. The retrieved key not only confirmed many of our cryptanalysis results, e.g. the substitution of the word und (English: 'and') or many of the found homophones, but it also helped us to decrypt missing parts like the beginnings, endings, and some nomenclature elements.
A short time after finding the original key, we realized that another letter stored in our database (letter B) was also encrypted with the same key. We found that out by test-decrypting the first line of the letter using our key. After the word "Maximilian" showed up, we were sure that the letter was indeed encrypted using the same key. Finally, after presenting our latest research results to our colleagues in the DECRYPT project, we found out that the third and shortest letter (letter C) was also encrypted with the same key as the two previous ones. In contrast to the first two letters, the third one did not start with the first line showing "Maximilian", but we could decrypt the line to meaningful Latin and German: "POSTSCRIPTA HOCHW € URDIGER F € URST … " (English: 'postscripta, most illustrious prince … ').
Using the digital key and the CrypTool 2 substitution component (that allows to decrypt homophonic substitutions too) the decryption of the two additional letters B and C was only a matter of copying the ciphertexts into CrypTool 2 and applying the key to them. Figure 6 shows a screenshot of the used CrypTool 2 workspace (graphical program) decrypting letter C. On the left side of the screenshot, the transcribed ciphertext (upper text field) as well as the key (bottom text field) are shown. The substitution component (small component with a rectangle inside) decrypts the ciphertext using the given key. The final decrypted plaintext is shown on the right side (text field). After decryption, the ciphertext can be copied and further analyzed, e.g. in a text editor. To ease the understanding of the three letters, we analyzed the 16th-century German and prepared preliminary translations into Modern German. Section 6 presents more details about that.
The key (reconstructed and original): As already mentioned, we were able to reconstruct most of the homophones using the homophonic substitution analyzer of CrypTool 2. Table 1 shows our reconstructed key. Later, we found the original key in the DECODE database. Figure 7 shows a photo of the original key named "Cyffra nova ad Poloniam" from 1572. On top of the two pages, first, the mapping of single plaintext letters to homophones can be seen. Below this, there are the mapping of plaintext duplices (bigrams) to homophones. Then, the symbols for nulls are shown. The lower and largest part shows the nomenclature elements. For example, here we saw, that "benignus" encrypts Archduke Ernest of Austria. Also, one can see that numbers encrypt different countries, e.g. the 1 means Germania. However, the nomenclature elements in this key do only partly correspond to the elements used in the ciphertext letters. The key is identified in the DECODE database by " € OStA_HHStA_Stk_Int_ Chiffrenschl€ ussel_fasc_20_28" and held at the HHStA identified by "Staatskanzlei Interiora, Chiffrenschl€ ussel, Kt. 13. Fasc. 20. f 28." 8 We also found a second copy of a similar original key identified by " € OStA_HHStA_Stk_Int_Chiffrenschl€ ussel_fasc_20_30" in another record of the DECODE database 9 . It is identified at the HHStA as "Staatskanzlei Interiora, Chiffrenschl€ ussel, Kt. 13. Fasc. 20. f 30.". Unfortunately, this copy does not provide any additional or different nomenclature elements.

Open problems
At the time of writing this article, we are able to decrypt about 95% of the three ciphertext letters. Nevertheless, we have a few open problems that we are still working on: (1) Missing plaintext representation for nomenclature elements, (2) small transcription problems, (3) problems with the punctuation, (4) and nulls that seem to be nomenclature elements.
1. We have some nomenclature elements that are not contained in the original key. Examples for that are the words "Bern", "Ater", and "Nato", which are written in letter A. Based on the linguistic context we can tell that these stand for personal names, an assumption supported by the overall typology of nomenclature elements at that time. In one case, we can deduce from the context which person most probably was meant (see Section 5.1). However, without finding the correct plaintext representations, maybe in another key record stored in the DECODE database, the meanings of these elements remain unclear. At the same time, this means that the actual key used for encrypting the letters must have been a similar type with a slightly modified list of nomenclatures.
