# Fifteenth-century Italian "mixed" keys and the Voynich text: structure, solvers, signatures

Scope: the hypothesis that the Voynich text is Latin or an Italian vernacular enciphered with a chancery key of the Tranchedino type (letter homophones, syllable signs, a nomenclator of whole-word signs, nulls). Every citation is tagged:

- VERIFIED-FETCHED: I retrieved the text, or the relevant part of it, during this survey.
- VERIFIED-URL: I confirmed the bibliographic record (Crossref, Semantic Scholar, OpenAlex, a repository page or an abstract) but not the full text.
- UNVERIFIED: known only from secondary citation. Not checked.

No numbers below are mine unless marked "my count" or "my inference".

---

## 1. Real key structure, c. 1380-1480

### 1.1 Papal and Avignon keys (Meister 1906)

Source: A. Meister, *Die Geheimschrift im Dienste der päpstlichen Kurie von ihren Anfängen bis zum Ende des XVI. Jahrhunderts*, Paderborn, 1906. Internet Archive scan `diegeheimschrift00meis`, OCR text read directly. [VERIFIED-FETCHED]

- **Archbishop Petrus of Naples, 1363-64.** These are "vowel systems": only the vowels are replaced, later also l, m, n, r, s. Nulls ("Trugzeichen") are new at this point. They are "scattered at will; sometimes Petrus puts them after every letter, then again only after two, three or four, in irregular alternation." Petrus often enciphered only single lines or single words, not whole letters.
- **Gabriel de Lavinde (Parma), secretary to the antipope Clement VII, 1379.** His handbook is Vat. Arch. Collect. 393, ff. 166-181. Meister says the system "has nothing to do with the vowel system any more." Vowels get no more substitutes than consonants, so all letters are treated alike, one sign each. The cipher alphabet mixes "signs, letters, digits indiscriminately," often modified by dots or strokes, "and usually the addition of nulls increases the difficulty." Meister links the method to north Italian state chanceries, possibly Visconti Milan.
  - My count from the printed keys: the null lists ("nichil habent importare") hold 4 to 6 signs per key. Key 1 has 6, key 2 has 5, key 5 has 4, keys 8 and 12 have 6.
  - Key 13 has a nomenclator of roughly 40-50 entries (my approximate count from the OCR). It holds only names and titles, plus a few political nouns (pax, Matrimonium), each coded as a two- or three-letter group (papa, cardinalis, rex Francie, Imperator, Veneti, Florentini, Mediolanum, dux Burgundie and so on). There are no function words.
  - Pelling summarises these as "at heart, simple (monoalphabetic)" with nulls and nomenclators of "a dozen-or-so" shapes. [VERIFIED-FETCHED, ciphermysteries.com/2016/07/06]
- **Spacing, the key point for the simulator.** Meister writes that keys of the 1540s-50s "repeatedly" carry the instruction to encipher "without spacing between words and without paragraph breaks." From this he concludes that "one was in the process of abandoning the earlier custom of enciphering with word separation" (p. 49). Papal ciphertexts of the 1540s are written continuously "so that word endings cannot be recognised." Orthography is simplified (doubles, diphthongs and h dropped).
- **Mid-16th-century papal keys, for contrast** (pp. 47-49):
  - The nomenclator is "not always present; where present often only very meagre, only the most necessary proper names and perhaps the words et, per, non, che." When rich, it includes "whole syllable series ba, be, bi, bo, bu."
  - Most alphabets have "only one or at most two nulls."
  - Nomenclator words were flagged by a dot over the neighbouring sign, or by enclosing the word between two nulls.

### 1.2 Mantua and Milan: the Tranchedino ledger (Vienna, ÖNB Cod. 2398)

- **The codex.** Parchment, 169 folios, "ca. 1475, probably Milan." It contains "287 complete and four partial keys," not all of them true keys. Some keys use arbitrary symbols for letters, digraphs and trigraphs, and "vowels get more symbols than consonants." Facsimile: *Francesco Tranchedino: Diplomatische Geheimschriften*, ADEVA, Graz 1970, with commentary by W. Höflechner. [VERIFIED-FETCHED, facsimilefinder.com product page; a secondary description, not a scholarly edition]
- **Dating.** Folio 20v sits between ciphers of 1458 and 1459, so entries span decades. [VERIFIED-FETCHED, ciphermysteries.com/2011/06/28]
- **Cerioni 1970.** L. Cerioni, *La diplomazia sforzesca nella seconda metà del Quattrocento e i suoi cifrari segreti*, 2 vols., Rome, 1970. The citation is confirmed in Costamagna 1977, but I did not consult the book. [UNVERIFIED for content]
- **Sacco.** I found no fetchable Sacco item that treats Tranchedino. [UNVERIFIED; no title given to avoid invention]

