Enigma

Old ciphers fell because they used the same substitution, or a few in turn, over and over, and letter counts gave them away. The obvious fix is a different substitution for every letter, and in the 1920s machines made that practical. The most famous is Enigma, patented by the German engineer Arthur Scherbius in 1918 and adopted by the German armed forces in the late 1920s. It enciphered their messages through the Second World War, and it was broken: first in Poland, then at Bletchley Park in England. This page builds the army’s machine, the Enigma I, and then breaks it the way they did.

An Enigma looks like a typewriter in a wooden box. Press a key and, instead of printing, a lamp lights under a second set of letters: the enciphered letter. Inside, the key press is a current that runs through a chain of wiring and back:

1. the plugboard, which swaps pairs of letters with cables (up to thirteen pairs; ten was usual);
2. three rotors, each a wheel with 26 contacts on each face, cross-wired inside: each rotor is a fixed substitution, but it can turn, so which contacts line up changes;
3. the reflector, which wires the contacts together in 13 pairs and sends the current back;
4. back through the three rotors, by a different route, and the plugboard again, to a lamp.

The army’s machines came with five rotors, numbered I to V, each wired differently; the day’s key said which three to use, in which order. Their wirings, and the reflector’s, are known today, and this machine uses them.

The rotors are what make Enigma more than one big substitution. Before each letter is enciphered, the right rotor turns one place, so the next letter goes through different wiring. Like the digits of a mileage counter, each rotor has a notch that, at one point in its turn, moves the rotor to its left on by one too: rotor III’s notch is at V, so when it moves on from V, the middle rotor steps.

There’s a quirk. The middle rotor’s own notch also catches the middle rotor itself: when the middle rotor reaches its notch, the next key press moves it and the left rotor. So the middle rotor moves twice in two key presses, the double step. It cuts the machine’s period a little (16,900 letters before the rotors repeat, not 17,576), but more importantly it’s part of the machine, and a simulator that leaves it out gets the wrong letters.

The reflector, sending the current back through the machine by another path, has two consequences.

The same settings decrypt. At any one position, the machine is a set of swaps: if A goes to G, then G goes to A, because the current from G retraces the path from A backwards. So the receiver sets the same start position, types the ciphertext, and reads the message off the lamps. There’s no separate decrypting mode.

A letter never becomes itself. A pressed key’s own wire carries the current in; the reflector can’t send it back on the same contact, so it always arrives at a different lamp. That sounds harmless, even a feature. It was the most useful flaw the codebreakers had, as section 5 shows.

The daily key set out the rotor order, the ring settings (where each rotor’s wiring sits against its lettered ring), the plugboard and the start position. Counting, for the Enigma I with ten plugged pairs:

The plugboard is the giant: there are 26! orders of the letters, but within each pair the order doesn’t matter (2¹⁰), nor does the order of the ten pairs (10!), nor of the six letters left unplugged (6!). Oddly, ten pairs isn’t the most: eleven give 205,552,193,096,250.

Multiplied out, that’s 107,458,687,327,250,619,360,000 keys, about 1.1 × 10²³, between 2⁷⁶ and 2⁷⁷: a 76-bit key, in today’s terms. (The figure often quoted, 158,962,555,217,826,360,000, leaves out the rings.) Trying them all was out of the question then, as it would be hard even now. Enigma was broken anyway, because no one tried them all: they used what they knew about the messages to throw away almost all the keys at once.

The codebreakers rarely knew a message, but they often knew a phrase in it. Military messages are routine: a weather station reported in the same format every day; units reported “nothing special to report” (keine besonderen Ereignisse); messages began with addresses and titles. A guessed phrase like this is a crib, the same idea as on the one-time pad page.

The difficulty is knowing where in the message it goes. Here Enigma’s flaw from section 3 helps: no letter enciphers to itself, so the crib can’t go anywhere that one of its letters sits over the same letter of ciphertext.

With a crib in place, each of its letters is a test of the machine’s settings: at position 26 the machine must turn W into this ciphertext letter, at 27 E into the next, and so on. Try a setting, encipher the crib, and at the first letter that comes out wrong, throw the setting away. Most settings fail on the first or second letter, so testing them is quick, and that’s exactly what a machine can do over and over.

The real problem was harder: the plugboard was always in use, and it changed the letters going in and coming out of the rotors, so a crib’s letters couldn’t be tested directly. The British bombe, designed by Alan Turing, with an improvement by Gordon Welchman, got round it with the crib’s menu: draw each letter of the crib and the ciphertext letter under it, and join them, labelled with the position.

A loop is what defeats the plugboard. Suppose E is plugged to some unknown letter, x. At position 27 the rotors must turn x into whatever I is plugged to; at 38 that must become S’s partner; at 41 that must come back to x. Whatever the plugboard is, the loop has to close. So the bombe, for each rotor setting, assumed a partner for E, followed it around every loop in the menu, and if it didn’t come back to itself, that setting was wrong, plugs and all. Welchman’s diagonal board added the plugboard’s own symmetry (if E is plugged to x, x is plugged to E), which made each test far stronger. A bombe was dozens of Enigma rotor sets, spun electrically through every position. The settings that survived were tried by hand on the message.

Enigma was first broken in Poland. In late 1932 Marian Rejewski, a mathematician at the Polish Cipher Bureau, worked out the wiring of the army’s rotors, using the mathematics of permutations together with documents that French intelligence had obtained from a German source. With Jerzy Różycki and Henryk Zygalski he went on to read Enigma messages for much of the 1930s, inventing the methods and machines (including the bomba) that kept up as the Germans changed their procedures. In July 1939, weeks before the invasion of Poland, they shared everything with British and French intelligence, including reconstructed machines.

At Bletchley Park that work became an industry: the bombes, thousands of staff, and the habits of German operators (stereotyped messages, predictable keys) as a constant supply of cribs. The lessons are the ones from What we want from cryptography: the enemy will learn the machine (Kerckhoffs’s principle), so everything rests on the key; and a cipher that leaks anything at all about its message (here, that no letter is itself) will have that leak used against it.

• Enigma is a different substitution for every letter: a plugboard, three stepping rotors and a reflector.
• The rotors step before every letter, with notches carrying (and the middle rotor’s double step).
• The reflector makes each position a set of 13 swaps: the same settings decrypt, and no letter ever enciphers to itself.
• About 10²³ keys, most of them from the plugboard: too many to try.
• Cribs guessed from routine messages, placed where no letter maps to itself, test the settings letter by letter; loops in the crib’s menu test them whatever the plugboard is. That’s what the bombes did.

• Marian Rejewski, “How Polish Mathematicians Deciphered the Enigma”, Annals of the History of Computing (1981): the first break, in his own words.
• Gordon Welchman, The Hut Six Story (1982): Bletchley Park, the bombe and the diagonal board, from the inside.
• Simon Singh, The Code Book (1999): an approachable account of Enigma and its breaking, among much else.