Del Vasto to Charles V, and a letter to “Garbino” from Madrid, 1527–28

01 The volume

Français 3022 is a sixteenth-century recueil of originals and copies, mostly imperial correspondence of 1527–28 that came into French hands. There are about twenty letters of Juan Pérez, the imperial secretary in Rome, several of them in clear. There are three letters of the Marquis del Vasto (Alfonso d’Ávalos), who commanded the imperial infantry after the Sack of Rome. There are Spanish “avertimientos” of 1528 from Fuenterrabía and Bayonne, and a small bundle of Italian espionage papers. The notice’s folio numbers run about three higher than the ink foliation. Below, folios are the ink numbers and “views” are Gallica’s (ark btv1b90601558).

02 Checked first: existing decipherments

The catalogue says “no decipherment noted”, and the obvious place for a French decipherment was checked first. The eighteenth-century Clairambault copies were searched. Clairambault 327 ff. 279–280 copies no. 20 as “Lettre non signée écrite au seigneur Garbino du 11 d’avril 1528 … partie en chiffre, partie non”, with the cipher copied and nothing deciphered. Clairambault 314 f. 337 copies the addition sheet. Neither carries a decipherment, and none turned up in the neighbouring français volumes.

The decipherments are modern. Tomokiyo’s cryptiana pages record that George Lasry sent him a solution of no. 10 in 2023. In 2026 Tomokiyo edited it into a Spanish text and published it as “Gasto–Charles V Cipher 1”. That text is not complete: of its 1,146 words, 47 carry a query, 19 of them a bare “?” for a group not decoded, and a few stretches are garbled; Tomokiyo still asks for someone to finish it. He also published Lasry’s preliminary letter-level decryption of a second cipher, used in no. 6 and in no. 19, asking for someone who knows Spanish to finish that too. No. 10 is therefore counted here as deciphered in part by others. It was not reworked, and since only an edited text exists and no sign transcription, it is not measured.

03 No. 6: del Vasto’s December letter

The piece catalogued as an anonymous report opens in clear: “A seis de noviembre escrivi a V. M. muy largo y tanbien a xxvij de setiembre, cuyos duplicados van con esta”. The clear first page reports the agreement with the Pope for “la libertad suya y de los cardenales” (the capitulation of 26 November) and says that del Vasto is still in Rome only because the Prince of Orange, “el qual se espera que verna de aqui a tres dias”, has not yet arrived to take the command. That puts it in the first days of December 1527.

The cipher is a Caesar shift of one place over a 21-letter alphabet, with homophones, plus a nomenclator of three-letter groups beginning with b, c or d. Lasry’s decryption has the letter layer right; it checks against the f. 16v ciphertext word for word. It leaves the groups as [doz], [deh] and so on. His key also pairs a row of syllable signs two to a label (al, con, de, el, es, la, lo, no, para, por, qve, sin), and checked against the glyphs these pairings merge different signs: boz is esto, not “fin” (“y por esto pienso”, “en estos tiempos”); bab is mas; bar is tan (“tan adelante”, “tan cerca”); bop is como; bopt, Lasry’s “con s”, is ellos (“porque ellos no tienen gente”); bie is el, not “al”; bis is de; and bep is es in some places and en in others. Two of his cipher words are not text at all: at stands at every boundary between clear and cipher, going in and coming out, and quia stands before the cipher on f. 17r and f. 41r. They are switch markers. The barred sign ≡ is a stop.

The code groups were identified by taking every occurrence of each across nos. 6 and 19 and reading the Spanish around it. All are grade I (inferred from context); none is confirmed by a key or a clear copy.

The rest of the table (di mandado, coy Italia, der poca, bim empresa, cip mil, cac Florencia, bag rica, det he, bad basta(ra), bas deve or puede, and others) is in n6_codes.json and n6_reading.md. The measure is taken on n6_signs.tsv, which keeps Lasry’s decryption as a list of cipher signs, adds five signs seen on the image that his list leaves out, and gives each run a reading and a status; n6_measure.py checks it reproduces his stream exactly.