2. Despite trying to transcribe the texts of the three letters with a lot of care, some transcriptions of single symbols may be wrong. We are therefore trying to find and correct these mistakes. 3. Throughout the transcription process, the punctuation of the letters was not easily identifiable. With some sentences, dots marking the end of these were visible in the ciphertext, with others not. Also, the length of the plaintext sentences makes the identification of punctuation difficult. 4. During the analysis of the content and the language, we realized that some of the symbols which are listed either as nulls in the original key or do not appear at all also seem to be nomenclature elements. The linguistic context suggests that the symbol that looks like the letter "i" with a dot ("i.") stands for Poland and the symbol that resembles the letter "z" with a dot ("z.") represents Lithuania. Further, it would follow that the combination "iz." as a combined single symbol stands for the Polish-Lithuanian Commonwealth.

Historical context and content of the letters
In this section, we first give an overview of the historical context the letters relate to and are embedded in. After that, the content of the respective letters is presented and exemplified with plaintext excerpts from the letters.
The full plaintext of all three letters can be accessed in the DECODE database (see the links in Section 3). 10 The three letters all relate to the same historical event, namely the election of the new Polish king and the Grand Duke of Lithuania in the Polish-Lithuanian Commonwealth in 1575. After his brother's sudden death, the former king, Henri of Valois, fled Poland to claim the French throne and left the crown vacant. In May 1575, the Polish-Lithuanian Commonwealth was formally declared interregnum in a gathering of the Polish and Lithuanian nobility in Ste R _ zyca. Furthermore, the Commonwealth arranged a royal election to be held in Warsaw on 7 November 1575. Discussions at the gathering showed a deep divide between a pro-Habsburg and a contra-Habsburg league (Stone 2001, 122;Rhode 1971Rhode , 1036. Instead of passing on the crown by succession, the ruler of the Polish-Lithuanian Commonwealth was elected in a "sejm", a gathering of members of the nobility (Polish: szlachta). All members of the nobility had the right to attend the gathering and vote in the royal election, and around 50,000 electors were involved (Whaley 2011, 379;Jedruch 1982, 71,74).
Maximilian II, his son Ernst and his brother Ferdinand were among the candidates. The deep divide between the pro-Habsburg and the contra-Habsburg among the nobility led to a double election. On 12 December 1575, both Maximilian II and, three days later, the Polish princess Anna Jagiellon together with her future spouse Stefan B athory, the Prince of Transylvania, were proclaimed kings. The latter candidates were supported by the (mainly Polish) nobility in the lower house led by Jan Zamoyski whereas Maximilian II was backed by the senate and the Lithuanian and Prussian noblemen. Since B athory was faster on site in Krak ow to claim the crown, he won the double election and was coronated in May 1576 (Rhode 1971(Rhode , 1036.
In the three ciphertext letters several historical places and events before and after the royal election are mentioned. . He explains to Kochtitzky that following the gathering, his ambassadors received instructions from several Lithuanian noblemen, amongst others from the Court Marshal of Lithuania, Nicolas Christofer Radziwiłł, who even sent a servant to the Habsburg. These documents are said to be copied and attached to the current letter. However, we unfortunately do not have access to these documents in our records.
Upon receipt of the letter, Kochtitzky shall immediately go to Lithuania and see Radziwiłł and hand over to him a Credentiales literae [CREDENZ SCHREIBEN]. 12 He shall also assure him of the Empire's goodwill (A2:1-10). In the following paragraphs, Maximilian brings forward several arguments in favor of the election of his son Ernst as the king of the Polish-Lithuanian Commonwealth. He requests Kochtitzky to deliver these arguments, supposedly orally, to Radziwiłł. He mentions, for instance, that there is a divide in the Polish nobility, but that he considers they should vote united with the Lithuanian nobility for his son Ernst (A4:1-A5:5). He even suggests the possibility of sending money and other help to Polish noblemen who are not convinced yet (A5:8-14). Furthermore, Maximilian asks Radziwiłł to give him advice for other actions that might be taken (A5:15-29) and to send out his own allies to promote Ernst since this would be less suspicious (A6:1-3). 11 In the following, we use capital letters to give plaintext passages in the original. The indications in brackets refer to the text passage in the plaintext document available in the respective record in the DECODE database. The code A1:10-11 means letter A, page 1, lines 10-11. 12 A letter assuring legitimation and security by the Emperor (Meyer 1902, 337).