**Pelling's reading of specific ledger keys** (ciphermysteries.com, "Fifteenth century cryptography", 6 July 2016). [VERIFIED-FETCHED]

| Key | Vowels | Consonants | Other contents |
|---|---|---|---|
| Mantua 1401 (to Simeone de Crema) | multiple shapes each; four per vowel per his comparison | reversed-alphabet substitution (A→Z, B→Y) | none described |
| Milan, Tranchedino ledger, undated, "probably c.1450-1455" | three shapes each | not stated | signs for doubled letters; signs for shorthand ('9', ℞, p); "a few more nulls than before"; nomenclator of "more than eighty special entries" |
| Mantua ducal cipher 1450 (in the ledger) | three homophones each | two each, except x, z and '9' | mini-codebook of common words (Come, Quando, Quanto, Non…); "some nulls"; arbitrary shapes for syllable groups "ab, ac, ad, af, ag, etc." (a VC series); small nomenclator, about the size used in Mantua fifty years earlier |

Pelling: by c.1450 only "scale" changed. In a comment, he dates the first removal of word spaces to early 16th-century Venice.

**An actual Milanese ciphertext.** G. Costamagna, "Un'ottima applicazione quattrocentesca del sistema cifrante monoalfabetico," *Studi di Storia Medioevale e Diplomatica* 2 (1977) 353-358. Letter of 24 Dec 1453, ASMi Carteggio 315. [VERIFIED-FETCHED]

- More than 40 signs against the usual 20-21 letter signs. Homophones on vowels only in this letter, though "by mid-century commonly for all letters."
- Nulls "practically not used." Some nomenclator signs for words and names.
- **Continuous ciphertext, no word separation.** Words broken at line end are not split by syllable.
- No identical adjacent signs, and doubles not shown.
- Frequencies flattened: no sign above about 7% except one, against 13% or more for plaintext *e*.

**Other finds.** Forum posts by Mark Knowles report Milanese ciphers of 1397, 1424 and 1445 and an Albertoni ledger (Cremona, from 1444). None were tested here, and most replies are behind a login. [VERIFIED-FETCHED for the claims; voynich.ninja threads 3943 and 3533] A 1422 Genoese letter used substitution with nulls, homophones and a nomenclator. [VERIFIED-FETCHED, ciphermysteries 2011/06/28, secondary]

**Cicco Simonetta, *Regule* for decipherment, Pavia, 4 July 1474** (BnF it. 1595). Ed. Perret 1890, Gutenberg #28227. [VERIFIED-FETCHED]

- Thirteen rules for simple substitution. Word-final signs are mostly vowels. Italian has five or fewer distinct word endings and Latin more than five. Two-sign words starting with l suggest lo/la/li/le. A frequent three-sign word suggests che. A sign always followed by the same sign is q+u.
- The rules can be defeated "by inserting cipher signs that represent no letters" (nulls), by mixing Latin and Italian, or by "two entirely different cipher alphabets."
- Perret states generally that "most often words are not separated."
- Bonavoglia reads the Regule as applying to ciphers with "spaces among words left visible, only one sign for each letter." [VERIFIED-FETCHED, "Venetian Cryptanalysis Treatises of the Renaissance", HistoCrypt]

The rules only work on word-spaced ciphertext, which is evidence that spaced ciphertext was still met in Milan in 1474.

### 1.3 Venice and Florence

- **Venice.** Pre-1500 Venetian keys are scarce. Knowles cites Iordanou as saying only a 1411 key and a 1484 key survive. [VERIFIED-FETCHED forum claim; Iordanou not consulted, UNVERIFIED]
- Bonavoglia documents homophones and nulls in Venice "from the early 1400s." The syllable cipher ("babuino") was "the basis of Venetian ciphers (nomenclators)" by the 16th century. [VERIFIED-FETCHED, ecp.ep.liu.se HistoCrypt article 389]
- **Florence.** Marco Vito, "A Florentine 'polyalphabetic' cipher in the 15th century," Proc. HistoCrypt 2025, pp. 141-148, says the Sforza corpus is "almost exclusively" homophonic monoalphabetic. Capponi's c.1487 nomenclator has 13 words with 3 substitutions each. [VERIFIED-FETCHED]
- **Sforza envoy in Buda, 1490-93:** homophonic "fantasy symbols" built from Greek and Latin letters and numerals. [VERIFIED-FETCHED, mnl.gov.hu/mnl/ol/encryption]

