The Zimmermann telegram,
the Enigma machine and
how cryptography changed
the courses of
the First and Second World Wars
At the end of the nineteenth century, cryptography was in disarray. Ever since Babbage and Kasiski had destroyed the security of the Vigenère cipher, cryptographers had been searching for a new cipher, something that would reestablish secret communication, thereby allowing businessmen and the military to utilize the immediacy of the telegraph without their communications being stolen and deciphered. Furthermore, at the turn of the century, the Italian physicist Guglielmo Marconi invented an even more powerful form of telecommunication, which made the need for secure encryption even more pressing.
In 1894, Marconi began experimenting with a curious property of electrical circuits. Under certain conditions, if one circuit carried an electric current, this could induce a current in another isolated circuit some distance away. By enhancing the design of the two circuits, increasing the power and adding aerials, Marconi could soon transmit and receive pulses of information across distances of up to one and a half miles. He had invented radio. The telegraph had already been established for half a century, but it required a wire to transport a message between sender and receiver. Marconi’s system had the great advantage of being wireless – the signal travelled, as if by magic, through the air.
In 1896, in search of financial backing for his idea, Marconi emigrated to Britain, where he filed his first patent. Continuing his experiments, he increased the range of his radio communications, first transmitting a message about nine miles across the Bristol Channel, and then nearly thirty-three miles across the English Channel to France. At the same time he began to look for commercial applications for his invention, pointing out to potential backers the two main advantages of radio: it did not require the construction of expensive telegraph lines, and it had the potential to send messages between otherwise isolated locations. He pulled off a magnificent publicity stunt in 1899, when he equipped two ships with radios so that journalists covering the America’s Cup, the world’s most important yacht race, could send reports back to New York for the following day’s newspapers.
Marconi’s invention tantalized the military, who viewed it with a mixture of desire and trepidation. The tactical advantages of radio are obvious: it allows direct communication between any two points without the need for a wire between the locations. Laying such a wire is often impractical, sometimes impossible. Previously, a naval commander based in port had no way of communicating with his ships, which might disappear for months on end, but radio would enable him to coordinate a fleet wherever the ships might be. Similarly, radio would allow generals to direct their campaigns, keeping them in continual contact with battalions, regardless of their movements. All this is made possible by the nature of radio waves, which emanate in all directions, and reach receivers wherever they may be. However, this all-pervasive property of radio is also its greatest military weakness, because messages will inevitably reach the enemy as well as the intended recipient. Consequently, reliable encryption became a necessity. If the enemy was going to be able to intercept every radio message, then cryptographers had to find a way of preventing them from deciphering these messages.
The mixed blessings of radio – ease of communication and ease of interception – were brought into sharp focus at the outbreak of the First World War. Both sides were eager to exploit the power of radio, but were also unsure of how to guarantee security. Together, the advent of radio and the Great War intensified the need for effective encryption. The hope was that there would be a breakthrough, some new cipher that would re-establish secrecy for military commanders. However, between 1914 and 1918 there was to be no great discovery, merely a catalogue of cryptographic failures. Codemakers conjured up several new ciphers, but one by one they were broken. It was Germany that suffered most from these security breaches. The supremacy of the Allied codebreakers and their influence on the Great War are best illustrated by the decipherment of a German telegram that was intercepted by the British on January 17, 1917.
At the beginning of 1917, Germany was planning a new naval offensive against Britain, but it was concerned that this might result in accidental damage to, and the sinking of, American ships. Up until this point, America had remained neutral, but the German offensive and inadvertent attacks on American ships might bring America into the war, which Germany was anxious to avoid. Hence the German foreign minister, Arthur Zimmermann, planned to forge an alliance with Mexico. If America entered the war, then Germany would help Mexico recapture territory lost to America, thereby forcing America to keep most of its troops at home, as opposed to sending them to European battlefronts.
On January 16, Zimmermann encapsulated his offer in a telegram to the German ambassador in Washington, who would then retransmit it to the German ambassador in Mexico, who would deliver it to the Mexican president. Figure 23 shows the telegram, its contents encrypted with a diplomatic code. The telegram contained the following proposal:
We shall endeavor in spite of this to keep the United States neutral. In the event of this not succeeding, we make Mexico a proposal of alliance on the following basis: make war together, make peace together, generous financial support, and an understanding on our part that Mexico is to reconquer the lost territory in Texas, New Mexico and Arizona. The settlement in detail is left to you.
Zimmermann
Zimmermann had to encrypt his telegram because Germany was aware that the Allies were intercepting all its transatlantic communications, a consequence of Britain’s first offensive action of the war. Before dawn on the first day of the First World War, the British ship Telconia approached the German coast under cover of darkness, dropped anchor, and hauled up a clutch of undersea cables. These were Germany’s transatlantic cables – its communication links to the rest of the world. By the time the sun had risen, they had been severed. This act of sabotage was aimed at destroying Germany’s most secure means of communication, thereby forcing German messages to be sent via insecure radio links or via cables owned by other countries. Zimmermann sent his encrypted telegram via routes that touched England, so the Zimmermann telegram, as it would become known, soon fell into British hands.
The intercepted telegram was immediately sent to Room 40, the Admiralty’s cipher bureau, named after the office in which it was initially housed. Room 40 was a strange mixture of linguists, classical scholars and puzzle addicts, capable of the most ingenious feats of cryptanalysis. For example, the Reverend Montgomery, a gifted translator of German theological works, had deciphered a secret message hidden in a postcard addressed to Sir Henry Jones, 184 King’s Road, Tighnabruaich, Scotland. The postcard had been sent from Turkey, so Sir Henry had assumed that it was from his son, a prisoner of the Turks. However, he was puzzled because the postcard was blank, and the address was peculiar – the village of Tighnabruaich was so tiny that none of the houses had numbers, and there was no King’s Road. Eventually, Montgomery spotted the postcard’s cryptic message. The address alluded to the Bible, First Book of Kings, chapter 18, verse 4: Obadiah took a hundred prophets, and hid them fifty in a cave, and fed them with bread and water.” Sir Henry’s son was simply reassuring his family that he was being well looked after by his captors.
When the encrypted Zimmermann telegram arrived in Room 40, it was Montgomery who was made responsible for decrypting it, along with Nigel de Grey, who in peacetime had been with the publishing firm of William Heinemann. They saw immediately that they were dealing with a form of encryption used only for high-level diplomatic communications, and tackled the telegram with some urgency. The decipherment was far from trivial, but they were able to draw upon previous analyses of other, similarly encrypted telegrams. Within a few hours the codebreaking duo had been able to recover a few chunks of text, enough to see that they were working with a message of the utmost importance. Montgomery and de Grey persevered with their task, and within a few days they could discern the outline of Zimmermann’s terrible plans. They realized the dreadful implications of the new German naval offensive, but at the same time they could see that the German foreign minister was encouraging an attack on America, which was likely to provoke President Wilson into abandoning Americas neutrality. The telegram contained the deadliest of threats, but also the possibility of America joining the Allies.
Montgomery and de Grey took the deciphered telegram to Admiral Sir William Hall, director of naval intelligence, expecting him to pass the information to the Americans, thereby drawing them into the war. However, Admiral Hall merely placed the decipherment in his safe. He reckoned that there was no point in releasing the telegram if the German naval offensive would in any case draw America into the war.
On February 1, as ordered by the Kaiser, Germany instigated the new offensive. On February 2, Woodrow Wilson held a cabinet meeting to decide the American response. On February 3, he spoke to Congress and announced that America would continue to remain neutral, acting as a peacemaker, not a combatant. This was contrary to Allied and German expectations. American reluctance to join the Allies left Admiral Hall with no choice but to exploit the Zimmermann telegram.
On February 23, Arthur Balfour, the British secretary of state for foreign affairs, summoned the American ambassador, Walter Page, and presented him with the Zimmermann telegram, later calling this “the most dramatic moment in all my life”. Four days later, President Wilson saw for himself the “eloquent evidence”, as he called it, proof that Germany was encouraging direct aggression against America.
