Appendix 2

Enigma and the Bombe in Depth

By Frank Carter

The ‘military’ Enigma machine generates a sequence of cipher text letters from the corresponding sequence of plain text letters that are typed on its keyboard. When a letter key is depressed the movement closes a switch under the key and this completes an electrical circuit that lights a lamp (one on a panel of 26 lamps) that indicates the corresponding cipher text letter. The convoluted wiring of this circuit passes through the interior of three moveable wheels or rotors, and also through a plugboard.

Every rotor (referred to as a wheel in the body of this book) has a set of 26 electrical contacts on each of its opposite sides, with a different internal arrangement of 26 wires connecting the contacts on one side to those on the other, so that when located in the machine every possible combination of the rotational positions of the three rotors will result in a different electrical circuit between the keys and the indicating lamps. The three rotors turn in a way that is somewhat like the motion of the wheels in an odometer fitted in a car, the right-hand rotor turning on by one position for each letter key pressed, and at a particular position, this turning motion causes the middle rotor to turn on by one place. In the same way at a certain position the movement of the middle rotor causes the left-hand rotor to turn on by one place. The design of the machine is such that when a key is pressed the rotors move before the switch under the key closes to complete the electrical circuit and to light one of the lamps.

The rotor orientations where the ‘turnovers’ take place are determined by the positions of a notch cut into the side of the ring that is fitted round the rim of each rotor, rather like a tyre on a wheel. These rings either have the 26 letters (A–Z) or alternatively the 26 numbers (1–26) inscribed on them (the following exposition will assume them to be letters).

In the initial setting-up of the machine each ring is made to rotate around the inner core of its rotor to a position where a chosen letter on the ring is aligned with a fixed index mark embossed on the rotor, and it is then locked at this position by a spring clip. These chosen positions are referred to collectively as the ‘ring settings’ of the rotors and as the plain text is ‘typed’ on the keyboard of the machine the ‘turnover’ positions of the middle and left-hand rotors are determined by these settings.

The rotor ‘turnovers’ have the following unexpected characteristic: every time a key is pressed on the Enigma machine the right-hand rotor moves on regularly by one position; once in every 26 of these moves (at the turnover position set on the right-hand rotor) the middle rotor will also move on by one position. If this movement of the middle rotor happens to bring it to its own ‘turnover’ position then it will move on again by one position when the next letter key is pressed, and also cause the left-hand rotor to advance by one position. This behaviour is known as the ‘double stepping’ of the middle rotor and it has the effect of reducing the cyclic period of the rotors from the expected value of 26 × 26 × 26 ( = 17,576) to 26 × 25 × 26 ( = 16,900).

The three chosen rotors are placed side by side in one of the six possible arrangements. When in position, three small viewing windows allow one letter on each of the rotor rings to be visible to the operator. The rotors can then be turned by hand until the three letters chosen for the initial rotor starting positions appear in the three windows. Then each letter of plain text entered on the keyboard will result in the illumination of one of the lamps on the lamp panel indicating the corresponding letter of cipher, the electric current passing first though the plugboard to the rotors, and then again through the plugboard and finally to the lamp panel.

The function of the plugboard is to enable additional special changes to be made to the electrical circuits connecting the keys to the lamps. For pre-selected pairs of letters this device enables exchanges to be made automatically between the letters in each pair in the electrical circuits between the keyboard and the rotors and again between the rotors and the indicating lamps.

After passing through the three rotors the electric circuits are connected to another device known as the ‘reflector’; the internal wiring in this has the effect of returning the circuit back through the rotors for a second time but in the reverse direction and following a different path, returning again to the plugboard where further exchanges between the pre-selected pairs of letters are made.

The Steckers

The pairs of pre-selected letters that were subjected to these exchanges were known at BP as the ‘stecker pairs’ (Stecker is the German word for ‘plug’). The remaining letters not paired for this purpose were said to be ‘self-steckered’ or ‘unsteckered’. During the war the standard German practice was to select 10 pairs of letters each day, and one of the tasks at BP was to identify these 10 stecker pairs (by default the remaining six letters would be self-steckered).

The Reciprocal Characteristics of the Machine

The Enigma machine was designed to have reciprocal characteristics so that the two processes of encrypting and decrypting a message are essentially the same. In order to understand how this can be achieved it is necessary to consider the electrical circuits inside the machine connecting the keys on the keyboard to the indicating lamps on the lamp panel. At each set of rotor positions the effect of the design of the machine is to partition the 26 letters from the alphabet into 13 conjugate pairs so that for every pair one letter will be encrypted as the other and consequently no letter will ever be encrypted as itself. It is important to remember that as the rotor positions change the identity of these conjugate pairs will also change but there will always be 13 of them.

Two highly simplified versions of the circuit diagram of the machine are given opposite showing only 4 of the keys and 4 of the indicator lamps. A machine based upon this simple circuit would be of no practical use but the electrical principles of the real machine can be readily understood by considering the characteristics of the electric circuits shown in these diagrams.