With these, the deciphered text of ff. 16v–17v is a strategic proposal. Del Vasto wants the army out of Rome and moving north before Lautrec settles the matter in Lombardy. His plan: secure Siena, “la qual es muy devota de V. M.”; threaten Florence so that the League must come to its aid; take Perugia, “una tierra del Patrimonio muy rica y muy gruesa”, and the state of Urbino, “en el qual se hallará poca resistencia”; and pass into the Marche, “donde no pueden faltar vituallas”. It ends with a warning that runs through all his letters of that winter: “que el exército por lo de advenir no se puede sostener desta manera”, and that with so many shortages “es imposible que el servicio de V. M. se haga como sus fieles vasallos deseamos”.

04 What remains uncertain in no. 6

Every code value above is grade I, inferred from context. The 34 signs not yet deciphered are these.

Ten code groups, eleven signs. Each has one or two contexts, and none fits a single value. Blocker: open codes; more contexts are in no. 19 ff. 41–43, which are not yet transcribed.

• dnh: “porque según la [dnh] no la seguirán en venir tan adelante”. Roma, suggested on 18 September, does not fit.
• bnq: “dificultoso el bolver y que mas el quedar y [bnq] y finalmente no podrían”.
• rar (twice): “es ganar en el camino a [rar] y ponella debaxo el mando de V. M.”; “si no los suyços se acogieren [rar]”. Florencia or Luca are candidates; neither is settled.
• car: “sera poner espanto a [car] y ocasión a estos enemigos”.
• cny: “en esta empresa servirá … mil [cny]”.
• bny: “de hazelles hazer [bny] un movimiento”.
• beb: “podrase ir más fácilmente a socorrella [beb] porque es mejor el camino”.
• bnc: “podrase tomar apuntamiento [es bnc]”.
• ge+: after “como si se estuviese el exército dentro”; possibly a stop.
• der at 17va.2: “la principal de [der de] país”. Elsewhere der = poca, which does not fit here.

Nine short stretches, 23 signs besides the codes. The signs are transcribed, but the syllable values that make sense elsewhere make none here, most likely because Lasry’s labels merge different glyphs, as they do for es/en and con/tan/ellos. Blocker: open codes; they need a glyph-level retranscription of these words.

• the head of f. 16v, “[y y por] [mq] creo mas presto”;
• “[en de las los] que más se ha de trabajar”;
• “el duque de Urbino [es de] otro exército está en Narni y Todi”;
• “servirá [que de con] mil [cny]”;
• “irá [que l] camino”;
• “la principal de [der de] país”;
• “si caminara en [cnt] parte” (ninguna or otra);
• “se puede esperar [es] más ventaja”;
• “apuntamiento [es] [bnc]”.

A third letter in the same key would settle most of them. No. 19 is one. Lasry decrypted its first leaf; ff. 41r and 41v were searched on the images for the open groups, which gave bet = dello and the switch markers, but ff. 41–43 have not been transcribed in full. CSP Spain III.2 no. 233 summarises its content from a copy in the Salazar collection, not its words, so it gives no crib.

05 No. 20: the Garbino letter and Ranzo’s code

No. 20 is an Italian letter, dated at Madrid on 11 April 1528, endorsed on the back to “Garbino”. It alternates clear and code. The clear passages report that the Chancellor was ill with gout, that fifty galleys were being fitted out, that a million ducats had been raised in Castile and 500,000 more were expected from the Cortes of Aragon, and that the Empress was in the seventh month and the prince would be sworn heir. The coded passages, about two thirds of the letter, are what it was sent for.

The design is explained by the sheets bound after it. On f. 48 is a jargon, with more on f. 49: cover letters signed “Antonio de Cosenza” to “Andrea Romano in Valencia”, news disguised as the price of grain, and a list of cover names. On f. 49v the Emperor is “Joan Jacobo”, del Vasto “portolano de Gergenti”, Garbino himself “antonio petra”. On f. 50 is an “Aditione nel zifra” that shows how the code works.