At the beginning of the year, Wilson had said that it would be a “crime against civilization” to lead his nation to war, but by April 2, 1917, he had changed his mind: “I advise that the Congress declare the recent course of the Imperial German Government to be in fact nothing less than war against the government and people of the United States, and that it formally accept the status of belligerent which has thus been thrust upon it.” A single breakthrough by Room 40 cryptanalysts had succeeded where three years of intensive diplomacy had failed. Barbara Tuchman, American historian and author of The Zimmermann Telegram, offered the following analysis:
Had the telegram never been intercepted or never been published, inevitably the Germans would have done something else that would have brought us in eventually. But the time was already late and, had we delayed much longer, the Allies might have been forced to negotiate. To that extent the Zimmermann telegram altered the course of history…. In itself the Zimmermann telegram was only a pebble on the long road of history. But a pebble can kill a Goliath, and this one killed the American illusion that we could go about our business happily separate from other nations. In world affairs it was a German Minister’s minor plot. In the lives of the American people it was the end of innocence.
The First World War saw a series of victories for codebreakers, culminating in the decipherment of the Zimmermann telegram. Ever since the cracking of the Vigenère cipher in the nineteenth century, codebreakers had maintained the upper hand over the codemakers. In the years following the war, there was a concerted effort to find new, secure encryption systems. Cryptographers turned to technology to help guarantee security. Rather than relying on pencil-and-paper ciphers, they focused their attention on the mechanization of secrecy.
Although primitive, the earliest cryptographic machine was the cipher disc, invented in the fifteenth century by the Italian architect Leon Alberti, one of the fathers of the polyalphabetic cipher. He took two copper discs, one slightly larger than the other, and inscribed the alphabet around the edge of both. By placing the smaller disc on top of the larger one and fixing them with a needle to act as an axis, he constructed something similar to the cipher disc shown in Figure 25. The two discs can be independently rotated so that the two alphabets can have different relative positions, and can thus be used to encrypt a message with a simple Caesar shift. For example, to encrypt a message with a Caesar shift of one place, position the outer A next to the inner B – the outer disc is the plain alphabet, and the inner disc represents the cipher alphabet. Each letter in the plaintext message is looked up on the outer disc, and the corresponding letter on the inner disc is written down as part of the ciphertext. To send a message with a Caesar shift of five places, simply rotate the discs so that the outer A is next to the inner F, and then use the cipher disc in its new setting. Even though the cipher disc is a very basic device, it does ease encipherment, and it endured for five centuries. The version shown in a Figure 25 was used in the American Civil War.
The cipher disc can be thought of as a scrambler, taking each plaintext letter and transforming it into something else. The mode of operation described so far is straightforward, and the resulting cipher is relatively simple to break, but the cipher disc can be used in a more complicated way. Its inventor, Alberti, suggested changing the setting of the disc during the message, which in effect generates a polyalphabetic cipher instead of a monoalphabetic cipher. For example, Alberti could have used his disc to encipher the word goodbye, using the keyword LEON. He would begin by setting his disc according to the first letter of the keyword, moving the outer A next to the inner L. Then he would encipher the first letter of the message, g, by finding it on the outer disc and noting the corresponding letter on the inner disc, which is R. To encipher the second letter of the message, he would reset his disc according to the second letter of the keyword, moving the outer A next to the inner E. Then he would encipher o by finding it on the outer disc and noting the corresponding letter on the inner disc, which is S. The encryption process continues with the cipher disc being set according to the keyletter O, then N, then back to L, and so on. Alberti has effectively encrypted a message using the Vigenère cipher with his first name acting as the keyword. The cipher disc speeds up encryption and reduces errors compared with performing the encryption via a Vigenère square.
The important feature of using the cipher disc in this way is the fact that the disc is changing its mode of scrambling during encryption. Although this extra level of complication makes the cipher harder to break, it does not make it unbreakable, because we are simply dealing with a mechanized version of the Vigenère cipher, and the Vigenère cipher was broken by Babbage and Kasiski. However, five hundred years after Alberti, a more complex reincarnation of his cipher disc would lead to a new generation of ciphers, an order of magnitude more difficult to crack than anything previously used.
In 1918, the German inventor Arthur Scherbius and his close friend Richard Ritter founded the company of Scherbius & Ritter, an innovative engineering firm that dabbled in everything from turbines to heated pillows. Scherbius was in charge of research and development, and was constantly looking for new opportunities. One of his pet projects was to replace the inadequate systems of cryptography used in the First World War by swapping traditional codes and ciphers with a form of encryption that exploited twentieth-century technology. Having studied electrical engineering in Hanover and Munich, he developed a piece of cryptographic machinery that was essentially an electrical version of Alberti’s cipher disc. Called Enigma, Scherbius’ invention would become the most fearsome system of encryption in history.
Scherbius’ Enigma machine consisted of a number of ingenious components, which he combined into a formidable and intricate cipher machine. However, if we break the machine down into its constituent parts and rebuild it in stages, then its underlying principles will become apparent. The basic form of Scherbius’ invention consists of three elements connected by wires: a keyboard for inputting each plaintext letter, a scrambling unit that encrypts each plaintext letter into a corresponding ciphertext letter, and a display board consisting of various lamps for indicating the ciphertext letter. Figure 26 shows a stylized layout of the machine, limited to a six-letter alphabet for simplicity. In order to encrypt a plaintext letter, the operator presses the appropriate plaintext letter on the keyboard, which sends an electric pulse through the central scrambling unit and out the other side, where it illuminates the corresponding ciphertext letter on the lampboard.
The scrambler, a thick disc riddled with wires, is the most important part of the machine. From the keyboard, the wires enter the scrambler at six points, and then make a series of twists and turns within the scrambler before emerging at six points on the other side. The internal wirings of the scrambler determine how the plaintext letters will be encrypted. For example, in Figure 26 the wirings dictate that:
Typing in a will illuminate the letter B, which means that a is encrypted as B
Typing in b will illuminate the letter A, which means that b is encrypted as A
Typing in c will illuminate the letter D, which means that C is encrypted as D
Typing in d will illuminate the letter F, which means that d is encrypted as F
Typing in e will illuminate the letter E, which means that e is encrypted as E
Typing in f will illuminate the letter C, which means that f is encrypted as C
The message cafe would be encrypted as DBCE. With this basic setup, the scrambler essentially defines a cipher alphabet, and the machine can be used to implement a simple monoalphabetic substitution cipher.
However, Scherbius’ idea was for the scrambler disc to automatically rotate by one-sixth of a revolution each time a letter is encrypted (or one-twenty-sixth of a revolution for a complete alphabet of twenty-six letters). Figure 27(i) shows the same arrangement as in Figure 26; once again, typing in the letter b will illuminate the letter A. However, this time, immediately after typing a letter and illuminating the lampboard, the scrambler revolves by one-sixth of a revolution to the position shown in Figure 27(ii). Typing in the letter b again will now illuminate a different letter, namely, C. Immediately afterwards, the scrambler rotates once more, to the position shown in Figure 27(iii). This time, typing in the letter b will illuminate E. Typing the letter b six times in a row would generate the ciphertext ACEBDC. In other words, the cipher alphabet changes after each encryption, and the encryption of the letter b is constantly changing. With this rotating setup, the scrambler essentially defines six cipher alphabets, and the machine can be used to implement a polyalphabetic cipher.
The rotation of the scrambler is the most important feature of Scherbius’ design. However, as it stands, the machine suffers from one obvious weakness. Typing b six times will return the scrambler to its original position, and typing b again and again will repeat the pattern of encryption. In general, cryptographers try to avoid repetition because it leads to regularity and structure in the ciphertext, symptoms of a weak cipher. This problem can be alleviated by introducing a second scrambler disc.
Figure 28 is a schematic of a cipher machine with two scramblers. Because of the difficulty of drawing a three-dimensional scrambler with three-dimensional internal wirings, Figure 28 shows only a two-dimensional representation. Each time a letter is encrypted, the first scrambler rotates by one space, or in terms of the two-dimensional diagram, each wiring shifts down one place. In contrast, the second scrambler disc remains stationary for most of the time. It moves only after the first scrambler has made a complete revolution. You could imagine that the first scrambler is fitted with a tooth, and it is only when this tooth reaches a certain point that it knocks the second scrambler forwards one place.
Figure 28(i), the first scrambler is in a position where it is just about to knock forward the second scrambler. Typing in and encrypting a letter moves the mechanism to the configuration shown in Figure 28(ii), in which the first scrambler has moved one place, and the second scrambler has also been knocked forwards one place. Typing in and encrypting another letter again moves the first scrambler forwards one place, Figure 28(iii), but this time the second scrambler has remained stationary. The second scrambler will not move again until the first scrambler completes one revolution, which will take another five encryptions. This arrangement is similar to a car odometer – the rotor representing tenths of miles turns quite quickly, and when it completes one revolution by reaching 9, it knocks the rotor representing single miles forwards one place.