The first diagram shows a configuration of the machine for which letter Q is encrypted to letter E. The second diagram of the same Enigma configuration shows the reciprocal process where letter E is encrypted to letter Q.

The diagrams also show the basic electrical design of the double sockets on the plugboard, where the insertion of a two-pin plug moves the spring-loaded shorting bar across the sockets causing a break in the electrical contact between them and thus enabling the required external ‘crossed’ pair of connections to be made. The diagrams show how the insertion of plugs in sockets ‘Q’ and ‘W’ enables the electrical cross connections to be made to form the stecker pair Q/W.

The addition of the plugboard to an earlier version of Enigma transformed it into such a formidable cipher machine that throughout WWII the German authorities never seriously thought that it had been broken. The function of the board was to add to the effects of the rotors the further complication of the transposition of selected pairs of letters. The number of pairs subjected to this process changed over time; initially 6 different pairs were selected each day, but by 1939 this had been increased to 10 pairs. So then each day 10 pairs of sockets from the 26 on the plugboard were chosen and these pairs were electrically connected by means of external cables that had special plugs at each end.

As might be expected the number of possible ways of selecting a set of steckers is a function of the number that are to be selected. Let n represent the number of steckered pairs of letters that are to be selected, so that the number of sockets on the plugboard that will be involved = 2n. The first pair of sockets can be selected in ²⁶C₂ ways. After the selection of the first pair has been made from 26 sockets there will be 24 sockets remaining from which the second pair of sockets can be selected. Hence the second pair of sockets can be selected in ²⁴C₂ ways. After the selection of the second pair has been made there will be 22 sockets remaining from which the third pair of sockets can be selected and so on. In general, the number of remaining sockets from which the n^th pair of sockets can be selected is given by the expression (28 – 2n).

Hence from this chain of values, the total number (T_n) of possible selections of n pairs of sockets is given by the following expression:

Hence

After considerable simplification (by cancellation)

In this analysis, the order of occurrence of the selected pairs of sockets is not taken into account and hence the total number T_n of possible selections found includes all of the possible orders of arrangement of the n selected pairs of sockets. The total number of arrangements of n pairs of sockets = n!.

Hence if S_n represents the number of possible selections of n pairs of sockets (when no distinction is made between different orders of arrangement) then it follows that:

Two numerical examples:

If n = 1 then S₁ = 26!/(2 × 24! × 1) = (26 × 25)/2 ( = 325)

If n = 2 then S₂ = 26!/(4 × 22! × 2) = (26 × 25 × 24 × 23)/8 ( = 44,850)

It is evident that at this stage the number of possible sets of steckers increases very rapidly!

The expression for S_n given above is inconvenient to use when calculating the results for larger values of n. An alternative method is to use the ratio

(As an algebraic exercise the reader may wish to confirm this result.)

By using this ratio the results for larger values of n can be more readily determined:

if n = 1: S₂/S₁ = (24 × 23/4)

then since S₁ = 325, S₂ = (24 × 23/4) × 325 ( = 44,850)

if n = 2: S3 / S2 = (22 × 21)/6

then since S2 = 44,850, S3 = (22 × 21)/6 × 44,850 ( = 3,453,450)

This process can be continued for values of n = 3, 4, 5 …. 13.

Overleaf is a graph of the results obtained in this way.

It is perhaps surprising that the maximum possible number of stecker pairs is produced when 11 pairs are selected. From the perspective of German security, the greater the number of stecker letter pairs the better, and so 11 pairs would have been the optimal number to use. However the number for 10 pairs is close and slightly reduced the daily task for the Enigma operators when setting up their machines. The value of S₁₀ is approximately equal to 1.5 × 10¹⁴ (i.e. about 150 million, million). (About 95% of the letters of cipher were affected by the 10 stecker pairs.)

The addition of the plugboard to the Enigma machine gave a huge increase in the number of possible keys that could have been used on a given day, and so greatly increased the security of the system.

Breaking Enigma ciphers

In order to be able to read an Enigma message, it was necessary to find the ‘key’ that had been used to encrypt the message. This consisted of four component parts.

(i)	The choice and location in the machine of the three rotors used, referred to as the ‘rotor order’;
(ii)	The rotor turnover positions for the rotors, given by the ‘ring settings’ that had been selected for the three rotor rings;
(iii)	The identity of the set of the 10 ‘steckered pairs’ of letters that had been set up on the plugboard;
(iv)	The starting positions of the three rotors that had been used to encrypt the message, known as the ‘message settings’.

The function of the bombe was to carry out a systematic search to find the following parts of an unknown Enigma key: (a) the rotor order, (b) the rotor ‘core starting positions’ (c) the ‘stecker partner’ of one of the letters on the plugboard.

The expression ‘core starting positions’ used above is not easy to come to terms with and requires a careful explanation. The ‘core starting positions’ of the rotors are defined by the respective differences (i.e. the number of places in the alphabet) between the letters of the message settings and the corresponding ring settings. For example the ‘message settings’ JHL and ring settings DGR taken together define the rotor ‘core starting positions’; initially of course both of these parameters would be unknown.