### 1.4 DECODE and the Megyesi et al. statistics

**Megyesi, Tudor, Láng, Lehofer, "Key Design in the Early Modern Era in Europe."** Proc. HistoCrypt 2021, pp. 121-130, DOI 10.3384/ecp183165. [VERIFIED-FETCHED]

- Sample: 700 keys from the 15th to 18th centuries.
- **Nulls:** in about 32% of all keys, but in **96% of 15th-century keys** and 27% of 18th-century keys. **94% of nulls have at least two codes.**
- 72% of keys hold more than 100 plaintext entities. The alphabet alone is about 20-30.
- Script: 98% contain digits, 25% letters or graphic signs, 72% digits only. **In the 15th century, digits, letters and graphic signs appear together in almost all keys.**
- Alphabets are mostly homophonic. Nomenclatures are mostly simple, with homophonic code words becoming standard only in the 17th-18th centuries.
- No regional or per-letter homophone figures.

**Megyesi, Tudor, Láng, Lehofer, Kopal, Waldispühl, "What Was Encoded in Historical Cipher Keys in the Early Modern Era?"** Proc. HistoCrypt 2022, pp. 159-167, DOI 10.3384/ecp188404. [VERIFIED-FETCHED]

- 1,384 keys with nomenclatures were annotated into nine categories.
- Named entities appear in 96% of keys, persons and places most often. About 20% of 15th-century keys have numbers.
- Function words are in fewer keys than content words, in under half of 16th-century nomenclatures.
- Syllables are common only from the 17th century. Shares of keys are given, not entry counts.

**Other DECODE-related work.**
- Tudor, Megyesi, Láng, "Automatic Key Structure Extraction," HistoCrypt 2020, pp. 146-152, is a tool paper with no key statistics. [VERIFIED-FETCHED, abstract page] The DECODE listing shows 10,106 records, with no public century or type filter. [VERIFIED-FETCHED, de-crypt.org/decrypt-web]
- Antal and Mírka studied 93 Thirty Years' War keys (Marburg): 83.9% nomenclators, 88.2% with a homophonic part, 79.6% with a code part. In 91.5% of keys the substitution numbers are smaller than the code numbers, so the sub-ciphers separate by number interval. [VERIFIED-FETCHED, HistoCrypt art. 387; 17th century, digit keys]

### 1.5 Synthesis for c.1380-1480 Italy

- **Homophones.** Vowels got more: 4 in Mantua 1401, 3 in the Milan and Mantua ledger keys of c.1450. Consonants had 1, rising to 2 by mid-century (Mantua 1450; Costamagna says common by mid-century). Lavinde's 1379 papal keys are flat at one sign per letter.
- **Special signs** for doubled letters and for shorthand (9 = con/com, ℞, p = per/pro).
- **Syllable signs** were not universal in the 15th century. A VC series (ab, ac, ad…) appears in Mantua 1450, and VC syllable signs in the 1457 Ottone del Carretto key (see §2). The CV series ba-be-bi-bo-bu is attested in rich 16th-century papal keys.
- **Nomenclator.**
  - 1379: dozens of names and titles, coded as letter groups.
  - Milan c.1450: more than 80 entries.
  - Mantua 1450: small, plus a function-word mini-codebook (come, quando, quanto, non).
  - Florence 1487: 13 words with 3 homophones each.
  - Function words are attested but not dominant.
- **Nulls.** Nearly universal in 15th-century keys, usually 4-6 types with several codes each. Usage in actual letters varied from heavy (Petrus) to "practically not used" (Milan 1453).
- **Spacing.** Contested. Meister says word separation was the earlier papal custom, dropped in the 1540s. Simonetta's 1474 rules presuppose spaces. Costamagna's 1453 Milanese letter is continuous, and Perret says "most often" unspaced. Pelling dates systematic space removal to 16th-century Venice. Simulate both.
- **Script.** Mixed graphic signs, Latin letters and digits, often with dots or strokes. Pure digit keys came later.
- **Partial encipherment** was normal, so a wholly enciphered book would be atypical.