The advantage of adding a second scrambler is that the pattern of encryption is not repeated until the second scrambler is back where it started, which requires six complete revolutions of the first scrambler, or the encryption of 6 x 6, or 36 letters in total. In other words, there are 36 distinct scrambler settings, which is equivalent to switching between 36 cipher alphabets. With a full alphabet of 26 letters, the cipher machine would switch between 26 x 26, or 676 cipher alphabets. So by combining scramblers (sometimes called rotors), it is possible to build an encryption machine that is switching between a greater number of cipher alphabets. The operator types in a particular letter, which, depending on the scrambler arrangement, can be encrypted according to any one of hundreds of cipher alphabets. Then the scrambler arrangement changes, so that when the next letter is typed into the machine, it is encrypted according to a different cipher alphabet. Furthermore, all of this is done with great efficiency and accuracy, thanks to the automatic movement of scramblers and the speed of electricity.
Before explaining in detail how Scherbius intended his encryption machine to be used, it is necessary to describe two more elements of the Enigma, which are shown in Figure 29. First, Scherbius’ standard encryption machine employed a third scrambler for extra complexity – for a full alphabet these three scramblers would provide 26 x 26 x 26, or 17,576, distinct scrambler arrangements. Second, Scherbius added a reflector. The reflector is a bit like a scrambler, inasmuch as it is a disc with internal wirings, but it differs because it does not rotate and the wires enter on one side and then re-emerge on the same side. With the reflector in place, the operator types in a letter, which sends an electrical signal through the three scramblers. When the reflector receives the incoming signal it sends it back through the same three scramblers, but along a different route. For example, with the setup in Figure 29, typing the letter b would send a signal through the three scramblers and into the reflector, whereupon the signal would return back through the wirings to arrive at the letter D. The signal does not actually emerge through the keyboard, as it might seem from Figure 29, but instead is diverted to the lampboard. At first sight the reflector seems to be a pointless addition to the machine, because its static nature means that it does not add to the number of cipher alphabets. However, its benefits become clear when we see how the machine was actually used to encrypt and decrypt a message.
Imagine that an operator wants to send a secret message. Before encryption begins, he must first rotate the scramblers to some starting position. There are 17,576 possible arrangements and therefore 17,576 possible starting positions. The initial setting of the scramblers will determine how the message is encrypted. We can think of the Enigma machine in terms of a general cipher system, and the initial settings are what determine the exact details of the encryption. In other words, the initial settings provide the key. The initial settings are usually dictated by a codebook, which lists the key for each day, and which is available to everybody within the communications network. Distributing the codebook requires time and effort, but because only one key per day is required, it could be arranged for a codebook containing twenty-eight keys to be sent out just once every four weeks. Once the scramblers have been set according to the codebook’s daily requirement, the sender can begin encrypting. He types in the first letter of the message, sees which letter is illuminated on the lampboard and notes it down as the first letter of the ciphertext. Then, the first scrambler having automatically stepped forwards by one place, the sender inputs the second letter of the message, and so on. Once he has generated the complete ciphertext, he hands it to a radio operator, who transmits it to the intended receiver.
In order to decipher the message, the receiver needs to have another Enigma machine and a copy of the codebook that contains the initial scrambler settings for that day. He sets up the machine according to the book, types in the ciphertext letter by letter, and the lampboard indicates the plaintext. In other words, the sender types in the plaintext to generate the ciphertext, and then the receiver types in the ciphertext to generate the plaintext – encipherment and decipherment are mirror processes. The ease of decipherment is a consequence of the reflector. From Figure 29 we can see that if we type in b and follow the electrical path, we come back to D. Similarly, if we type in D and follow the path, then we come back to b. The machine encrypts a plaintext letter into a ciphertext letter, and as long as the machine is in the same setting, it will decrypt the ciphertext letter back into the plaintext letter.
It is clear that the key, and the codebook that contains it, must never be allowed to fall into enemy hands. It is quite possible that the enemy might capture an Enigma machine, but without knowing the initial settings used for encryption, they cannot easily decrypt an intercepted message. Without the codebook, the enemy cryptanalyst must resort to checking all the possible keys, which means trying all the 17,576 possible initial scrambler settings. The desperate cryptanalyst will set up the captured Enigma machine with a particular scrambler arrangement, input a short piece of the ciphertext, and see if the output makes any sense. If not, he will change to a different scrambler arrangement and try again. If he can check one scrambler arrangement each minute and works night and day, it will take almost two weeks to check all the settings. This is a moderate level of security, but if the enemy sets a dozen people on the task, then all the settings can be checked within a day. Scherbius therefore decided to improve the security of his invention by increasing the number of initial settings and thus the number of possible keys.
He could have increased security by adding more scramblers (each new scrambler increases the number of keys by a factor of twenty-six), but this would have increased the size of the Enigma machine. Instead, he added two other features. First, he simply made the scramblers removable and interchangeable. So, for example, the first scrambler disc could be moved to the third position, and the third scrambler disc to the first position. The arrangement of the scramblers affects the encryption, so the exact arrangement is crucial to encipherment and decipherment. There are six different ways to arrange the three scramblers, so this feature increases the number of keys, or the number of possible initial settings, by a factor of six.
The second new feature was the insertion of a plugboard between the keyboard and the first scrambler. The plugboard allows the sender to insert cables that have the effect of swapping some of the letters before they enter the scrambler. For example, a cable could be used to connect the a and b sockets of the plugboard, so that when the cryptographer wants to encrypt the letter b, the electrical signal actually follows the path through the scramblers that previously would have been the path for the letter a, and vice versa. The Enigma operator had six cables, which meant that six pairs of letters could be swapped, leaving fourteen letters unplugged and unswapped. The letters swapped by the plugboard are part of the machine’s setting, and so must be specified in the codebook. Figure 30 shows the layout of the machine with the plugboard in place. Because the diagram deals only with a six-letter alphabet, only one pair of letters, a and b, have been swapped.
Now that we know all the main elements of Scherbius’ Enigma machine, we can work out the number of keys by combining the number of possible plugboard cablings with the number of possible scrambler arrangements and orientations. The following list shows each variable of the machine and the corresponding number of possibilities for each one:
Scrambler orientations. Each of the three scramblers can be set in one of 26 orientations. There are therefore 26 x 26 x 26 settings:
17,576
Scrambler arrangements. The three scramblers (1, 2 and 3) can be positioned in any of the following six orders: 123,132, 213, 231, 312, 321:
6
Plugboard. The number of ways of connecting, thereby swapping, 6 pairs of letters out of 26 is enormous:
100,391,791,500
Total. The total number of keys is the multiple of these three numbers: 17,576 x 6 x 100,391,791,500
=10,000,000,000,000,000
As long as sender and receiver have agreed on the plugboard cablings, the order of the scramblers and their respective orientations, all of which specify the key, they can encrypt and decrypt messages easily. However, an enemy interceptor who does not know the key would have to check every single one of the 10,000,000,000,000,000 possible keys in order to crack the ciphertext. To put this into context, a persistent cryptanalyst who is capable of checking one setting every minute would need longer than the age of the universe to check every setting. (In fact, I have ignored the effect of one aspect of the Enigma machine, known as the ring setting, so the number of possible keys is even larger, and the time to break Enigma even longer.)
Since by far the largest contribution to the number of keys comes from the plugboard, you might wonder why Scherbius bothered with the scramblers. On its own, the plugboard would provide a trivial cipher, because it would do nothing more than act as a monoalphabetic substitution cipher, just swapping around a few letters. The problem with the plugboard is that the swaps do not change once encryption begins, so on its own it would generate a ciphertext that could be broken by frequency analysis. The scramblers contribute a smaller number of keys, but their setup is continually changing, which means that the resulting ciphertext cannot be broken by frequency analysis. By combining the scramblers with the plugboard, Scherbius protected his machine against frequency analysis, and at the same time gave it an enormous number of possible keys.
Scherbius took out his first patent in 1918. His cipher machine was contained in a compact box measuring only 34x28x14cm, but it weighed a hefty twelve kilos. Figure 32 shows an Enigma machine with the outer lid open, ready for use. It is possible to see the keyboard where the plaintext letters are typed in, and above it the lampboard, which displays the resulting ciphertext letter. Below the keyboard is the plugboard; there are more than six pairs of letters swapped by the plugboard, because this particular Enigma machine is a slightly later modification of the original model, which is the version that has been described so far. Figure 33 shows an Enigma with the cover plate removed to reveal more features, in particular the three scramblers.