Maximilian orders Kochtitzky to consult and inform even Marshal "Ater", the Grand Marshal of Lithuania (A6:12-19). 13 Kochtitzky shall listen carefully what the two Marshals have to say and satisfy them with the Empire's promises (A7:1-11). He emphasizes again that he finds it best if the Marshals could send out their own allies to campaign for the Habsburg candidacy (A7:12-16). However, in case they consider it necessary that Kochtitzky shall be responsible for the initiative, Maximilian wants him to report the advice of the two Marshals on what the best course of action should be (A7:16-A8:1).
On the last page of the letter, Kochtitzky is informed that he also receives other letters of thanks and Credentiales literae for other Lithuanian noblemen in the attachment (A8:2-7). He is also instructed to listen carefully to the advise of the two Marshals and to the mood of the general nobility and to report everything back to the Crown (A8:8-21).

Exemplar letter to the ambassadors, 24 December 1575, Vienna (Letter B)
The second enciphered document is filed as "EXEMPLUM LITERA" on its last page, i.e. it is a template letter that most probably was copied several times and posted to different ambassadors [ORATORES]. It is dated 24 December and posted from Vienna (B8:25-26).
On the first page of this letter, Maximilian refers to a letter from 15 December where he learned "very reluctantly" [GANZ UNGERN (B1:8)] that the situation in Poland is divided. He mentions that he hopes that eventually, there will be a positive consensus. No further details on this divide are mentioned in the letter, but from the historical context we can deduce that the double election of Maximilian (on 12 December) and Stefan B athory on 15 December is referred to here. Maximilian requests his representatives to put things straight and to provide him instructions on what actions he should take.
Furthermore, Maximilian reports that the Habsburg court will send letters with warnings to supporters of both parties and that he hopes the conflict can be resolved without the use of force (B2:19-25). However, he makes it clear that he has prepared for such actions because he would not stay idle to assure his right for the crown (B2:25-B3:5). Therefore, he has given notice to his allies in Saxony, Brandenburg, Bohemia, Silesia and Upper and Lower Lusatia to get ready for a potential war.
Additionally, the addressees of the letter are requested to report back on how the different supporters are planning to act in an emergency situation of a war (B3:20-B5:6).
In the following two paragraphs (B5:7-B6:21), Maximilian announces the renewed peace treaty with the Ottomans and that it is his intention as king that Poland also keeps up this peace.
Moreover, Maximilian explains that he will not be able to travel to Krak ow by 12 January, as requested by the Polish-Lithuanian senate, because it is on a too short notice and he wants first to be assured of the definite decision of the election (B6:22-B7:26). Finally, Maximilian reminds his representatives to give notice of any action his counterpart intends to take. Moreover, he orders that they should, on the one hand, invite the noblemen who voted for him to confirm their vote in a letter and, on the other hand, to consult with trusted allies on how a gathering of the opposite party could be prevented (B7:26-B8:25).

Postscripta to the letter from 23 December 1575 (Letter C)
The third document that is introduced as POSTSCRIPTA and dated 23 December 1575 is a short summary of the aforementioned letter B (see Section 5.2). First, a disappointment about the content of the letter from 15 December is uttered (C1:1-17) and a report is given that the allies of the Habsburg have been informed to prepare for a potential war (C1:21-24; C2:1-4). Furthermore, we find explanations on which documents are attached to the letter and which documents are not (C2:5-16).