---

## 2. Breaking homophonic ciphers with nomenclators and syllables

### 2.1 Lasry, Biermann, Tomokiyo 2023 (Mary Stuart)

"Deciphering Mary Stuart's lost letters from 1578-1584," *Cryptologia* 47(2): 101-202 (2023), DOI 10.1080/01611194.2022.2160677. The record, abstract and pages are VERIFIED-URL via Crossref and Semantic Scholar. The publisher full text was blocked (HTTP 403), so the exact pipeline in the paper is **not verified**. The following comes from secondary sources:

- **Corpus.** About 50,000 words (abstract); 57 letters, about 176,900 symbols. [VERIFIED-FETCHED, Biermann, Tomokiyo, Lasry, "What Encryption Errors Can Reveal: Cross-Cipher Errors in Mary Queen of Scots' Letters," Proc. HistoCrypt 2024]
- **Transcription.** Manual, in CTTS. [VERIFIED-FETCHED, Héder et al., "Supporting Historical Cryptology: The Decrypt Pipeline"]
- **Symbol typing.** 191 distinct symbols per National Geographic, which led the team to reject simple substitution in favour of homophonic. Rose's summary of a figure in the paper gives 219 symbols. The discrepancy is unresolved. [VERIFIED-FETCHED, nationalgeographic.com; alexanderrose.substack.com]
- **Search.** CrypTool 2 simulated annealing. [VERIFIED-FETCHED, cryptool.org post, 7 Feb 2023]
  - The solver was run under Italian, Spanish and Latin language models with no result; French produced words (*fils*, *ma liberté*).
  - Recognised words were then fixed and the search re-run ("locking").
  - The best automatic key decrypted only about a third of the text. Symbols for whole words, names and parts of words were then worked out by hand from context. [VERIFIED-FETCHED, National Geographic]
- **Key components** (error paper): an alphabet with homophones, a nomenclature (common words, name parts, persons, places), special symbols (nulls, a deleter, a repeater, punctuation) and meaning-changing diacritics.
- **Error rate.** Cross-cipher errors are 1.55% of symbols (2,740 instances). This is a useful noise level for a simulator.
- **How nulls were identified:** not available in the sources I could reach. [gap]

### 2.2 Lasry, "Deciphering Historical Syllabic Ciphers"

NEALT Proceedings Series 53, Tartu, 2024 (HistoCrypt). [VERIFIED-FETCHED, full text]

This is the most relevant method paper.

**Model.**
- The plaintext "vocabulary" is letters plus syllables (CV, VC, CCV, CVC, sometimes VCC or consonant clusters) plus nomenclature words. The key maps each cipher symbol to one vocabulary element.
- Plaintext is decomposed into vocabulary elements either systematically (longest match) or randomly.
- 4-gram statistics are built per vocabulary configuration from reference texts.

**Move.** Only swaps of two symbols' assignments, so the number of symbols per element stays fixed. Initial assignment is random, giving priority to frequent symbols and elements.

**Objective.** S = Σ_g N_g log F_g / Σ_c N_c², with 4-grams. The denominator penalises solutions that pile up on a few elements, the same role as AZdecrypt's entropy term.

**Parameters.**
- Decomposition scheme and syllable set.
- Maximum homophones per element type (vowel, consonant, syllable).
- Interchangeable letters (u/v, i/j) and ignored letters.
- Dedicated symbols for doubles.
- Optional common-word lists and fixed tentative assignments.
- Many parallel runs, e.g. on 64 cores.

**Workflow.** Semi-automatic: the analyst confirms plausible segments, which are fed back as fixed assignments.

**Nulls and nomenclator.** No automatic null or nomenclator detection is described.

**Results** (decrypted-text accuracy / key accuracy):

| Cipher | Ciphertext | Symbol types | Syllables | Full text | At 1,000 symbols |
|---|---|---|---|---|---|
| Ottone del Carretto 1457 (Italian) | 3,900 | 113 | VC, irregular | 75% / 58% | 27% / 13% |
| Castiglione 1527 (Italian) | 900 | 134 | CV | 35% / 18% | not reported |
| Ten ciphers overall | 900-4,300 | 101-219 | various | 35-96% text, 18-68% key | below 5% for most French ones |

- Results are highly sensitive to the homophone caps and the decomposition scheme ("a wrong selection would often prevent the algorithm from converging").
- Performance drops above about 150 types.
- About 40% initial accuracy is usually enough to finish by hand.

