The Enigma machine

Six in the morning, 1942. A German weather ship somewhere in the North Atlantic sends its report: cloud, wind, visibility. It is short and dull. It is typed into a machine the size of a typewriter, and what goes out on the air is a jumble of five-letter groups. A few hours later, in a wooden hut on an English country estate called Bletchley Park, someone reads that jumble — and learns from it the key the whole German navy will use for the rest of the day.

The machine was called Enigma, Greek for “riddle”. Its makers were sure no one could solve it: it had more settings than there are stars in our galaxy. Yet it was broken, first by Polish mathematicians, then by the British. Today we look at how it worked and where its weakness hid.

A machine instead of a table

Enigma was invented by the German engineer Arthur Scherbius, who filed his patent in 1918. At first it was sold to banks and businesses as a commercial cipher machine; in the second half of the 1920s the German navy and army adopted it. We will talk about the most common military model, the Enigma I.

From the outside it is simple. There is a keyboard of 26 Latin letters and above it 26 small lamps with the same letters. Press a key and a lamp with a different letter lights up. One operator typed the plain text; a second wrote down the letters that lit. That was the cipher text.

You already know the Vigenère cipher: each letter gets its own shift, and the shifts repeat in a cycle. Enigma takes that idea to the extreme. After every key press it changes the whole substitution table, and the same table does not come back for about 17,000 letters. A cipher whose substitution changes from letter to letter is called polyalphabetic.

The rotor: scrambled wires

The heart of the machine is the rotor, a wheel about the size of an ice-hockey puck. Each face has 26 contacts, one per letter. Inside, wires connect the contacts in a scrambled order: contact A on one face leads to, say, E on the other, B to K, and so on. A single rotor is just a simple substitution cipher made of copper.

The trick is that the rotor turns. Before each letter, the right-hand rotor moves on by one step, and all its wires shift against the input. The same key A now meets a different wire and comes out as a different letter. One rotor gives 26 different substitutions in a row.

There are three rotors, and they turn like a car's odometer. The right one moves with every key press. When it passes a certain letter — each rotor has its own, marked by a notch on its rim — it kicks the middle rotor on. Once per turn the middle rotor kicks the left one in the same way. The letters the rotors stand at show in three little windows in the lid.

Follow the current. From the key it goes through the plugboard (more on that soon), then through the right, middle and left rotors, into the reflector, which turns it round and sends it back through the same three rotors by other wires. Only then does it light a lamp. Each letter goes through eight substitutions in a row, and all of them change with every key.

The double step

An odometer and an Enigma differ in one odd detail. When Enigma's middle rotor kicks its left neighbour, it also moves itself. So once every 650 key presses it steps twice in a row. Click “Show the double step” in the widget and press any key three times: the windows go ADU → ADV → AEW → BFX. The middle rotor moved from D to E, and with the very next key straight on to F.

It is not a design flaw, just mechanics: the pawl that pushes the left rotor sits in the middle rotor's notch and drags it along. Because of the double step, the machine's full cycle is a little shorter than 26 × 26 × 26: 16,900 positions instead of 17,576. Harmless for the cipher, and a classic trap for anyone writing a simulator.

You press the same key five times: AAAAA. What lights up?

Most likely five different letters, because the right rotor turns before every key Five identical letters Five A's

The rotor turns before each letter, so the current takes new wires. With rotors I-II-III, reflector B and windows AAA, five A's give BDZGO. Repetition in the plain text vanishes in the cipher, which is exactly why frequency analysis gets nowhere here.

The reflector: a convenience and a fatal flaw

The reflector is a fixed disc to the left of the rotors. It joins letters in pairs and sends the current back. Why have it? Convenience. The reflector makes the machine reciprocal: if A becomes R at some setting, then R becomes A at the same setting. So encrypting and decrypting are the same operation. The receiver sets the rotors exactly as the sender did, types the cipher text, and the plain text lights up on the lamps. No “encrypt / decrypt” switch at all.

The convenience had a price. The current enters the reflector on one wire and comes back on another: the reflector never connects a letter to itself. So Enigma never encrypts a letter as itself. A can become anything except A. Keep that in mind: it is what doomed the machine.

The plugboard, and how many settings there are

The military added one more part: the plugboard (Steckerbrett), a panel with 26 sockets on the front. A cable joins two letters, say A and V, and they swap places, both before the rotors and after them. Operators usually fitted ten cables, swapping ten pairs.

The plugboard doesn't move as you type, but it multiplies the number of settings by an astronomical factor. Try it:

With five rotors in the box and ten cables you get about 1.59 × 10²⁰ settings, a hundred and fifty-nine billion billion. On top of that come the rings: each can be turned against its wiring, which shifts the moment a rotor kicks its neighbour. Trying everything blindly was impossible by hand, impossible for a 1940 machine, and frankly not quick on a modern laptop either.

So why was Enigma broken? Because a huge number of keys is necessary for security but not sufficient. The codebreakers never tried everything. They found ways to rule out nearly everything at once.

How the operators worked

Every operator had a key sheet for the month: for each day, the rotor order, the ring settings and the plugboard pairs. In the morning the machine was set up from the sheet. Then, for each message, the operator chose three letters himself — the rotors' starting position, his “message key” — and sent it at the start, encrypted as well. Until 1940 the message key was encrypted twice in a row, so that static on the radio could not garble it. That care for reliability gave the codebreakers their first foothold.

One more detail: the machine has no space bar, digits or punctuation. Spaces and full stops became the letter X, and numbers were spelled out. So the word EINS (one) turned up suspiciously often in German traffic.