Scherbius believed his cipher machine was invincible, and because the memories of security failures haunted the German military, he soon persuaded them to adopt Enigma. By 1925 Scherbius began mass-producing Enigmas, which went into military service the following year. They were subsequently used by the government and by state-run organizations such as the railways.
Over the next two decades, the German military would buy over thirty thousand Enigma machines. Scherbius’ invention provided the most secure system of cryptography in the world, and at the outbreak of the Second World War the German military’s communications were protected by an unparalleled level of encryption. At times, it seemed that the Enigma machine would play a vital role in ensuring Nazi victory, but instead it was ultimately part of Hitler’s downfall. Scherbius did not live long enough to see the successes and failures of his cipher system. In 1929, while driving a team of horses, he lost control of his carriage and crashed into a wall, dying on May 13 from internal injuries.
In the years that followed the First World War, the British cryptanalysts in Room 40 continued to monitor German communications. In 1926 they began to intercept messages that baffled them completely. Enigma had arrived, and as the number of Enigma machines increased, Room 40’s ability to gather intelligence diminished rapidly. The Americans and the French also tried to tackle the Enigma cipher, but their attempts were equally dismal, and they soon gave up hope of breaking it. Germany now had the most secure communications in the world.
The speed with which the Allied cryptanalysts abandoned hope of breaking Enigma was in sharp contrast to their perseverance just a decade earlier in the First World War. Confronted with the prospect of defeat, the Allied cryptanalysts had worked night and day to penetrate German ciphers. It would appear that fear was the main driving force, and that adversity is one of the foundations of successful codebreaking. However, in the wake of the First World War the Allies no longer feared anybody. Germany had been crippled by defeat, and the Allies were in a dominant position; as a result, they seemed to lose their cryptanalytic zeal.
One nation, however, could not afford to relax. After the First World War, Poland re-established itself as an independent state, but it was concerned about threats to its new-found sovereignty. To the east lay Russia, a nation ambitious to spread its communism, and to the west lay Germany, intent upon regaining territory ceded to Poland after the war. Sandwiched between these two enemies, the Poles were desperate for intelligence information, and they formed a new cipher bureau, the Biuro Szyfrów. If necessity is the mother of invention, then perhaps adversity is the mother of cryptanalysis.
In charge of deciphering German messages was Captain Maksymilian Ciezki, a committed patriot who had grown up in the town of Szamotuly, a centre of Polish nationalism. Ciezki had no access to a military Enigma machine, and without knowing the wirings of the military machine, he had no chance of deciphering messages being sent by the German army. He became so despondent that at one point he even employed a clairvoyant in a frantic attempt to conjure some sense from the enciphered intercepts. Not surprisingly, the clairvoyant failed to make the breakthrough the Biuro Szyfrów needed. Instead, it was left to a disaffected German, Hans-Thilo Schmidt, to make the first step towards breaking the Enigma cipher.
Hans-Thilo Schmidt was born in 1888 in Berlin, the second son of a distinguished professor and his aristocratic wife. Schmidt embarked on a career in the German army and fought in the First World War, but he was not considered worthy enough to remain in the army after the drastic cuts implemented as part of the Treaty of Versailles. He then tried to make his name as a businessman, but his soap factory was forced to close because of the postwar depression and hyperinflation, leaving him and his family destitute.
The humiliation of Schmidt’s failures was compounded by the success of his elder brother, Rudolph, who had also fought in the war, and who was retained in the army afterwards. During the 1920s Rudolph rose through the ranks and was eventually promoted to Chief of Staff of the Signal Corps. He was responsible for ensuring secure communications, and in fact it was Rudolph who officially sanctioned the army’s use of the Enigma cipher.
After his business collapsed, Hans-Thilo was forced to ask his brother for help, and Rudolph arranged a job for him in Berlin at the Chiffrierstelle, the office responsible for administering Germany’s encrypted communications. This was Enigmas command centre, a top-secret establishment dealing with highly sensitive information. When Hans-Thilo moved to his new job, he left his family behind in Bavaria, where the cost of living was affordable. He was living alone in expensive Berlin, impoverished and isolated, envious of his perfect brother and resentful towards a nation that had rejected him. The result was inevitable. By selling secret Enigma information to foreign powers, Hans-Thilo Schmidt could earn money and gain revenge, damaging his country’s security and undermining his brother’s organization.
On November 8, 1931, Schmidt arrived at the Grand Hotel in Verviers, Belgium, for a liaison with a French secret agent code-named Rex. In exchange for 10,000 marks (equivalent to $30,000 in today’s money), Schmidt allowed Rex to photograph two documents: “Gebrauchsanweisung für die Chiffriermaschine Enigma” and “Schlüsselanleitung fur die Chiffriermaschine Enigma”. These documents were essentially instructions for using the Enigma machine, and although there was no explicit description of the wirings inside each scrambler, they contained the information needed to deduce those wirings.
Thanks to Schmidt’s treachery, it was now possible for the Allies to create an accurate replica of the German military Enigma machine. However, this was not enough to enable them to decipher messages encrypted by Enigma. The strength of the cipher depends not on keeping the machine secret, but on keeping the initial setting of the machine (the key) secret. If a cryptanalyst wants to decipher an intercepted message, then, in addition to having a replica of the Enigma machine, he still has to find which of the millions of billions of possible keys was used to encipher it. A German memorandum put it thus: “It is assumed in judging the security of the cryptosystem that the enemy has at his disposition the machine.”
The French secret service was clearly up to scratch, having found an informant in Schmidt, and having obtained the documents that suggested the wirings of the military Enigma machine. In comparison, French cryptanalysts were inadequate, and seemed unwilling and unable to exploit this newly acquired information. The Bureau du Chiffre did not even bother trying to build a replica of the military Enigma machine, because they were convinced that achieving the next stage, finding the key required to decipher a particular Enigma message, was impossible.
As it happened, ten years earlier the French had signed an agreement of military cooperation with the Poles. The Poles had expressed an interest in anything connected with Enigma, so in accordance with their decade-old agreement the French simply handed the photographs of Schmidt’s documents to their allies and left the hopeless task of cracking Enigma to the Biuro Szyfrów. The Biuro realized that the documents were only a starting point, but unlike the French, they had the fear of invasion to spur them on. The Poles convinced themselves that there must be a shortcut to finding the key to an Enigma-encrypted message and that if they applied sufficient effort, ingenuity and wit, they could find that shortcut.
As well as revealing the internal wirings of the scramblers, Schmidt’s documents also explained in detail the layout of the codebooks used by the Germans. Each month, Enigma operators received a new codebook, which specified which key should be used for each day. For example, on the first day of the month, the codebook might specify the following day key:
1. Plugboard settings: | A/L - P/R - T/D – B/W – K/F – O/Y |
2. Scrambler arrangement: | 2–3–1 |
3. Scrambler orientations: | Q-C-W |
Together, the scrambler arrangement and orientations are known as the scrambler settings. To implement this particular day key, the Enigma operator would set up his Enigma machine as follows:
1. Plugboard settings: Swap the letters A and L by connecting them via a lead on the plugboard, and similarly swap P and R, then T and D, then B and W, then K and F, and lastly O and Y.
2. Scrambler arrangement: Place the second scrambler in the first slot of the machine, the third scrambler in the second slot and the first scrambler in the third slot.
3. Scrambler orientations: Each scrambler has an alphabet engraved on its outer rim, which allows the operator to set it in a particular orientation. In this case, the operator would rotate the scrambler in slot 1 so that Q is facing upwards, rotate the scrambler in the second slot so that C is facing upwards, and rotate the scrambler in the third slot so that W is facing upwards.
One way of encrypting messages would be for the sender to encrypt all the day’s traffic according to the day key. This would mean that for a whole day all Enigma operators would set their machines according to the same day key. Then, each time a message needed to be sent, it would be typed into the machine; the enciphered output would be recorded and handed to the radio operator for transmission. At the other end, the receiving radio operator would record the incoming message and hand it to the Enigma operator, who would type it into his machine, which would already be set to the same day key. The output would be the original message.
This process is reasonably secure, but it is weakened by the repeated use of a single day key to encrypt the hundreds of messages that might be sent each day. In general, it is true that if a single key is used to encipher an enormous quantity of material, then it is easier for a cryptanalyst to deduce it. A large amount of identically encrypted material provides a cryptanalyst with a correspondingly larger chance of identifying the key. For example, harking back to simpler ciphers, it is much easier to break a monoalphabetic cipher with frequency analysis if there are several pages of encrypted material, as opposed to just a couple of sentences.