However the ‘core starting positions’ can be represented by many different combinations of rotor settings and ring settings, and by provisionally assuming the ring settings to be Z Z Z, a bombe could be used to find the rotor settings that represented the same unknown rotor ‘core starting positions’. For example with the provisional ring settings Z Z Z, the rotor settings that will give the same ‘core starting positions’ are F A T.

This can be explained by means of the above three diagrams that show the left-hand rotor adjusted in three different ways. In diagram (a) the rotor setting is J and the ring setting is D so the letter D on the ring is aligned to be in registration with the index mark on the core of the rotor. The entire rotor has then been turned so that letter J appears in the left-hand viewing window on the Enigma machine. (Note that the positions of letters J and D in the alphabet differ by 6 places).

In diagram (b) the ring setting has been changed from D to Z by turning the inner core of the rotor ‘forwards’ so that the index mark on it comes into registration with letter Z on the ring. Note that the ring itself has not been moved and letter J still appears in the left-hand viewing window.

In diagram (c) the rotor setting has be changed from J to F by turning the entire rotor (i.e. including the core) ‘backwards’ so that the letter in the viewing window changes accordingly. Note that this has the effect of moving the index mark on the core (together with the internal wiring) to its original position. (Note that the positions of letters F and Z in the alphabet differ by 6 places.)

Similar thinking applied to the two other rotors should lead to the conclusion that the rotor positions F A T and ‘ring settings’ Z Z Z do represent the same set of rotor ‘core starting positions’ as message settings J H L and ‘ring settings’ D G R

The penalty incurred by assuming the ‘ring settings’ to be Z Z Z, is that the true locations of the left and middle-rotor turnover positions will almost certainly differ from those given by the assumed letters. During the war the correct turnover positions had to be found by a sequence of trials that were made at the last stage of the codebreaking process.

The rotors and reflector as used in the Enigma machine were designed as a single-ended unit. In the development of the bombe, an alternative double-ended form was devised which used rotating ‘drums’ instead of rotors as this was an essential requirement in the design of the machine. Each of these double-ended ‘scramblers’ had two sets of 26 input/output terminals, and the units could be linked together by 26-way cable connectors in a variety of ways. The following two diagrams show the distinction between the two forms of construction:

The drums in each scrambler unit were mechanically linked so that they moved from one position to another like the wheels in the odometer of a car. However, they could be independently pre-set to any chosen starting position.

Unlike the adjustable rings attached to the rotors in the Enigma machine, the drums simply had fixed rings of reference letters marked on their circumferences. Consequently the unknown turnover positions of the middle and right-hand rotors of the Enigma machine were unlikely to be the same as those of the corresponding drums in the bombe. This resulted in some restrictions and difficulties in the operational use of the machine.

The Turing Bombe

The fundamental ideas upon which the bombe was based are attributed to Alan Turing, and the first two of them are given here as direct quotations from his wartime paper ‘Treatise on the Enigma’.1

(i)	‘The best data for finding an Enigma key is a crib.’
(ii)	‘The method to be used for finding a key will be to take a hypothesis about part of the key and then draw from it all the conclusions that one can, hoping to obtain either a confirmation or a contradiction.’
(iii)	The perception that a closed chain of successive Enigma encipherments had a very useful property that could be exploited. (These chains were to be found in some of the cribs as will be explained.)
(iv)	His realization that a search for the correct key could be hugely reduced by rejecting all the possible keys which were found to be logically inconsistent with the information that had been derived from a crib.

A Crib

This was a conjecture (an informed guess!) for the letters of plain text represented by a given sequence of cipher letters. The big advantage of finding keys by means of cribs was that the process could not be compromised by any future changes that the Germans might make in their operational procedure. An analysis of some messages broken by earlier methods had revealed that a useful proportion of the messages contained common forms of expression (stereotypes) that could be used as cribs.

The whole basis of Turing’s approach was the idea of running a crib through all 17,576 different positions of the drums for a given wheel order, and accepting or rejecting a given position by testing to see if possible stecker pairs could or could not be found for it. This was a very remarkable idea: although in theory the steckers made the identification vastly more difficult, in practice they provided a method for spotting possible positions. Thus the steckers were used to work for a solution and their ‘difficulty’ was thus neatly compensated for by their ‘utility’.2

The following illustrative example of a crib was derived from a dummy message encrypted on an Enigma machine. The initial rotor configuration used was specially chosen to avoid the additional complications that would have arisen if a middle-rotor turnover had occurred within the span of the 25 positions of the crib (the problems caused by middle-rotor turnovers will be addressed later):

This crib can also be represented in the diagrammatic form that was known as a ‘menu’:

Each ‘link’ in the menu shows the relationship between the cipher/plain text pair of letters at a particular position on the crib. For example at the fourth position the relationship shown is that letter S is encrypted as U or alternatively, as a consequence of the reciprocal nature of Enigma, letter U is encrypted as S.

Turing found a useful way of formulating a hypothesis about part of a given message key that depended on the sequences of links forming the closed ‘loops’ that appeared in some menus. The bombe was designed to test these hypotheses in a way that provided parts of the Enigma key that had been used, so that subsequently the complete message key for the day could be found.