### 2.3 Lasry, "Deciphering a Letter from the French Wars of Religion"

HistoCrypt 2022. [VERIFIED-FETCHED]

- 858 symbols, 86 types, homophonic, 2-6 homophones per letter.
- Score: S(K) = Σ F(i,j,k) log R(i,j,k), trigram first. Simulated annealing with two moves (swap two homophones; reassign one homophone) and a cap on homophones per letter.
- Generic trigrams failed. 5-grams gave partial text. **A historical French corpus was decisive.**

### 2.4 Kopal, CrypTool 2 homophonic analyzer

"Cryptanalysis of Homophonic Substitution Ciphers Using Simulated Annealing with Fixed Temperature," Proc. HistoCrypt 2019, pp. 107-116. [VERIFIED-FETCHED]

- Fitness: sum of log pentagram scores × 500,000.
- Fixed temperature T = 15,000. A worse move is accepted with probability exp(-Δ/T) only if that probability exceeds 0.0085.
- Moves: swap two key entries, trying all pairs.
- Key length = observed homophones × 1.3, so spare slots exist.
- After 100 non-improving tries, the last 3 entries are randomised. Restarts are used, and dictionary words can be locked.
- It solved Z408 and an 81-homophone, 500-letter test. Nomenclature support was then "future work"; the online analyzer now supports nomenclature annotation. [VERIFIED-FETCHED, Héder et al.]
- Lasry used the Kopal solver as the first pass on Armand de Bourbon's 1649 cipher. The first key had 150+ discrepancies; the rest was manual, and he notes the encipherer may have used only one homophone per letter. [VERIFIED-FETCHED, HistoCrypt art. 699]

### 2.5 AZdecrypt and the Zodiac work

Oranchak, Blake, Van Eycke, "The Solution of the Zodiac Killer's 340-Character Cipher," arXiv:2403.17350 (2024). [VERIFIED-FETCHED]

- AZdecrypt is simulated annealing with letter n-grams up to 8-grams. Its composite score adds a plaintext-entropy term "to keep the solver from converging to solutions that only use a few of the most common letters" ("n-gram spaghetti").
- Reported throughput: up to 200 homophonic ciphers per second at a 99%+ solve rate.
- **Multiplicity** (key length / cipher length; King and Bahler, *Cryptologia* 17(1), 1993) predicts difficulty: Z408 is 0.13 and solvable; a 153-symbol section of Z340 is 0.41 and failed without cribs.
- King and Bahler, "An algorithmic solution of sequential homophonic ciphers," *Cryptologia* 17(2): 148-165 (1993), detected and collapsed cyclic homophones. [VERIFIED-URL via the reference list]
- Dhavare, Low and Stamp (2013), 1,000-letter ciphers: about 100% success at 28 homophones, about 78% at 35-45, about 40-45% at 55-65. [as reported in Kopal 2019, VERIFIED-FETCHED]

### 2.6 Segmentation and word-level codes

- **Aldarrab and May, "Segmenting Numerical Substitution Ciphers,"** arXiv:2205.12527. BPE and unigram-LM segmentation of unspaced ciphers: 2% segmentation error on 100 synthetic monoalphabetic ciphers, 27% on 3 real homophonic ciphers. A lattice plus a pretrained LM then solved the IA cipher. [VERIFIED-URL, arXiv abstract] It is the closest existing tool for finding cipher units.
- **Chu, Valenti, Knight, "Solving Historical Dictionary Codes with a Neural Language Model,"** arXiv:2010.04746. Lattice plus neural LM over word codes; 75.1% of cipher-word tokens correct on the Wilkinson letters. [VERIFIED-URL, abstract]
- **Automatic nomenclator identification.** I found no published method that detects nomenclator signs from frequency, position or context alone in graphic-sign ciphers. Known practice is:
  - interval separation of number ranges in digit keys (Antal and Mírka);
  - historical flagging of code words by a dot or by enclosing nulls (Meister p. 48);
  - manual identification after a letter-level solve (Mary Stuart, Elio).
  This is a genuine gap, and building a detector is a contribution the program could make.
- **Lasry, Simonetta, Biermann, "Antonio Elio 'Cipher' and his Polyphonic-Syllabic Cipher,"** Proc. HistoCrypt 2025, pp. 80-89. [VERIFIED-FETCHED] A 1540 cipher of about 40 symbols where CV syllable symbols each carry two values (dot-selected), compound symbol pairs, and short-word signs (che); h and doubled letters dropped. It was solved only from known-plaintext matches, with two days to first progress. Shows that a small inventory does not imply a simple cipher.