As an extra precaution, the Germans therefore took the clever step of using the day key settings to transmit a new message key for each message. The message keys would have the same plugboard settings and scrambler arrangement as the day keys but different scrambler orientations. Because the new scrambler orientation would not be in the codebook, the sender had to transmit it securely to the receiver according to the following process. First, the sender sets his machine according to the agreed day key, which includes a scrambler orientation, say, QCW. Next, he randomly picks a new scrambler orientation for the message key, say, PGH. He then enciphers PGH according to the day key. The message key is typed into the Enigma twice, just to provide a double check for the receiver. For example, the sender might encipher the message key PGHPGH as KIVBJE. Note that the two PGH’s are enciphered differently (the first as KIV, the second as BJE), because the Enigma scramblers are rotating after each letter, and changing the overall mode of encryption. The sender then changes his machine to the PGH setting and encrypts the main message according to this message key. At the receivers end, the machine is initially set according to the day key, QCW. The first six letters of the incoming message, KIVBJE, are typed in and reveal PGHPGH. The receiver then knows to reset his scramblers to PGH, the message key, and can then decipher the main body of the message.
This is equivalent to the sender and receiver agreeing on a main cipher key. Then, instead of using this single main cipher key to encrypt every message, they use it merely to encrypt a new cipher key for each message, and then encrypt the actual message according to the new cipher key. Had the Germans not employed message keys, then everything – perhaps thousands of messages containing millions of letters – would have been sent using the same day key. However, if the day key is used only to transmit the message keys, then it encrypts only a limited amount of text. If there are one thousand message keys sent in a day, then the day key encrypts only six thousand letters. And because each message key is picked at random and is used to encipher only one message, it encrypts a limited amount of text, perhaps just a few hundred characters.
At first sight the system seemed to be invulnerable, but the Polish cryptanalysts were undaunted. They were prepared to explore every avenue in order to find a weakness in the Enigma machine and its use of day and message keys. The Biuro organized a course on cryptography and invited twenty mathematicians, each of them sworn to an oath of secrecy. The mathematicians were all from the university at Poznán. Although not the most respected academic institution in Poland, it had the advantage of being located in the west of the country, in territory that had been part of Germany until 1918. These mathematicians were therefore fluent in German.
Three of the twenty demonstrated an aptitude for solving ciphers and were recruited into the Biuro. The most gifted of them was a young man called Marian Rejewski, a timid twenty-three-year-old who had previously studied statistics in order to pursue a career in insurance.
Rejewski’s strategy for attacking Enigma focused on the fact that repetition is the enemy of security: repetition leads to patterns, and cryptanalysts thrive on patterns. The most obvious repetition in the Enigma encryption was the message key, which was enciphered twice at the beginning of every message. If the operator chose the message key ULJ, then he would encrypt it twice, so that ULJULJ might be enciphered as PEFNWZ, which he would then send at the start before the actual message. The Germans had demanded this repetition in order to avoid mistakes caused by radio interference or operator error. But they did not foresee that this would jeopardize the security of the machine.
Each day, Rejewski would find himself with a new batch of intercepted messages. They all began with the six letters of the repeated three-letter message key, all encrypted according to the same agreed day key. For example, he might receive four messages that began with the following encrypted message keys:
In each message, the first and fourth letters are encryptions of the same letter, namely, the first letter of the message key. Also, the second and fifth letters are encryptions of the same letter, namely, the second letter of the message key, and the third and sixth letters are encryptions of the same letter, namely, the third letter of the message key. For example, in the first message, L and R are encryptions of the same letter, the first letter of the message key. The reason why this same letter is encrypted differently, first as L and then as R, is that between the two encryptions the first Enigma scrambler has moved on three steps, changing the overall mode of scrambling.
The fact that L and R are encryptions of the same letter allowed Rejewski to deduce some slight constraint on the initial setup of the machine. The initial scrambler setting, which is unknown, encrypted the first letter of the day key, which is also unknown, into L, and then another scrambler setting, three steps forward from the initial setting, which is still unknown, encrypted the same letter of the day key, which is also still unknown, into R.
This constraint might seem vague, as it is full of unknowns, but at least it demonstrates that the letters L and R are intimately related by the initial setting of the Enigma machine, the day key. As each new message is intercepted, it is possible to identify other relationships between the first and fourth letters of the repeated message key. All these relationships are reflections of the initial setting of the Enigma machine. For example, the second message above tells us that M and X are related, the third tells us that J and M are related, and the fourth that D and P are related. Rejewski began to summarize these relationships by tabulating them. For the four messages we have so far, the table would reflect the relationships between (L,R), (M,X), (J,M) and (D,P):
If Rejewski had access to enough messages in a single day, then he would be able to complete the alphabet of relationships. The following table shows such a completed set of relationships:
Rejewski had no idea of the day key, and he had no idea which message keys were being chosen, but he did know that they resulted in this table of relationships. Had the day key been different, then the table of relationships would have been completely different. The next question was whether there existed any way of determining the day key by looking at the table of relationships. Rejewski began to look for patterns within the table, structures that might indicate the day key. Eventually, he began to study one particular type of pattern, which featured chains of letters. For example, in the table, A on the top row is linked to F on the bottom row, so next he would look up F on the top row. It turns out that F is linked to W, and so he would look up W on the top row. And it turns out that W is linked to A, which is where we started. The chain has been completed.
With the remaining letters in the alphabet, Rejewski would generate more chains. He listed all the chains, and noted the number of links in each one:
So far, we have only considered the links between the first and fourth letters of the six-letter repeated key. In fact, Rejewski would repeat this whole exercise for the relationships between the second and fifth letters, and the third and sixth letters, identifying the chains in each case and the number of links in each chain.
Rejewski noticed that the chains changed each day. Sometimes there were lots of short chains, sometimes just a few long chains. And, of course, the letters within the chains changed. The characteristics of the chains were clearly a result of the day key setting – a complex consequence of the plugboard settings, the scrambler arrangement and the scrambler orientations. However, there remained the question of how Rejewski could determine the day key from these chains. Which of 10,000,000,000,000,000 possible day keys was related to a particular pattern of chains? The number of possibilities was simply too great.
It was at this point that Rejewski had a profound insight. Although the plugboard and scrambler settings both affect the details of the chains, their contributions can to some extent be disentangled. In particular, there is one aspect of the chains that is wholly dependent on the scrambler settings and has nothing to do with the plugboard settings: the number of links in the chains, which is purely a consequence of the scrambler settings. For instance, let us take the example above and pretend that the day key required the letters S and G to be swapped as part of the plugboard settings. If we change this element of the day key, by removing the cable that swaps S and G, and use it to swap, say, T and K instead, then the chains would change to the following:
Some of the letters in the chains have changed, but, crucially, the number of links in each chain remains constant. Rejewski had identified a facet of the chains that was solely a reflection of the scrambler settings.
The total number of scrambler settings is the number of scrambler arrangements (6) multiplied by the number of scrambler orientations (17,576), which comes to 105,456. So, instead of having to worry about which of the 10,000,000,000,000,000 day keys was associated with a particular set of chains, Rejewski could busy himself with a drastically simpler problem: Which of the 105,456 scrambler settings was associated with the number of links within a set of chains? This number is still large, but it is roughly one hundred billion times smaller than the total number of possible day keys. In short, the task has become one hundred billion times easier, certainly within the realm of human endeavour.
Rejewski proceeded as follows. Thanks to Hans-Thilo Schmidt’s espionage, he had access to replica Enigma machines. His team began the laborious chore of checking each of 105,456 scrambler settings and cataloguing the chain lengths that were generated by each one. It took an entire year to complete the catalogue, but once the Biuro had accumulated the data, Rejewski could finally begin to unravel the Enigma cipher.
Each day, he would look at the encrypted message keys, the first six letters of all the intercepted messages, and use the information to build his table of relationships. This would allow him to trace the chains and establish the number of links in each chain. For example, analyzing the first and fourth letters might result in four chains with three, nine, seven and seven links. Analyzing the second and fifth letters might also result in four chains, with two, three, nine and twelve links. Analyzing the third and sixth letters might result in five chains with five, five, five, three and eight links. As yet, Rejewski still had no idea of the day key, but he knew that it resulted in three sets of chains with the following number of chains and links in each one:
4 chains from the 1st and 4th letters, with 3, 9, 7 and 7 links
4 chains from the 2nd and 5th letters, with 2, 3, 9 and 12 links
5 chains from the 3rd and 6th letters, with 5, 5, 5, 3 and 8 links
Rejewski could now go to his catalogue, which contained every scrambler setting indexed according to the sort of chains it would generate. Having found the catalogue entry that contained the right number of chains with the appropriate number of links in each one, he immediately knew the scrambler settings for that particular day key. The chains were effectively fingerprints, the evidence that betrayed the initial scrambler arrangement and orientations. Rejewski was working just like a detective who might find a fingerprint at the scene of a crime and then use a database to match it to a suspect.