The given menu shown contains three such sequences of links forming loops, one for example for the positions: 4, 2, 9, 16, 22. Starting with the letter S this generates the closed letter sequence: S U H E Y (S).

The following diagram gives this sequence of links again now showing only those parts of the encrypting process due solely to the effects of the Enigma rotor system. Starting with the letter α (representing the unknown stecker partner of letter S), the diagram shows how the closed chain of (unknown) stecker letters: α, β, γ, δ, ε, (α) are related to one another.

It is very important to appreciate that the identity of the unknown stecker letters β, γ, δ, ε will depend only on the identity of letter α together with the rotor positions but not on the letters that appeared on the original menu. It was from sequences of steckered letters like this that Turing was able to formulate his working hypotheses.

Suppose that the rotor configuration is correct (i.e. both the rotor order and rotor core positions are correct), and that the working hypothesis to be used for identifying the stecker partner of letter S is: α ≡ A (i.e. the stecker hypothesis is: S/A). Then as the diagram shows, if this hypothesis is correct, then the final outcome from the closed sequence of successive encipherments, beginning with the chosen letter A must also be letter A as any other outcome would imply a logical contradiction, as the letter S must have a unique stecker partner.

A practical way of testing a working hypothesis like this can be carried out by means of the circuit shown overleaf. Assuming that the rotor configuration in use is correct, then to test the hypothesis: S/A, the switch for letter A on the panel is set to ‘on’ and the identity of the single lamp on the board that becomes lit is noted.

If the hypothesis S/A is correct then lamp A will be lit, but if it is false then instead a different lamp will be lit, indicating a logical inconsistency and establishing that hypothesis S/A is false. In this event the sequence of alternative hypotheses: S/B, S/C, S/D … etc. could then be systematically tested in turn, the final outcome being the discovery of the true stecker hypothesis and thus identifying the correct stecker partner of letter S.

The searching process carried out on the bombe was essentially the systematic testing of these stecker hypotheses. Turing called the basic process ‘single line scanning’, as the test involved applying a voltage to the input terminals of the scramblers one at a time. However, he realized that this would be much too slow as it would have been necessary to carry out up to 26 of these single tests, for every rotor configuration. Substantial improvements were needed if the bombe was to have any operational value.

There is some evidence that at an early stage in the design of the bombe, an electronic system was considered that would have enabled the 26 individual stecker hypothesis tests to be made at a very high speed. Turing referred to this ideal process as ‘simultaneous scanning’. This project was quickly abandoned, after it had been discovered that new ideas (to be considered later) made it unnecessary to resort to the use of complex electronics.

There was also a significant weakness in the test procedure as it has so far been described, that is best understood by means of an example. Suppose that a false stecker hypothesis is under test say S/D and that the rotor configuration being used is also wrong. The identity of the lamp on the panel that is lit now depends entirely on random chance, and so it is possible that it could be lamp D, thus wrongly indicating that the false hypothesis S/D was true. The probability of this happening is 1/26, which is an unsatisfactorily high value.

To reduce the chances of such false conclusions occurring, Turing proposed that the testing process should be carried out with menus that contained at least three closed sequences of successive encipherments. The example menu is of this type containing the sequence S1 = (4 2 9 16 22) already described and also the 2 additional sequences S2 = (21 3 12 20 9 2 4) and S3 = (21 3 5 1 15 20 9 2 4).

These three sequences have the letter S in common (Turing called this ‘the central letter’, and so in testing any of the stecker hypotheses involving letter S, say (S/D), the condition now required to establish the truth of the hypothesis is the simultaneous lighting of lamp D on all three panels shown in the next diagram.

With this circuit if the rotor configuration and the stecker hypothesis to be tested (S/I, the correct hypothesis in this case) are both correct, then lamp I will be lit on each board. If however a wrong hypothesis is tested then it is highly probable that a different lamp will light up on each of the boards.

Suppose for example that the false hypothesis S/Q is tested, and that as a consequence of setting the switch Q to ‘on’, lamp W is lit on one of the boards. Thus the hypothesis S/Q has led to the inconsistent conclusion S/W, showing that the hypothesis S/Q is false. It is important to appreciate that the conclusion S/W will itself be false. This can be verified in the following way:

If the hypothesis (S/W) were true, then when tested (i.e. by setting switch W to ‘on’), lamp W would be lit on all three boards. But it has already been established that on one of the boards lamp W was lit by means of switch Q and not by switch W, consequently the hypothesis (S/W) must be false.

Speeding up the Scanning Process

Turing thought of a highly ingenious idea that enabled the true stecker hypothesis for a chosen letter on the menu to be quickly identified by means of a procedure that eliminated all of the false ones. Provided that a suitable menu was available, this procedure enabled the correct hypothesis to be identified by means of a single electrical test that was carried out with modified versions of the electrical circuits described earlier.

The most important practical outcome of his innovative thinking was that this procedure could be carried out almost instantaneously, so that with suitable menus simultaneous scanning could be achieved.