Language
The three letters are written in a so-called "neutral" Austrian-Bavarian written dialect and in an office style typical of the Early New High German (ENHG) period. In this section, we first present characteristic features of the written Bavarian dialect and then describe a linguistic peculiarity with regard to the use of the Latin nomenclature elements.

Written Bavarian dialect
The language of the letters can clearly be identified as the Bavarian written dialect used at the Habsburg chanceries in Austria in the late 16th century. The language in official writings issued by the chancery is called "neutral" Austrian Bavarian. There are regional features typical of Austrian Bavarian, but no strong dialectal traits (see Wiesinger 2012). Table 2 gives an overview of some typical linguistic features of neutral Austrian Bavarian occurring in the letters: 14 While the features in Table 2 can be found in all three letters, letters A and B show an interesting distribution of another typical orthographic feature, the use of the signs hpi and hbi, respectively. In letter A, the so-called Upper German hpi occurs only in one specific word, erpieten 'offer'. Other possible candidates, such as bis 'until', sambtlich 'all' and others are all written with a hbi: In letter B, however, we can observe a more frequent use of the Upper German hpi: hpi likewise occurs in the verb -pieten 'offer', but here, even sampt 'all' and nachparschafft 'neighborhood' are spelled with a hpi, while hbi can be seen in bis 'until', lieben 'to love', and other instances. From other studies on Early Modern writing it is known that the scribes usually adhered to regional orthographic features of their chancery, but that they also had some freedom to develop their own "orthographic style" (see, e.g. Elmentaler 2018;Moser 1977;Waldisp€ uhl, in press). On the backdrop of these insights, we can hypothesize that the two different uses of Upper German hpi might indicate the distinct styles of two individual scribes, i.e. the texts of the letters were edited by two different scribes, respectively. However, a more comprehensive orthographic analysis is needed to validate this assumption.
The letters furthermore share particular characteristics in their vocabulary. Beside words and wordforms typical of the Bavarian office language, such as nit 'not' (in contrast with Middle German nicht), there are certain phrases that reoccur frequently in all three letters. An example of such a phrase is an nichts erwinden lassen, sich nit erwinden lassen 'not show a lack' (see Grimm and Grimm 2005 s.v. erwinden) as in the following subordinate clause:  14 Phonology is the study of sound patterns in a language and orthography the study of the writing system.
Morphology treats the structure of words and word forms.
The three letters show, however, some differences in the syntactic and textual structure. Letter A consists of long paragraphs and very long sentences that are internally structured by subordinate clauses and strings of independent clauses linked by connectives such as NIT ALLAIN … SONDER AUCH ['not only … but also']. The paragraphs and sentences in letter B, on the other hand, are shorter. This structure illustrates the greater range of topics dealt with in letter B. The postscripta in letter C are given in even shorter sentences and paragraphs. Since in this letter, the topics of letter B are summarized the more concise structure is not surprising.
6.2. Code-switching in the nomenclature elements As mentioned above (see Section 3), the nomenclature elements of the cipher involve Latin appellatives, i.e. Latin words such as benignus 'benevolent, benign', animus 'soul', mente 'brain'. Interestingly, these Latin code words are integrated into the syntactical context of the German plaintext and are inflected according to the Latin case system. The nomenclature element benignus, for instance, occurs in the genitive form benigni in the following phrase: Another illustrative example is the embedding of the nomenclature element ater 'gloomy' in the following passage. In the first instance, the Latin word Ater stands in the nominative case, in the second instance in the dative (Atro) according to the German syntax. Thus, we can observe a "double switch" in these ciphertext letters. On the one hand, the scribe switches between two written sign systems, the cipher alphabet and the Roman alphabet when he introduces nomenclature elements. This practice results in the nomenclature elements being easily detectable because they visually stand out from the ciphertext body. On the other hand, there is code-switching between the nomenclature language Latin and the plaintext language German in which the nomenclature elements are embedded in.
From a cryptographic perspective, these grammatical adaptations are relevant because the nomenclature elements are typically indicated in the nominative singular form in the corresponding historical keys (see Figure 7). Hence, to be able to establish a link between the nomenclature element embedded in the letter context and the form used in the keys a cryptanalyst has to be aware of the Latin declension system.