Tomokiyo's own notes ("Ciphers of Mary, Queen of Scots," cryptiana, 2023, cited in the error paper) were not reached. [UNVERIFIED]

---

## 3. Statistical signatures

**Flattening.**
- The 1453 Milanese letter, with vowel homophones only, had no sign above about 7% except one. [Costamagna, VERIFIED-FETCHED]
- Homophones raise unigram entropy towards log2(number of signs) and raise conditional entropy, because the same plaintext transition is spread over several sign pairs.
- Simple substitution leaves entropies unchanged. One-to-many and many-to-one substitutions do not. [Zandbergen, voynich.nu/extra/sol_ent.html, VERIFIED-FETCHED]

**Human homophone choice.**
- Z408 shows "very strong homophone cycling": plaintext letters are enciphered from an orderly repeating sequence of their homophones (fourteen Es as two identical seven-symbol runs). In Z340 the cycling is present but weaker, perhaps disrupted by transposition. Z340 also has abnormally few repeats within 17-symbol rows, which is anti-repetition behaviour. [Oranchak et al. 2024, VERIFIED-FETCHED]
- In the 1453 Milanese letter, no identical adjacent signs occur at all. [Costamagna, VERIFIED-FETCHED]
- I found **no published measurement** of homophone-choice distributions in 15th-century Italian ciphertexts. Simulators should sweep: uniform, cyclic, favourite-biased, and adjacent-repeat avoidance.

**Nulls.**
- 15th-century keys nearly always have them, with multiple codes. [Megyesi 2021]
- Usage ranged from one null after every letter (Petrus, 1363-64) to almost none (Milan 1453).
- Inserted at random, nulls raise conditional entropy and break n-gram chains. A null type should show near-uniform left and right contexts and no within-word positional preference.
- Meister reports 16th-century warnings not to put nulls at the start and end of a dispatch when only one or two null types exist, because position gives them away. Positional clustering of a candidate null is therefore itself a signature.

**Syllable signs.** One sign replaces two letters, so sequences shorten, the inventory grows (about 85 extra signs for a full CV set [Lasry 2024]) and unigram entropy rises. Key accuracy falls once types exceed about 150.

**Nomenclator.** Most code signs are individually rare (names), while a few function-word codes are frequent. They stand as whole tokens when spacing is kept. A large nomenclator sharply raises multiplicity, which is why automated solves stop at about a third to three-quarters of the text and the rest is manual.

**Measured comparison for the Voynich.** Zandbergen's page gives:

| Text | h1 (bits) | h2, conditional (bits) |
|---|---|---|
| Voynich, transcription range | 3.83-3.87 | 1.84-2.12 |
| Latin and Italian (Mattioli, Pliny, Dante) | 4.00-4.04 | 3.13-3.27 |

The Voynich values are "anomalously low." Rozanova and Temerev, arXiv:2608.17096 (2026), give glyph conditional entropy of about 2.7 bits against about 3.5 for Latin, Italian and English (their alphabet differs). They report a null result for a calibrated one-to-one substitution attack, and that 70% of Voynich token types are singletons. [both VERIFIED-FETCHED; abstract level for the latter]

Glyph-level homophony would push h2 **up**, not down.

---

## 4. Prior proposals that the Voynich is a chancery-type cipher

- **Pelling, the Averlino hypothesis** (*The Curse of the Voynich*, 2006; summary post 10 Jan 2010). [VERIFIED-FETCHED, blog]
  - Milan, after 1456. The EVA "qo" ("4o") is read as a verbose pair attested in Milanese and north Italian ciphers of 1424-1456 (1435 Modena key: 4 = Q, 4o = qua).
  - No formal test is published.
  - His 2016 post argues the Voynich "would seem to have too few cipher shapes to be using homophonic cipher tricks," doubled-letter signs, a common-word nomenclator or nulls. So the author must have hidden vowels some other way.
  - His 2017 draft "Fifteenth Century Cryptography Revisited" argues homophones were a "steganographic defence" against Italian and Latin linguistic giveaways. [VERIFIED-FETCHED, announcement only]
- **Zandbergen** (comment, ciphermysteries 2011/06/28): the Voynich has about 25-35 distinct characters against more than 50 in Tranchedino ciphers, and "its text statistics do not fit a Tranchedino-style cipher applied to Latin or a vernacular." [VERIFIED-FETCHED, as paraphrased by the fetch tool]
  - His entropy page argues that verbose expansion lowers entropy rather than raising it, which is consistent with the Voynich's low h2. [VERIFIED-FETCHED]
- **Mark Knowles** (voynich.ninja threads 3140 and others, 2019-2025) proposes an early-15th-century Milanese model with nulls, homophones, a glossary and possibly filler. No visible test. [VERIFIED-FETCHED, opening posts only]
- **Greshko, "The Naibbe cipher: a substitution cipher that encrypts Latin and Italian as Voynich Manuscript-like ciphertext,"** *Cryptologia* (online 26 Nov 2025), DOI 10.1080/01611194.2025.2566408. [VERIFIED-URL, abstract via OpenAlex]
  - A hand-executable verbose homophonic cipher: plaintext is cut into unigrams and bigrams by dice, and cards select among tables.
  - It reproduces "many key statistical properties" of the Voynich at once, and is presented as constraining plausible substitution structures.
  - Commentary reports 6 representations per unigram and 36 per bigram. Critics say it misses page-position-dependent rare glyphs and Voynich spacing irregularity. [Schneier blog comments, VERIFIED-FETCHED, secondary]
  - Rozanova and Temerev report that a published Voynich-imitating cipher and a generator reproduce the low entropy but not the edge-glyph coupling or open vocabulary. [VERIFIED-FETCHED, abstract]
- **voynich.ninja thread 4769** (June 2025): only a multi-character (3-4 per symbol) substitution of Latin reproduced the Voynich per-word entropy bump at n = 3-6. Graphs only. [VERIFIED-FETCHED]