The following is an extract from Turing’s ‘Treatise on Enigma’:

There is no reason why, when from one hypothesis about the stecker partner of the central letter we have deduced that the central letter [S in the example] must have a different stecker partner, the process should not go on to draw further conclusions from this second stecker pair. At first sight this seems quite useless, but as these deductions are reversible [i.e. may be used as new false hypotheses] it is actually very useful, for all the conclusions that can be drawn will be false, and those that remain will stand out clearly as possible correct hypotheses.

In the procedure based on this remarkable idea, each false conclusion reached in the way previously described, was to be used as a new hypothesis and so on. This gave rise to a chain of logical conclusions that were almost instantaneously deduced by means of the electrical circuits in the bombe.

A practical way of implementing this procedure is illustrated in the accompanying diagram where the output voltage signal representing the (false) conclusion resulting from the initial (false) hypothesis (S/A) is fed back as a new hypothesis, and the process is repeated until all the possible false conclusions have been reached. These are all revealed by the lamps that become lit, and these are represented in the diagram by the hollow circles.

Insight into why the circuit behaves in this way can be obtained by considering the permutation of the 26 letters represented by the switches created by the sequence of scramblers in the circuit.

The pairs of elements from such a permutation can in theory be determined one by one, by setting each switch in turn to ‘on’, and noting which lamp on the board is lit as a consequence.

For the sequence of scramblers shown in the diagram the permutation is:

A B C D E F G H I J K L M N O P Q R S T U V W X Y Z

C R K Z G F O J I N S H P V X T U E M A L W B Q D Y

Then beginning with the letter A the permutation gives the letter C and likewise from C the permutation gives the letter K, and so on. If this process is continued a sequence of letters will be created that will ultimately terminate when letter A recurs, so giving rise to the sequence (A C K S M P T). This is known as a ‘permutation cycle’ from the complete permutation.

The reader may wish to verify that the permutation also contains the following other permutation cycles:

C2 = (B R E G O X Q U L H J N V W), C3 = (D Y Z), C4 = (I), C5 = (F).

It will be seen that collectively the five cycles account for all 26 letters of the alphabet, and that there is no single letter common to any pair of cycles, (i.e. the cycles are mutually disjoint). The electrical behaviour of the circuit can now be predicted from the associated permutation cycles. The letter designated by any switch on the panel will also occur in one of the permutation cycles given above. If this switch is set to ‘on’ then all the lamps that correspond to the letters occurring in this cycle will be lit.

In one special case since the correct stecker hypothesis is S/I, the only conclusion reached will be S/I, so setting switch I to ‘on’ will result in only the lamp I on the panel being lit.

The structure of the cycles shows that tests carried out on the other 25 false stecker hypotheses will, with the exception of the hypothesis S/F, all result in more than one lamp on the panel being lit, but none would cause lamp I to be lit as the cycles are all mutually disjoint.

The application of voltage feedback to this particular circuit leads to results that considerably reduce the number of possible choices for the correct hypothesis. However the outcomes obtained on the lampboard fail to identify all of the false hypotheses and so it is still not possible to isolate the correct one. In addition there is one totally misleading outcome indicating that the false hypothesis S/F is in fact true!

The full value of voltage feed-back only becomes apparent when a longer crib is used such that the circuit derived from it contains more than one loop. This is illustrated by means of a more complex menu derived from the original crib, containing the 2 sequences S1 and S2. The following diagram shows the 2 loops for S1 and S2 from the original menu, in a circuit configuration that is similar to that used in the first version of the bombe.

The diagram does not include a lampboard as in fact lamps were not used on the bombe; instead a device known as the ‘indicator unit’ (or the ‘test-register’) was used, which incorporated 26 indicating relays. A test voltage was applied to the input terminal of one these relays and they provided a visual/tactile indication of the final results.

The input terminal chosen for this purpose was connected to a voltage source by means of the corresponding switch (A–Z) on the panel of switches. The indicator unit was connected to a chosen position on the scrambler circuit by means of a 26-way cable.

The terminals of the relays in the indicator unit that will also ‘receive’ the test voltage via the scrambler circuit can be identified by considering the permutation cycles for the two sequences S1 and S2.

S1 cycles: C1 = (A C K S M P T), C2 = (B R E G O X Q U L H J N V W),

C3 = (D Y Z), C4 = (I), C5 = (F).

S2 cycles: D1 = (A J U G F W Q L R S C Z M O), D2 = (B H D K Y),

D3 = (E V), D4 = (N T X P), D5 = (I).

If a test voltage is applied to terminal I on the indicator unit (i.e. testing the correct hypothesis S/I), then as the permutation cycle (I) occurs in the lists of cycles for both the sequences S1 and S2 the voltage cannot reach any of the other terminals on the test-registers. Terminal I is now the only one with this property so identifying the correct stecker hypothesis to be S/I.