Although he had identified the scrambler part of the day key, Rejewski still had to establish the plugboard settings. There are about a hundred billion possibilities for the plugboard settings, but this was a relatively straightforward task. Rejewski would begin by setting the scramblers in his Enigma replica according to the newly established scrambler part of the day key. He would then remove all cables from the plugboard, so that the plugboard had no effect. Finally, he would take a piece of intercepted ciphertext and type it into the Enigma machine. This would largely result in gibberish, because the plugboard cablings were unknown and missing. However, every so often vaguely recognizable phrases would appear, such as alliveinbelrin – presumably, this should be “arrive in Berlin”. If this assumption is correct, then it would imply that the letters R and L should be connected and swapped by a plugboard cable, while A, I, V, E, B and N should not. By analyzing other phrases, it would be possible to identify the other five pairs of letters that had been swapped by the plugboard. Having established the plugboard settings, and having already discovered the scrambler settings, Rejewski had the complete day key, and could then decipher any message sent that day.
Rejewski had vastly simplified the task of finding the day key by divorcing the problem of finding the scrambler settings from the problem of finding the plugboard settings. On their own, both of these problems were solvable. Originally, we estimated that it would take more than the lifetime of the universe to check every possible Enigma key. However, Rejewski had spent only a year compiling his catalogue of chain lengths, and thereafter he could find the day key before the day was out. Once he had the day key, he possessed the same information as the intended receiver and so could decipher messages just as easily.
Following Rejewski’s breakthrough, German communications became transparent. Poland was not at war with Germany, but there was a threat of invasion, so Polish relief at conquering Enigma was nevertheless immense. If they could find out what the German generals had in mind for them, there was a chance that they could defend themselves. The Polish nation had depended on Rejewski, and he did not disappoint his country. Rejewski’s attack on Enigma is one of the truly great accomplishments of cryptanalysis. I have had to sum up his work in just a few pages, and so have omitted many of the technical details, and all of the dead ends. Enigma is a complicated cipher machine, and breaking it required immense intellectual force. My simplifications should not mislead you into underestimating Rejewski’s extraordinary achievement.
The Polish success in breaking the Enigma cipher can be attributed to three factors: fear, mathematics and espionage. Without the fear of invasion, the Poles would have been discouraged by the apparent invulnerability of the Enigma cipher. Without mathematics, Rejewski would not have been able to analyze the chains. And without Schmidt, code-named Asche, and his documents, the wirings of the scramblers would not have been known, and cryptanalysis could not even have begun. Rejewski did not hesitate to express the debt he owed Schmidt: “Asche’s documents were welcomed like manna from heaven, and all doors were immediately opened.”
The Poles successfully used Rejewski’s technique for several years. When Hermann Göring visited Warsaw in 1934, he was totally unaware of the fact that his communications were being intercepted and deciphered. As he and other German dignitaries laid a wreath at the Tomb of the Unknown Soldier next to the offices of the Biuro Szyfrów, Rejewski could stare down at them from his window, content in the knowledge that he could read their most secret communications.
Even when the Germans made a minor alteration to the way they transmitted messages, Rejewski fought back. His old catalogue of chain lengths was useless, but rather than rewriting the catalogue, he devised a mechanized version of his cataloguing system, which could automatically search for the correct scrambler settings. Rejewski’s invention was an adaptation of the Enigma machine, able to rapidly check each of the 17,576 settings until it spotted a match. Because of the six possible scrambler arrangements, it was necessary to have six of Rejewski’s machines working in parallel, each one representing one of the possible arrangements. Together, they formed a unit that was about one metre high, capable of finding the day key in roughly two hours. The units were called bombes, a name that might reflect the ticking noise they made while checking scrambler settings. Alternatively, it is said that Rejewski got his inspiration for the machines while at a café eating a bombe, an ice cream shaped into a hemisphere. The bombes effectively mechanized the process of decipherment. It was a natural response to Enigma, which was a mechanization of encipherment.
For most of the 1930s, Rejewski and his colleagues worked tirelessly to uncover the Enigma keys. Month after month, the team would have to deal with the stresses and strains of cryptanalysis, continually having to fix mechanical failures in the bombes, continually having to deal with the never-ending supply of encrypted intercepts. Their lives became dominated by the pursuit of the day key, that vital piece of information that would reveal the meaning of the encrypted messages. However, unknown to the Polish codebreakers, much of their work was unnecessary. The chief of the Biuro, Major Gwido Langer, already had the Enigma day keys, but he kept them hidden, tucked away in his desk.
Langer, via the French, was still receiving information from Schmidt. The German spy’s underhanded activities did not end in 1931 with the delivery of the two documents on the operation of Enigma, but continued for another seven years. He met the French secret agent Rex on twenty occasions, often in secluded alpine chalets where privacy was guaranteed. At every meeting, Schmidt handed over one or more codebooks, each one containing a month’s worth of day keys. These were the codebooks that were distributed to all German Enigma operators, and they contained all the information that was needed to encipher and decipher messages. In total, he provided codebooks that contained thirty-eight months’ worth of day keys. The keys would have saved Rejewski an enormous amount of time and effort, eliminating the necessity for bombes and sparing manpower that could have been used in other sections of the Biuro. However, the remarkably astute Langer decided not to tell Rejewski that the keys existed. By depriving Rejewski of the keys, Langer believed he was preparing him for the inevitable time when the keys would no longer be available. He knew that if war broke out, it would be impossible for Schmidt to continue to attend covert meetings, and Rejewski would then be forced to be self-sufficient. Langer thought that Rejewski should practise self-sufficiency in peacetime, as preparation for what lay ahead.
Rejewski’s skills eventually reached their limit in December 1938, when German cryptographers increased Enigma’s security. Enigma operators were all given two new scramblers, so that the scrambler arrangement might involve any three of the five available scramblers. Previously there were only three scramblers (labelled 1, 2 and 3) to choose from, and only six ways to arrange them, but now that there were two extra scramblers (labelled 4 and 5) to choose from, the number of arrangements rose to sixty, as shown in Table 7. Rejewski’s first challenge was to work out the internal wirings of the two new scramblers. More worryingly, he also had to build ten times as many bombes, each representing a different scrambler arrangement. The sheer cost of building such a battery of bombes was fifteen times the Biuro’s entire annual equipment budget. The following month, the situation worsened when the number of plugboard cables increased from six to ten. Instead of twelve letters being swapped before entering the scramblers, there were now twenty swapped letters. The number of possible keys increased to 159,000,000,000,000,000,000.
In 1938, Polish interceptions and decipherments had been at their peak, but by the beginning of 1939, the new scramblers and extra plugboard cables stemmed the flow of intelligence. Rejewski, who had pushed forwards the boundaries of cryptanalysis in previous years, was confounded. He had proved that Enigma was not an unbreakable cipher, but without the resources required to check every scrambler setting, he could not find the day key, and decipherment was impossible. Under such desperate circumstances, Langer might have been tempted to hand over the keys that had been obtained by Schmidt, but the keys were no longer being delivered. Just before the introduction of the new scramblers, Schmidt had broken off contact with the agent Rex. For seven years he had supplied keys that were superfluous because of Polish innovation. Now, just when the Poles needed the keys, they were no longer available.
The new invulnerability of Enigma was a devastating blow to Poland, because Enigma was not merely a means of communication, but was at the heart of Hitler’s Blitzkrieg strategy. The concept of Blitzkrieg (the word means “lightning war”) involved rapid, intense, coordinated attack, which meant that large tank divisions would have to communicate with each other and with infantry and artillery. Furthermore, land forces would be backed up by air support from dive-bombing Stukas, which would rely on effective and secure communication between the front-line troops and the airfields. The philosophy of Blitzkrieg was “speed of attack through speed of communications”. If the Poles could not break Enigma, they had no hope of stopping the German onslaught, which was clearly only a matter of months away. Germany already occupied the Sudetenland, and on April 27, 1939, it withdrew from its nonaggression treaty with Poland. Hitler’s anti-Polish speeches became increasingly vicious. Langer was determined that if Poland was invaded, then its cryptanalytic breakthroughs, which had so far been kept secret from the Allies, should not be lost. If Poland could not benefit from Rejewski’s work, then at least the Allies should have the chance to try to build on it. Perhaps Britain and France, with their extra resources, could fully exploit the concept of the bombe.