No published work tests the full Tranchedino package (homophones + syllables + nomenclator + nulls) against the Voynich quantitatively. The closest are Greshko (verbose homophonic, no nomenclator) and Zandbergen's inventory and entropy objection.

---

## (A) Parameter ranges for a realistic simulator

| Parameter | Range to simulate | Basis |
|---|---|---|
| Signs per vowel | 1-4; modal 3 | 1 (Lavinde 1379); 4 (Mantua 1401); 3 (Milan c.1450-55, Mantua 1450) [Meister; Pelling 2016] |
| Signs per consonant | 1-2; frequent consonants (l m n r s t) more likely 2 | 1 (1401, Milan 1453 letter); 2 except x, z (Mantua 1450) [Pelling; Costamagna] |
| Doubled-letter and abbreviation signs | 0-10 (doubles; 9 = con/com; ℞; p = per/pro) | Tranchedino Milan [Pelling]; alternatively drop doubles and h before enciphering [Meister; Elio paper] |
| Syllable signs | 0 (most 15th-c keys) to about 85 (one full VC or CV series); VC series for 15th-c Mantua and Milan | Mantua 1450 "ab, ac, ad, af, ag…" [Pelling]; Carretto 1457 VC, 113 types total [Lasry 2024]; CV ba-bu in 16th-c papal keys [Meister] |
| Nomenclator size | 10-100; modal about 30-80 | Lavinde key 13 about 40-50 (my count); Milan c.1450 >80; Florence 1487 13 × 3 homophones [Vito] |
| Nomenclator content | about 60-90% persons, places, titles; 0-15 function words (che, non, et, per, come, quando, quanto); a few political nouns (pax, matrimonium) | Meister; Pelling; Megyesi 2022 (named entities in 96% of keys; function words less common) |
| Nomenclator code form | 1 sign, or a 2-3-character group; often 1 code per entry, sometimes 3 | Lavinde; Vito |
| Null types | 1-6 (modal 4-6 in the 15th c.), each with ≥2 codes | Lavinde 4-6 (my count); 96% of 15th-c keys have nulls, 94% of nulls have ≥2 codes [Megyesi 2021]; 1-2 in 16th-c papal keys [Meister] |
| Null rate in text | 0-10% of signs as the main sweep; up to about 50% as an extreme case (Petrus) | "practically not used" (Milan 1453); after every 1-4 letters (Petrus 1363-64) [Meister]. No measured rates found; treat as free. |
| Word spacing | Both: (a) word spaces kept, (b) continuous with line breaks ignoring syllables | Spaced: earlier papal custom [Meister p. 49], presupposed by Simonetta 1474. Continuous: Milan 1453 [Costamagna]; Perret "most often". |
| Homophone choice model | uniform; cyclic (Z408-like); favourite-biased (p_fav 0.5-0.9); no adjacent repeat | Z408 cycling [Oranchak et al.]; no adjacent repeats (Milan 1453); "lazy" single homophone (Lasry 1649) |
| Symbol repertoire | 40-150 types, mixing invented signs, Latin letters and digits, with dot or stroke modifiers | >40 (Milan 1453); >50 (Tranchedino) [Zandbergen comment]; mixed scripts [Meister; Megyesi 2021] |
| Encipherer error rate | about 1-2% of signs | 1.55% cross-cipher errors (Mary Stuart) |
| Orthography | Italian vernacular or Latin; optional dropping of h and doubles | Simonetta (Latin/Italian mix); Meister |
| Fraction enciphered | 15th-c letters often partial; the Voynich case is 100% | Petrus; Costamagna |