If instead a false hypothesis, say (S/A) is tested, then the test voltage will be applied to relay terminal A, and because of the existence of the permutation cycle C1, the voltage will reach terminals A, C, K, S, M, P, and T via the S1 loop, and likewise because of the existence of the permutation cycle D1, the voltage will also reach the terminals A, J, U, G, F, W, Q, L, R, S, C, Z, M and O via the S2 loop.

Some of the letters in the second list are duplications from the first list, but others are not, terminal G being one example. As a consequence of this, via terminal G, cycle C2, will give rise to voltages on the other terminals B, E, H, N, V and X.

Again as a consequence of the voltage on terminal B, cycle D2 will give rise to voltages on terminals D and Y, and at this stage the terminals of all the relays in the indicator unit, with the exception of terminal I, will have a voltage on them.

As the following table shows, beginning with the false hypothesis S/A, all of the 25 possible false conclusions are arrived at. The reader may wish to test other false initial hypotheses, and should find that they will all produce the same final outcome on the indicator unit where, with the exception of relay I, all of the others will receive the test voltage.

In the way that has already been explained, if the true hypothesis (S/I) were to be tested, then only the terminal I would receive the test voltage.

The required discrimination between the correct stecker hypothesis and all the false ones has been achieved, and the general behaviour of the bombe characterized by the above example, is summarized in the following statements:

(i)	At each possible rotor configuration, the feedback circuit, in effect, tests simultaneously all of the 26 possible stecker hypotheses for a chosen letter on the menu, and if the rotor configuration is correct then the true hypothesis can be identified from a distinctive pattern of voltages appearing on the relay terminals of the indicator unit.
(ii)	The distinctive pattern can take two forms: either the test voltage will reach 25 of the 26 relay terminals of the indicator unit, or alternatively only one of them.

The 26 relays in the indicator unit, one for each letter of the alphabet, were used to provide the required logical control of the machine, so that when it was operating with the rotors progressively rotating through all their possible positions, the system would be halted automatically whenever the test voltage failed to reach all of the 26 relays (known as a ‘stop’).

The introduction of the concept of a feedback loop was of huge importance; providing that a suitable menu was used it enabled simultaneous scanning to be achieved in a remarkably simple way. This enabled part of an Enigma key to be found in a way that avoided having to confront at the same time the severe complications arising from the unknown connections on the Enigma plugboard (the steckers).

As the process of finding the true stecker hypothesis does not depend on which switch is used to input the test voltage, it was a common practice at the time to use switch A. The indicator unit was connected by a 26-way cable to the ‘best’ position in the circuit and this was usually taken to be the one corresponding to the letter on the menu that had the most links attached to it.

Eliminating All the Wrong Rotor Configurations

Clearly a matter of great importance is to consider how this circuit will behave when the rotor configuration is wrong as this will be by far the most common occurrence. In all such cases both sequences S1 and S2 will produce random permutations and a ‘random stop’ will occur when by chance both of these permutations happen to include a unit cycle of the same letter. The probability of this happening is 1/(26×26) implying that the expected number of random stops will be about 26 for every rotor order tested.

However, as a consequence of the feedback processes previously described, a much more likely outcome is that the test voltage will reach the terminals of all the relays in the indicator unit, no matter which input switch is used to ‘inject’ the test voltage. As all the stops had to be subsequently checked by hand the expected number of random ones given by a menu with 2 loops was inconveniently large. When a menu with three loops was available, the expected number of random stops would be reduced to only one for each rotor order that was tested.

The First Prototype

In the previous circuit diagram, there are duplications of some of the scramblers used at certain positions, and it is possible to eliminate these by making some simple changes to the electrical configuration. The resulting circuit, shown below, has an improved structure that is more suitable for setting up on the bombe, and corresponds to the circuit configurations that were used in the prototype.

The first machine arrived at Bletchley Park in March 1940, and was rather optimistically called ‘Victory’; however, the operational performance of the machine was somewhat below expectations. The effectiveness of the prototype bombe was critically dependent on the use of menus containing multiple loops and these were not available as often as had been hoped.

An additional reason for the limited success of the machine was that it was mainly used in attempts to break German Navy ciphers, and this meant that many more possible rotor orders had to be tested than was the case for the messages transmitted by the German Air Force and Army. Consequently a considerable amount of ‘bombe time’ was expended in attempting to find Navy Enigma keys, using relatively weak menus. German Navy Enigma operators had eight rotors available for use compared to the five for the operators in the other two services. With eight rotors in use there were 336 possible rotor orders to consider!

The Diagonal Board

The invention of the diagonal board by Gordon Welchman was of vital importance in improving the performance of the bombe. It had the valuable effect of hugely increasing the number of electrical connections between the contacts in the circuits that represented valid logical deductions, and enormously increased the likelihood that with a given menu the process of simultaneous scanning would be successfully completed.

This meant that after the addition of the diagonal board to the bombe it became possible to achieve simultaneous scanning using much weaker menus than before. The diagonal board also greatly reduced the number of random stops obtained from a given menu. It enabled menus that covered spans of less than 13 consecutive Enigma positions to be more easily formulated, thus reducing the chances of a middle-rotor turnover (explained below) occurring to less than 50%. In some extreme circumstances the diagonal board even made it possible to achieve simultaneous scanning when using a menu without any loops at all.