Each code group is the initial of the word with a number: apresso is a³²⁷, Cartagenia c³²⁷, Garbino g²¹⁵, soa santità s³⁹⁵, and common syllables get groups of their own. The addition continues each letter’s list from where the base table stopped (a1–326, b1–156, c1–326 …). The same code is used in the signed letters of Hieronimo Ranzo in BnF fr. 2988 ff. 2 and 9–10 and fr. 3019 f. 73. Ranzo was a Vercelli nobleman at Charles V’s court, of the family of Gattinara’s mother. Norbert Biermann had already tied the addition sheet to Ranzo’s code in a 2017 Cipherbrain thread. The Garbino letter is very likely Ranzo’s.

06 Why it cannot be decoded without the key

An initial-letter code is usually weak for one reason: if each letter’s list is in alphabetical order, the number tells you roughly where in the dictionary the word sits. That was the first thing tested. The distribution of the numbers within each initial was compared with where frequent Italian words fall in an alphabetical list, against shuffled orders. No. 20 scores z = −0.5. The same test run on Castiglione’s letters encoded with a genuinely alphabetical code scores about +6.5. Ranzo’s numbering is not alphabetical, so a number says nothing about its word beyond the initial.

What is left is a word substitution under one constraint, the initial letter, with about 550 group types in no. 20 and 730 in Ranzo’s own letters. All 1,315 groups of no. 20 were transcribed from full-resolution scans, and about 2,600 more from the six Ranzo pages. The two share 316 group types, which confirms the key is one table. An annealer then assigned each group a word with the right initial, treating the z groups as nulls, and scored the result with a word-bigram model built from Castiglione’s Lettere (diplomatic Italian written from Spain in these same years) and Guicciardini. It was first run on a control: 3,900 words of Castiglione held out of the model and encoded the same way.

That is the limit of the method, and the control shows it. Frequent words come out, because their contexts fix them: c170 che, i100 il, p149 per, n38 non, r41 re, s233 sua, m170 mi, p246 più. The words that carry the news occur once or twice each and do not. Nor was there a crib to be had. No Ranzo page repeats a passage of no. 20 (the longest shared run is a stock three-group phrase), the copy marked “dup.ª” duplicates another Ranzo letter rather than this one, and the Clairambault copy carries no decipherment. The other “pièces en chiffre” of fr. 2988 are a different, French, symbol cipher.

07 What would finish it

Only new evidence will finish no. 20: Ranzo’s base table, or any of his letters that was deciphered at the time or survives in clear. The places to look are Gattinara’s papers in the Archivio di Stato di Vercelli, the imperial correspondence in Simancas and Vienna, and the other side of the Garbino network. The transcriptions and the solver are ready for a key or a crib; with even a few hundred words of known plaintext the substitution would close quickly. For no. 6 the work is in hand here: a full transcription of no. 19 ff. 41–43 for more contexts of the ten open groups, and a glyph-level retranscription of no. 6 to separate the syllable signs Lasry’s labels merge. No. 10’s queried words would need a sign transcription of ff. 26–28 and 39, which no one has made.

08 Sources and files

• BnF français 3022 (Gallica), views 32–34 (no. 6), 51–55 and 76–77 (no. 10), 78–85 (no. 19), 86–98 (nos. 20–21); français 2988 (Gallica), views 6–7 and 17–20; français 3019 (Gallica), views 114–116; Clairambault 327 (Gallica), views 263–264.
• S. Tomokiyo, cryptiana, George Lasry’s solutions (Lasry’s Cipher 2 key and decryption of no. 6, the key extended here) and Spanish ciphers, “From the Archives”.
• Calendar of State Papers, Spain, vol. III part 2 (1527–29), British History Online, no. 233.
• K. Schmeh, Cipherbrain, 17 May 2016, comments by Norbert Biermann and Thomas, 2017.
• Repository: targets/vasto1527/, with notes, the no. 6 sign file and its measure (n6_signs.tsv, n6_measure.py), the code table, the transcriptions of no. 20 and of Ranzo’s letters, the addition sheet as JSON, and the solvers and control.

Notes, transcriptions and scripts are in targets/vasto1527/.