Conclusion and future work
This article is a direct outcome of the DECRYPT project, leveraging interdisciplinary work by historians, computer scientists, linguists, philologists, and cryptanalysts. It summarizes how we found, transcribed, analyzed, and deciphered three previously unknown encrypted letters of Maximilian II, Holy Roman Emperor from 1564 to 1576. Due to the efforts of historians who have been visiting archives all over the world we gained access to these encrypted letters. Using the tools developed by computer scientists and cryptanalysts we were able to successfully decipher these letters. The project expert on historical German then further refined the decryptions and translated the letters to Modern German to ease the understanding of the contents. The letters turned out to be diplomatic letters sent from Maximilian to his ambassadors in Poland asking for support and also giving direct orders regarding the Polish-Lithuanian Royal Election in 1575.
The three documents were encrypted using a homophonic substitution cipher, with nomenclature elements written as Latin words and encrypting names and places. Single letters and some syllables, as well as the German word und (English: 'and') were encrypted using one or at most two different homophones.
In the same time period, the Vatican used ciphers invented by the Argentis (see the article about the papal ciphers in Lasry, Megyesi, and Kopal 2020). While both ciphers are homophonic ciphers, Maximilian's cipher was a lot easier to analyze and decipher than the papal ciphers. The papal ciphers employed mainly digits, instead of graphical signs, and those digits were written continuously, without any spaces or separators, and therefore making cryptanalysis much more challenging, even with modern computerized techniques. Maximilian's cipher used a set of single, clearly distinguishable homophones (astrological signs, Greek letters, and esoteric symbols). Furthermore, there are visible spaces between words, and each letter can have at most one or two homophones (vs. five or even more with papal ciphers). So the three letters confirm that the Habsburg Empire in the 16th century was lagging behind the state-of-the-art (as exemplified by the 16th century papal ciphers) by nearly a century.
It was also interesting to see that the cryptographic key was probably used over a significant period of time. The dating on the original key document is 1572 and the three letters were all written in 1575. That means the key was in use for at least four years. Keys were in service several years since they had to be distributed (securely) to the corresponding parties. But this also meant that when a cryptographic key was compromised, letters encrypted with these keys could be read by the adversaries over several years (on this security problem, see also Ernst 1992).
So far, there has been little research on the language of the Habsburg chanceries (see Wiesinger 2012, 416) and the few aspects described in Section 6 provide only superficial glimpses of some main characteristics. More systematic examination of the three letters is needed to gain a more comprehensive understanding of the historical language. Furthermore, a comparison with other letters issued by Maximilian II in the 1570ies would contribute additional insights into linguistic and structural peculiarities of these cryptographic letters. In conclusion, the cryptographic documents provide not only precious data for the field of historical cryptography, but they also contribute to historical linguistic research and help to gain a better understanding of the communication and cryptographic practices in Habsburg chanceries.
In future work, we plan to improve our analysis techniques, implemented in CrypTool 2, to further ease the cryptanalysis of historical encrypted manuscripts. The DECODE database contains additional encrypted manuscripts of the Habsburg Empire, probably encrypted with other keys, which also will be transcribed and cryptanalyzed.
About the author Nils Kopal is a Computer Scientist and Cryptanalyst working as a Postdoc at the University of Siegen, Germany. He specializes in cryptanalysis of classical ciphers and distributed cryptanalysis. He is leading the development of the open-source software CrypTool 2. In the DECRYPT project he is responsible for developing tools for cryptanalysis of historical and classical ciphers and integrating these in the DECRYPT pipeline and CT2. Michelle Waldisp€ uhl is an Associate Professor in German Linguistics and Language Education at the Department of Languages and Literatures, University of Gothenburg, Sweden. She is a historical linguist specialized in philology, Germanic language history and the linguistics of writing. She has worked on historical spelling variation, especially in runic and onomastic sources.