The effect of the diagonal board was to enable additional logical inferences to be made about the stecker hypotheses that potentially existed in the original bombe circuits during the course of an operational ‘run’ but which could not have been foreseen in advance from the menu.

Basically the device consisted of an array of 26 × 26 ( = 676) electrical terminals that were connected to each other and to the scramblers in the bombe in a particular way that made it possible to exploit the symmetrical properties of the electrical connections on the Enigma plugboard.

As an illustrative example the diagram overleaf shows the sequence of encipherments S2 previously described, but now set up in the form of a circuit as used on the bombe with the indicator unit connected to position S. The diagram shows an additional row of 26 terminals (A–Z), all connected to position S on the menu by means of a 26-way cable, so that they will have the same voltages on them as the corresponding terminals of the relays in the indicator unit.

As has previously been explained, when used with the correct rotor configuration, the voltages on the relays represent the false conclusions for the stecker partner of letter S that follow as logical consequences from an initial false hypothesis. It should be clear that the voltages on the row of terminals could be used instead to represent the false conclusions for the stecker partners of letter S, instead of the relays in the indicator unit.

Additional rows of 26 terminals are also shown connected to the other six scrambler positions in the menu circuit, and likewise the voltages on the terminals in these rows could be used to represent the false conclusions for the stecker partners of these other letters (Q, I, F, E, H and U) also occurring on the menu. (For this particular menu an array of 7 × 26 of terminals is sufficient for the purpose.)

Welchman realized that permanent connections could be made between some of the pairs of the terminals in this array, and that electrically they would significantly increase the number of false conclusions that could be made from any false initial hypothesis that might have been used. His reasons for adding these permanent connections to the circuits in the bombe were based upon the reciprocal relationship existing between the pairs of stecker letters on the Enigma plugboard. For example if say the conclusion S/H is deduced by the electrical circuits in the bombe then as a consequence of this reciprocal stecker relationship, the additional conclusion H/S can also be made.

In electrical terms, this means that if a voltage happens to appear on the terminal H in row S of the array, (corresponding to the conclusion H/S), then there should also be a voltage on terminal S in row H (corresponding to the conclusion S/H). This can easily be arranged by simply making a permanent electrical connection between these two terminals to create a new electrical path in the scrambler circuit. If the conclusion H/S is false then so will the conclusion S/H and this in turn is highly likely to result in the generation of further false conclusions (as voltages on other terminals). The same argument can be made for all the other reciprocal stecker letter pairs represented in the array of terminals.

The combined effect of all the connections in the array is to increase hugely the number of false conclusions arrived at from any false initial hypothesis, to the extent that even for some menus without any loops at all, it remains highly probable that all of the possible false conclusions will be obtained, thus maintaining the desired simultaneous scanning that was essential for the correct functioning of the bombes. (The diagonal board had the same powerful effect when the rotor order was wrong.)

A much larger array of 26 × 26 ( = 676) terminals is required to provide for all the possible situations that might arise, consequently the wiring of the complete diagonal board is too complex to be given in the form of a diagram, but for purposes of illustration a ‘mini’ 3 × 3 version of the board for just three letters, is shown below.

To avoid confusion lower case letters have been used in this diagram to denote the individual terminals in the array and upper case letters to denote the multiple cable connectors used to link the rows of terminals on the board to the corresponding positions between the scramblers.

This ‘mini’ board would require three 3-way external connecting cables at the positions indicated by the capital letters to make the necessary electrical connections to the other circuits in the bombe.

As previously explained, the wiring of the diagonal board is based on the symmetrical property of the reciprocal stecker relation between pairs of letters on the plugboard. This means that with the wiring of the diagonal board, if the test voltage appeared on wire c, at position A it would cause the test voltage also to appear on wire a at position C. The arrows in the diagram show how the board provides the required electrical connections corresponding to the following stecker relationships:

A/c implying C/a and C/b implying B/c

(Note: the ‘self steckers’, for example B/b, do not require any interconnections on the board.)

When the diagonal board is extended to cover all 26 letters, each of the necessary 26 cable connectors, represented by capital letters in the diagram, will have 26 individual contacts, so that the internal electrical connections between the diagonal board and the other circuits in the bombe were made by means of 26-way cables.

The way in which the diagonal board functioned is not obvious, and it is on record that when Welchman first described it to Turing, the latter was ‘incredulous’ (for a moment or so)!

In order to provide some idea of how it functioned, the following simplified example is given that is based upon an alphabet restricted to the five letters A, B, C, D, E. As a consequence there will only be five connections through the scramblers and only a ‘5 × 5’ diagonal board will be needed.

Then, starting with the false stecker hypothesis A/d, the additional connections through the diagonal board will lead to the following sequence of outcomes:

The voltages on the ‘live’ contacts, representing the false steckers (A/d, B/e, C/d, D/b and E/c), will be passed to the diagonal board and returned from it to other contacts on the scramblers that represent the reciprocal steckers D/a, E/b, D/c, B/d, C/e, so that these contacts become ‘live’.