You have today's key sheet and an intercept. Settings: rotors II · V · I (left to right), reflector B, rings A A A, start position M A P, plugboard AE BF CM DQ HU JN LX PR SZ VW. The message:

KPXYU VCZWF BLTCX TPXJR ZHZ

Where is the key?

Open the Enigma simulator and set the rotors, rings, start position and plugboard pairs exactly as on the sheet. The machine is reciprocal: decrypting is just typing the cipher text.

Paste the cipher text into the text box. The answer starts THE KEY; each X stands for a space.

With these settings KPXYUVCZWFBLTCXTPXJRZHZ becomes THEKEYXISXUNDERXTHEXMAT: “the key is under the mat”, with X between the words.

Notice how little it took: knowing how the machine works (every side knew) and the day's settings. That is Kerckhoffs's principle at work: all of Enigma's secrecy rested on the key sheets. Which is why the British hunted so hard for them on captured ships and U-boats.

The Poles: mathematics against the machine

The first to break Enigma were not British but Polish. In 1932 a young mathematician at the Polish Cipher Bureau, Marian Rejewski, took on the German military Enigma. The commercial model was known, but the wiring of the military rotors was not.

Rejewski noticed what others had missed: the doubled message key. The first and fourth letters of every message were the same plain letter encrypted at two machine positions; likewise the second and fifth, the third and sixth. Collecting dozens of messages from one day, he wrote out how the letters were linked in those pairs and found chains in them — cycles. The lengths of the cycles depended only on the rotor positions and not on the plugboard. The plugboard, the designers' pride, simply dropped out of the problem.

Intelligence helped too. The French were receiving documents from a German informer, Hans-Thilo Schmidt, including key sheets for two months of 1932, and passed them to the Poles. With those sheets and the theory of permutations, Rejewski rebuilt the rotor wiring by the end of 1932 without ever seeing a military machine. With his colleagues Jerzy Różycki and Henryk Zygalski he built Enigma replicas, a catalogue of cycles, Zygalski's perforated sheets and, in 1938, an electromechanical “bomba” that searched for settings by running through rotor positions.

In July 1939, five weeks before the war began, the Poles handed everything they knew, replicas included, to the British and the French at a meeting near Warsaw.

Bletchley Park: cribs and bombes

Meanwhile the Germans made things harder: they added rotors IV and V, and in 1940 stopped doubling the message key. Rejewski's method stopped working. At Bletchley Park, Alan Turing and Gordon Welchman found another way in, through the crib.

A crib is a guess at a piece of the plain text. The Germans were methodical: weather reports began with WETTERVORHERSAGE (“weather forecast”), reports carried the same ranks and addresses, and night watches sent KEINE BESONDEREN EREIGNISSE, “nothing special to report”. If you know a word is somewhere in a message, you must find where. And here the reflector's flaw helps: a crib cannot sit anywhere one of its letters falls on the same cipher letter.

Once the crib is placed, you have pairs of “plain letter, cipher letter” at known distances. The British bombe — a cabinet of dozens of spinning drums imitating Enigmas — ran through every rotor position looking for contradictions. If a guess about the plugboard led to one letter being wired to two different letters at once, the position was thrown out. The first British bombe went to work in 1940; by the end of the war there were over two hundred. Each found a day's key in hours rather than centuries.

A night signal to U-boat command. We know that after a short address it contains the routine phrase KEINEBESONDERENEREIGNISSE (25 letters). At which position does the phrase start? Count positions from one.

DSTDR SAEIO BLJBI EMNFH MDYPH JQDQU NGRNT

Write the phrase under the cipher text starting at the first letter. If any letter of the phrase sits under the same cipher letter, that position is impossible. Move one letter right and repeat.

By hand this takes a while. Here are the same message and phrase in the widget: press “Test every position”.

There are 11 positions: a 35-letter message and a 25-letter phrase. Ten of them have at least one letter landing on itself and drop out. One survives: the 8th. So the signal opens with seven letters of address: ANXBDUX, “an BdU”, to the U-boat commander.

For Bletchley that would be a perfect day: one crib position, and the bombe could start at once. Usually several positions survived and each was tried. Even so, the reflector's flaw saved an enormous amount of work.

So why did it fall?

It is tempting to think one brilliant idea beat Enigma. In fact a pile of small things did.

• A design flaw. No letter encrypts to itself, which rules out crib positions and feeds contradictions to the bombe.
• Procedure. The doubled message key gave Rejewski the cycles in which the plugboard vanished.
• People. Operators chose lazy message keys — AAA, ABC, neighbouring keys on the keyboard — repeated stock phrases, and sometimes sent the same text twice in different ciphers.
• Captures. Key sheets and machine parts were seized from ships, U-boats and weather trawlers.
• Scale. By the end of the war thousands of people worked at Bletchley Park, and codebreaking ran like a factory.

Why did it help the British that Enigma was reciprocal — that one setting both encrypts and decrypts?

Because decrypting went twice as fast Reciprocity came from the reflector, and the reflector never lets a letter become itself: that was the loophole Because it switched the plugboard off

The designers bought convenience (no decrypt mode) at the price of “no letter stays itself”. That property let codebreakers rule out crib positions and built the logic of the bombe.

What to take with you

• A rotor is a substitution made of wires. Turning before every letter, it gives a new substitution; three rotors with a reflector and plugboard give a new table at every key press.
• The rotors turn like an odometer, except that the middle one double-steps: once per turn it moves twice in a row.
• The reflector makes the machine reciprocal and at the same time forbids a letter to encrypt to itself. That became the main loophole.
• A vast number of keys does not help if there is a way to rule out almost all of them without trying: cribs, procedural slips, human habits.

Enigma reached for an ideal: a cipher whose substitution never repeats. Can that ideal be reached? It can, and all it takes is one operation on bits. Next: XOR and the one-time pad →