Briefly, the CSA breaks up the input ciphertext into a list of words, and
recursively tries to fit as much of the list as possible to the words in a
fairly long list of English words, longest word first.  It tries to find
the trial solution with the maximum number of words fitted with the same
key, among all the recursive tree walks made. 

The "engine" program is a compiled-to-native-code C source that runs at
nice 5 (5 notches less priority than the server daemon itself), so that
the server gets priority for handing out pages to folks.  Consequently,
you get less of the allotted execution time, which is about 15 seconds,
during the busy part of the day.  If you try the CSA mail response option,
a machine that runs at about the speed of a Pentium 433 does the work,
again at nice 5, but you are allowed all day long.  (You should be
prepared to wait.)

The CSA is very strongly dependent on the input having the word boundaries
and lengths correct, so that, for example, a ciphergram redivided into
five letter groups will not work.  It is a little less dependent on having
no wrong letters in the text, but it thinks words of three letters or less
are all exact and in its word list, so a mistake in a short word will
almost surely cause it to fail.  Two newspaper cryptoquotes in 1997 have
had the word "oh" in them, and because that word was not in the known word
list, they failed, so I added "oh" to the list.  The "Los" of Los Angeles
tripped the CSA once.  Nearly all the "time limit" failures are caused by
input having a letter left out of a word, or a wrong letter in a short
word. 

The CSA knows no grammar or word meanings.  It is merely a brute-force
pattern matching algorithm.  The upside is that you could replace the word
list with, say, a fairly complete and very accurate German list, and the
CSA would solve German ciphergrams.

Some people try leaving out words, or even most of the ciphertext, to get
a start.  A few have also thought of putting the entire ciphertext in the
attribution window; the CSA merely fills that in using whatever key it
derives from the ciphergram window, and the user uses the results to fix
mistakes and try starting key pairs. 

While I was still developing the CSA engine, I enciphered "The quick brown
fox jumps over the lazy dog" and tried it out.  Four hours.  Short words,
non-unique patterns, no one or two-letter words, and few common letters.
I called it pathological, and went on.  Now, with the present word list,
it takes about twenty minutes on the K6-450, but yields:

   WHY FIRST BLACK JAG VIXEN AMYL WHY QUOD ZAP.

Not noticably better.

The CSA usually does not get stumped on the Cryptoquotes in the
newspapers;  that's probably because those have to be easy.