On June 30, Major Langer telegraphed his French and British counterparts, inviting them to Warsaw to discuss some urgent matters concerning Enigma. On July 24, senior French and British cryptanalysts arrived at the Biuro’s headquarters, not knowing quite what to expect. Langer ushered them into a room in which stood an object covered with a black cloth. He pulled away the cloth, dramatically revealing one of Rejewski’s bombes. The audience were astonished as they heard how Rejewski had been breaking Enigma for years. The Poles were a decade ahead of anybody else in the world. The French were particularly astonished, because the Polish work had been based on the results of French espionage. The French had handed the information from Schmidt to the Poles because they believed it to be of no value, but the Poles had proved them wrong.
As a final surprise, Langer offered the British and French two spare Enigma replicas and blueprints for the bombes, which were to be shipped in diplomatic bags to Paris. From there, on August 16, one of the Enigma machines was forwarded to London. It was smuggled across the Channel as part of the baggage of the playwright Sacha Guitry and his wife, the actress Yvonne Printemps, so as not to arouse the suspicion of German spies who would be monitoring the ports. Two weeks later, on September 1, Hitler invaded Poland, and the war began.
The Poles had proved that Enigma was not a perfect cipher, and they had also demonstrated to the Allies the value of employing mathematicians as codebreakers. In Britain, Room 40 had always been dominated by linguists and classicists, but now there was a concerted effort to balance the staff with mathematicians and scientists. They were recruited largely via the old-boy network, with those inside Room 40 contacting their former Oxford and Cambridge colleges. There was also an old-girl network that recruited women undergraduates from places such as Newnham College and Girton College, Cambridge.
The new recruits were not brought to Room 40 in London, but instead went to Bletchley Park, Buckinghamshire, the home of the Government Code and Cypher School (GC&CS), a newly formed codebreaking organization that was taking over from Room 40. Bletchley Park could house a much larger staff, which was important because a deluge of encrypted intercepts was expected as soon as the war started. During the First World War, Germany had transmitted two million words a month, but it was anticipated that the greater availability of radios in the Second World War could result in the transmission of two million words a day.
At the centre of Bletchley Park was a large Victorian Tudor-Gothic mansion built by the nineteenth-century financier Sir Herbert Leon. The mansion, with its library, dining hall and ornate ballroom, provided the central administration for the whole of the Bletchley operation. Commander Alastair Denniston, the director of GC&CS, had a ground-floor office overlooking the gardens, a view that was soon spoiled by the construction of numerous huts. These makeshift wooden buildings housed the various codebreaking activities. Initially, Bletchley Park had a staff of only two hundred, but within five years the mansion and the huts would house seven thousand men and women.
During the autumn of 1939, the scientists and mathematicians at Bletchley learned the intricacies of the Enigma cipher and rapidly mastered the Polish techniques. Bletchley had more staff and resources than the Polish Biuro Szyfrów and was thus able to cope with the larger selection of scramblers and the fact that Enigma was now ten times harder to break. Every twenty-four hours, the British codebreakers went through the same routine. At midnight, German Enigma operators would change to a new day key, at which point whatever breakthroughs Bletchley had achieved the previous day could no longer be used to decipher messages. The codebreakers now had to begin the task of trying to identify the new day key. It could take several hours, but as soon as they had discovered the Enigma settings for that day, the Bletchley staff could begin to decipher the German messages that had already accumulated, revealing information that was invaluable to the war effort.
Surprise is an invaluable weapon for a commander to have at his disposal. But if Bletchley could break into Enigma, German plans would become transparent and the British would be able to read the minds of the German high command. If the British could pick up news of an imminent attack, they could send reinforcements or take evasive action. If they could decipher German discussions of their own weaknesses, the Allies would be able to focus their offensives. The Bletchley decipherments were of the utmost importance. For example, when Germany invaded Denmark and Norway in April 1940, Bletchley provided a detailed picture of German operations. Similarly, during the Battle of Britain, the cryptanalysts were able to give advance warning of bombing raids, including times and locations.
Once they had mastered the Polish techniques, the Bletchley cryptanalysts began to invent their own shortcuts for finding the Enigma keys. For example, they cottoned on to the fact that the German Enigma operators would occasionally choose obvious message keys. For each message, the operator was supposed to select a different message key, three letters chosen at random. However, in the heat of battle, rather than straining their imaginations to pick a random key, the overworked operators would sometimes pick three consecutive letters from the Enigma keyboard (Figure 32), such as QWE or BNM. These predictable message keys became known as cillies. Another type of cilly was the repeated use of the same message key, perhaps the initials of the operators girlfriend – indeed, one such set of initials, CIL, may have been the origin of the term. Before cracking Enigma the hard way, it became routine for the cryptanalysts to try out the cillies, and their hunches would sometimes pay off.
As the Enigma machine continued to evolve during the course of the war, the cryptanalysts were continually forced to innovate, to redesign and refine the bombes and to devise wholly new strategies. Part of the reason for their success was the bizarre combination of mathematicians, scientists, linguists, classicists, chess grandmasters and puzzle addicts within each hut. An intractable problem would be passed around the hut until it reached someone who had the right mental tools to solve it. However, if there is one figure who deserves to be singled out, it is the mathematician Alan Turing, who identified Enigmas greatest weakness and ruthlessly exploited it. Thanks to Turing, it became possible to crack the Enigma cipher under even the most difficult circumstances.
At the outbreak of war, Turing left his post at Cambridge University and joined the codebreakers at Bletchley Park, spending much of his time in the Bletchley think-tank, formerly Sir Herbert Leon’s apple, pear and plum store. The think-tank was where the cryptanalysts brainstormed their way through new problems or anticipated how to tackle problems that might arise in the future. Turing focused on what would happen if the German military changed their system of exchanging message keys. Bletchley’s early successes relied on Rejewski’s work, which exploited the fact that Enigma operators encrypted each message key twice (for example, if the message key was YGB, the operator would encipher YGBYGB). This repetition was supposed to ensure that the receiver did not make a mistake, but it created a chink in the security of Enigma. British cryptanalysts guessed it would not be long before the Germans noticed that the repeated key was compromising the Enigma cipher, at which point the Enigma operators would be told to abandon the repetition, thus confounding Bletchley’s current codebreaking techniques. It was Turing’s job to find an alternative way to attack Enigma, one that did not rely on a repeated message key.
As the weeks passed, Turing realized that Bletchley was building up a vast library of decrypted messages, and he noticed that many of them conformed to a rigid structure. By studying old decrypted messages, he believed he could sometimes predict part of the contents of an undeciphered message, based on when it was sent and its source. For example, experience showed that the Germans sent a regular enciphered weather report shortly after 6.00 A.M. each day. So an encrypted message intercepted at 6.05 A.M. would be almost certain to contain wetter, the German word for “weather”. The rigorous protocol used by any military organization meant that such messages were highly regimented in style, so Turing could even be confident about the location of wetter within the encrypted message. For example, experience might tell him that the first six letters of a particular ciphertext corresponded to the plaintext letters wetter. When a piece of plaintext can be associated with a piece of ciphertext, this combination is known as a crib.
Turing proved that the crib placed severe constraints on the setup of the machine used to encrypt the message. In other words, it was possible to home in on the message key, and then the day key, the latter of which could be used to decipher other messages sent on the same day. It was still necessary to check thousands of Enigma scrambler settings in order to see which one satisfied the constraints, so Turing designed a machine for performing this task. It was called a bombe, after the Polish codebreaking machine that had helped to give Bletchley Park a head start against the Enigma cipher.
While waiting for the first of the bombes to be manufactured and delivered, Turing continued his day-to-day work at Bletchley. News of his breakthrough soon spread among the other senior cryptanalysts, who recognized that he was a singularly gifted codebreaker. According to Peter Hilton, a fellow Bletchley codebreaker, “Alan Turing was obviously a genius, but he was an approachable, friendly genius. He was always willing to take time and trouble to explain his ideas; but he was no narrow specialist, so that his versatile thought ranged over a vast area of the exact sciences.”