---

## (B) Solver techniques most worth adopting

1. **Vocabulary-element simulated annealing** (Lasry 2024). Treat letters, VC/CV syllables, doubles and nomenclator words as one vocabulary.
   - Move: swap the assignments of two cipher units, keeping per-element homophone counts fixed.
   - Objective: Σ_g N_g log F_g / Σ_c N_c², with 4-grams trained on period Italian or Latin after the same decomposition.
   - Sweep homophone caps and decomposition scheme; convergence depends on both.
   - Parallel restarts. Lock confirmed segments between runs.
2. **Fixed-temperature SA with spare slots** (Kopal 2019).
   - Pentagram log score.
   - Swap moves over all pairs. Key length set to 1.3 × the observed unit count, so units can become "unassigned" (a natural slot for nulls and unknown code words).
   - Random perturbation of 3 entries after 100 stalls.
3. **An entropy or concentration penalty** in the score: AZdecrypt's plaintext-entropy term, or Lasry's Σ N_c² denominator. Without it, solvers produce high-scoring degenerate output. This matters doubly for the Voynich, where the source h2 is low.
4. **Two-move set from the 1580s French solve.** Swap two homophones, or reassign one homophone to a different letter, under a cap on homophones per letter. Escalate n-gram order 3 → 5 and **use historical-period corpora**; generic corpora failed there.
5. **Unit discovery before solving.**
   - BPE or unigram-LM segmentation (Aldarrab and May) to propose multi-glyph cipher units.
   - Score each candidate inventory by multiplicity (units / text length); the successful cases above all had low multiplicity.
6. **Null and nomenclator handling.**
   - Add an explicit "null" element and a "WORD:x" element class to the vocabulary, each with its own homophone cap. This is a straightforward extension of (1).
   - Seed nomenclator candidates as units that (a) occur as whole space-delimited tokens, (b) are not decomposable by the letter-level key, and (c) are frequent function-word candidates (che, non, et, per).
   - Finish the residue with a lattice plus LM (Chu et al.).
7. **Language-model sweep** (Italian, Latin, Spanish, French), locking words once they surface, as in Mary Stuart.

---

## (C) Three statistically testable predictions of a Tranchedino-type key

1. **Inventory and entropy direction.**
   - A Tranchedino key over single Voynich glyphs predicts 45-150 unit types and glyph-level h2 **at or above** the plaintext's (about 3.1-3.3 bits for Latin and Italian). Observed Voynich h2 is about 1.8-2.1 bits, with 25-35 glyph types.
   - So the key survives only if cipher units are multi-glyph groups (a verbose realisation, as in Pelling's "4o" and Greshko's Naibbe).
   - Test: search segmentations into units. The hypothesis predicts an inventory where (a) the unit count lands in 45-150, (b) unit-level h1 is high and flat (no unit far above about 7%, cf. Milan 1453), and (c) unit-level conditional entropy is ≥ that of simulated Italian or Latin pushed through the same key.
   - Failure to find such a segmentation at any granularity falsifies the hypothesis.
2. **Homophone classes that are distributionally equivalent and position-blind.**
   - Homophones of one letter share left and right contexts but are chosen independently of position in the word: uniformly, cyclically or by favourite.
   - Test: cluster units by context vectors. The key predicts about 5 clusters of size 3 (vowels) and about 10-15 of size 1-2 (consonants).
   - Within each cluster, mutual information between variant choice and in-word position should be about 0. Adjacent same-class occurrences should show either cycling or anti-repetition relative to shuffled controls, as in Z408 and Milan 1453.
   - Strongly position-conditioned variants are what the Voynich edge-glyph coupling suggests (0.2 bits of edge mutual information, more than any prose control). Such variants point to allographs of a script, not cipher homophones.
3. **A small null set and a word-level nomenclator layer, given spacing.**
   - The key predicts 1-6 unit types (each with ≥2 forms) whose deletion **increases** n-gram log-likelihood of the remainder under the fitted model. These types should have near-uniform contexts and no word-position preference.
   - It also predicts a set of about 10-100 token types that behave as indivisible words: they occur only as whole tokens, resist letter-level decomposition, and include a few high-frequency items matching Italian or Latin function-word rates (che, non, et, per). The rest of the set is names that are singleton-heavy and section-clustered (people and places recur in one context).
   - With word spaces kept (the earlier 15th-century custom), word-final units should be dominated by the vowel homophone set. Italian has about 15 final forms (5 vowels × 3) and few others; Latin also allows s/m/t (Simonetta's rule of more than five endings).
   - The test is the final-position unit inventory and its entropy against the same statistic for simulated ciphertexts from Part A.

All citations are given inline with their tags. Unreached sources: Cerioni 1970 (content), Sacco, Iordanou, Raddum and Sýs 2010, Tomokiyo's cryptiana notes, and the full text of Lasry, Biermann and Tomokiyo 2023 (publisher returned HTTP 403).