However, everything at the Government Code and Cypher School was top secret, so nobody outside of Bletchley Park was aware of Turing’s remarkable achievement. For example, his parents had absolutely no idea that Alan was even a codebreaker, let alone Britain’s foremost cryptanalyst. He had once told his mother that he was involved in some form of military research, but he did not elaborate. She was merely disappointed that this had not resulted in a more respectable haircut for her scruffy son. Although Bletchley was run by the military, they had conceded that they would have to tolerate the scruffiness and eccentricities of these “professor types”. Turing rarely bothered to shave, his nails were stuffed with dirt and his clothes were a mass of creases.
By the end of 1941, there were fifteen bombes in operation, exploiting cribs, checking scrambler settings and revealing keys, each one clattering like a million knitting needles. If everything was going well, a bombe might find an Enigma key within an hour. Once the plugboard cablings and the scrambler settings (the message key) had been established for a particular message, it was easy to deduce the day key. All the other messages sent that same day could then be deciphered.
Even though the bombes represented a vital breakthrough in cryptanalysis, decipherment had not become a formality. There were many hurdles to overcome before the bombes could even begin to look for a key. For example, to operate a bombe you first needed a crib. The senior codebreakers would give cribs to the bombe operators, but there was no guarantee that the codebreakers had guessed the correct meaning of the ciphertext. And even if they did have the right crib, it might be in the wrong place – the cryptanalysts might have guessed that an encrypted message contained a certain phrase, but associated that phrase with the wrong piece of the ciphertext. However, there was a neat trick for checking whether a crib was in the correct position.
In the following crib, the cryptanalyst is confident that the plaintext is right, but he is not sure if he has matched it with the correct letters in the ciphertext.
One of the features of the Enigma machine was its inability to encipher a letter as itself, which was a consequence of the reflector. The letter a could never be enciphered as A, the letter b could never be enciphered as B, and so on. The particular crib on the previous page must therefore be misaligned, because the first e in wetter is matched with an E in the ciphertext. To find the correct alignment, we simply slide the plaintext and the ciphertext relative to each other until no letter is paired with itself. If we shift the plaintext one place to the left, the match still fails, because this time the first s in sechs is matched with S in the ciphertext. However, if we shift the plaintext one place to the right, there are no illegal encipherments. This crib is therefore likely to be in the right place, and could be used as the basis for a bombe decipherment:
The military intelligence derived from cracking the German Enigma was part of an intelligence-gathering operation code-named Ultra. The Ultra files, which also contained decipherment of Italian and Japanese messages, gave the Allies a clear advantage in all the major arenas of the war. In North Africa, Ultra helped to destroy German supply lines and informed the Allies of the status of General Rommel’s forces, enabling the Eighth Army to fight back against the German advances. Ultra also warned of the German invasion of Greece, allowing British troops to retreat without suffering heavy losses. In fact, Ultra provided accurate reports on the enemy’s situation throughout the entire Mediterranean region. This information was particularly valuable when the Allies landed in Italy and Sicily in 1943. In 1944, Ultra played a major role in the Allied invasion of Europe. For example, in the months before D-Day the Bletchley decipherments provided a detailed picture of German troop concentrations along the French coast.
Crucially, the information had to be used in such a way as not to arouse the suspicion of the German military. In order to maintain the Ultra secret, Churchill’s commanders took a variety of precautions. For example, the Enigma decipherments gave the locations of numerous U-boats, but it would have been unwise to attack every single one of them, because a sudden, unexplained increase in successful British attacks would suggest to Germany that its communications were being deciphered. Consequently, a number of U-boat coordinates were not passed on to the commanders at sea, allowing some of them to escape. Other U-boats were attacked only after a spotter plane had been sent out first, thus justifying the approach of a destroyer some hours later. Alternatively, the Allies might send fake messages describing sightings of U-boats, which likewise provided sufficient explanation for the ensuing attack.
Despite this policy of minimizing telltale signs that Enigma had been broken, British actions did sometimes raise concerns among Germany’s security experts. On one occasion Bletchley deciphered an Enigma message giving the exact location of a group of German tankers and supply ships, nine in total. Those responsible for exploiting the Ultra intelligence decided not to sink all the ships, in case this aroused German suspicion. Instead, they informed destroyers of the exact location of just seven of the ships, which should have allowed the Gedania and the Gonzenheim to escape unharmed. The seven targeted ships were indeed sunk, but Royal Navy destroyers accidentally encountered the two ships that were supposed to be spared, and sank them too. The destroyers did not know about Enigma or the policy of not arousing suspicion – they merely believed they were doing their duty. Back in Berlin, Admiral Kurt Fricke instigated an investigation into this and similar attacks, exploring the possibility that the British had broken the Enigma cipher. The report concluded that the numerous losses were either the result of natural misfortune or caused by a British spy who had infiltrated the German navy. The breaking of Enigma was considered impossible and inconceivable.
Stuart Milner-Barry, one of the Bletchley Park cryptanalysts, wrote: “I do not imagine that any war since classical times, if ever, has been fought in which one side read consistently the main military and naval intelligence of the other.” It has been argued, albeit controversially, that Bletchley’s achievements were the decisive factor in the Allied victory. What is certain is that the British codebreakers significantly shortened the war. This becomes evident by rerunning the Battle of the Atlantic and speculating what might have happened without the benefit of the Ultra intelligence. To begin with, more ships and supplies would certainly have been lost to the dominant U-boat fleet, and that would have compromised the vital link to America and forced the Allies to divert manpower and resources into the building of new ships. Historians have estimated that this would have delayed Allied plans by several months, which would have meant postponing the D-Day invasion until at least the following year. This would have cost lives on both sides.
However, cryptanalysis is a clandestine activity, so Bletchley’s accomplishments remained a closely guarded secret even after 1945. Having successfully deciphered messages during the war, Britain wanted to continue its intelligence operations and was reluctant to divulge its capabilities. In fact, Britain had captured thousands of Enigma machines and distributed them among its former colonies, who believed that the cipher was as secure as it had seemed to the Germans. The British did nothing to disabuse them of this belief, and routinely deciphered their secret communications in the years that followed.
Consequently, the thousands of men and women who had contributed to the creation of Ultra received no recognition for their achievements. Most of the codebreakers returned to their civilian lives, sworn to secrecy, unable to reveal their pivotal role in the Allied war effort. While those who had fought conventional battles could talk of their heroic achievements, those who had fought intellectual battles of no less significance had to endure the embarrassment of having to evade questions about their wartime activities. According to Gordon Welchman, one of the young cryptanalysts working with him at Bletchley received a scathing letter from his old headmaster, accusing him of being a disgrace to his school for not being at the front. Derek Taunt, another cryptanalyst, summed up the true contribution of his colleagues: “Our happy band may not have been with King Harry on St Crispin’s Day, but we had certainly not been abed and have no reason to think ourselves accurs’t for having been where we were.”
After three decades of silence, the cloud of secrecy over Bletchley Park was dispersed in the early 1970s. Captain F. W. Winterbotham, who had been responsible for distributing the Ultra intelligence, badgered the British government, arguing that the Commonwealth countries had stopped using the Enigma cipher and that there was now nothing to be gained by concealing the fact that Britain had broken it. The intelligence services reluctantly agreed, and permitted him to write a book about Bletchley Park. Published in the summer of 1974, Winterbotham’s The Ultra Secret meant that Bletchley codebreakers could at last get the recognition they deserved.
Tragically, Alan Turing did not live long enough to receive any public recognition. Before the war Turing had shown himself to be a mathematical genius, publishing work that had laid down the ground rules for computers. At Bletchley Park he turned his mind to cracking Enigma, arguably making the single most important contribution to finding the flaws in the German cipher machine. After the war, instead of being acclaimed a hero, he was persecuted for his homosexuality, then regarded as a crime. In 1952, while reporting a burglary to the police, he naively revealed that he was having a homosexual relationship. The police felt they had no option but to charge him with “Gross Indecency contrary to Section II of the Criminal Law Amendment Act 1885”. The newspapers reported the subsequent trial and conviction, and Turing was publicly humiliated.
Turing’s secret had been exposed, and his sexuality was now public knowledge. The British government withdrew his security clearance. He was forbidden to work on research projects relating to the development of the computer. He was forced to consult a psychiatrist and to undergo hormone treatment, which made him impotent and obese. Over the next two years he became severely depressed, and on June 7, 1954, he went to his bedroom, carrying with him a jar of cyanide solution and an apple. He dipped the apple in the cyanide and took several bites. At the age of just forty-two, one of the true geniuses of cryptanalysis committed suicide.