Each of the five ‘live’ contacts representing these reciprocal steckers will be on a ‘line of electrical continuity’ through the scramblers and consequently as well as the contacts on the scramblers these lines will also be made ‘live’.

As the diagram shows, two additional lines of continuity marked (2) & (3) are made ‘live’ by the wiring in the diagonal board. Consequently through these additional lines, more contacts on other scramblers will also be made ‘live’. These ‘live’ contacts will also indicate false steckers, and the voltage on them will be carried back again to the diagonal board to be returned as reciprocal false steckers. This virtually instantaneous process will continue until a stable state is reached.

There are three special circumstances that usually occur that will reduce the number of scrambler contacts involved:

(i)	‘Repeats’. It is possible that the voltage representing a reciprocal stecker may be returned from the diagonal board to a contact that is already ‘live’.
(ii)	‘Self steckers’ (A/a, B/b, C/c, D/d, E/e). These have no effect on the process and the ‘voltages’ are not returned from the diagonal board.
(iii)	‘Letter not on the Menu’. In general (but not in this example) a returned reciprocal stecker may involve a letter that is not on the menu. Consequently the voltage from the diagonal board cannot be returned to any of the scramblers.

The complex sequences of events carried out by means of the diagonal board are not easy to quantify. However, the following approximate analysis based on probability considerations may help to provide a better understanding of the role of the diagonal board than is possible from a purely descriptive account.

Consider for example a linear menu (one without loops) consisting of 12 letters, and suppose that the rotor order and current drum settings are both correct. If a false initial hypothesis for the partner of a chosen letter on the menu is used, then in electrical terms the test voltage is applied to a chosen contact on a particular scrambler so that it becomes ‘live’. The voltage will be conveyed by means of a line of electrical continuity through the scramblers so that one contact on each of the scramblers has become ‘live’. These 12 ‘live’ contacts each represent a stecker partner for the corresponding letter on the menu.

Then, by means of the electrical connections to and from the diagonal board, the voltage on some of these ‘live’ contacts will be returned and will make other scrambler contacts ‘live’, these corresponding to the reciprocal steckers. For each of these reciprocal steckers the probability that it will involve one of the 12 letters on the menu = 12/26. So assuming there are no ‘repeats’ the expected number of reciprocal steckers returned via the diagonal board that will result in additional ‘live’ contacts = 12 × (12/26).

This, however, is still a slight overestimate, because ‘self-steckers’ are not returned. The probability that a letter on the menu is ‘self-steckered’ = 1/26, hence the expected number of self-steckers = (12 × 1/26), and so a better estimate for the expected number of reciprocal steckers that will be returned from the diagonal board to contacts on the scramblers = 12 × (12/26) – 12/26 (≈ 5).

The processes involving the diagonal board can be considered in a number of stages. In the first stage, as explained above, simplified theory shows that a voltage on one line of continuity will cause one contact on each of the 12 rotors to become ‘live’ and via the diagonal board an estimate of five other contacts on the scramblers will be made ‘live’. Hence, assuming there are no ‘repeats’, the total number of contacts to become activated during the first stage = 12 + 5 ( = 17).

However, the possibility of the occurrence of one or more ‘repeats’ must be taken into account. The diagonal board consists of 26 rows of contacts, one for each letter of the alphabet, and each row has 26 contacts in it (in all 26 × 26 = 676 contacts). For a menu with 12 letters, the total number of operational contacts on the diagonal board is 12 × 26 ( = 312).

Suppose that at any stage, T represents the total number of terminals on the board that are ‘live’. Then the probability that a given terminal is not ‘live’ = 1 – T/312 or alternatively = (312 – T)/312. This expression can be used at the next stage as an approximation for the fraction of the predicted number of new ‘live’ contacts that are not ‘repeats’ of ones previously counted.

Hence an approximation for the expected total number of new contacts made ‘live’ by the end of the first stage is: 5 × (312 – 12)/312] (≈ 5) (so at this stage repeats are unlikely). By the end of the first stage a total of 12 + 5 = 17 contacts will be ‘live’, (the same approximate value as before).

During the second stage the five additional scrambler contacts that became ‘live’ during the first stage will have two effects:

(i)

As each of them is on a ‘line of electrical continuity’ through the 12 scramblers this will result in a contact on each of the 12 scramblers becoming ‘live’, so in all 5 × 12 = 60 contacts will be made ‘live’ in this way. However, taking into account the probable occurrence of ‘repeats’ this number is reduced to about: 60 × (312 – 17)/312 (≈ 57). So the current cumulative total number of ‘live’ contacts = 17 + 57 ( = 74)

(ii)

Probability theory has already shown that the voltage on 5 out of the 12 ‘live’ contacts on each of the above lines of continuity will be returned via the diagonal board and will result in another ‘live’ contact on another scrambler. Since there are five such lines the total number of contacts that will be made ‘live’ = 5 × 5. Then taking into account that some are very likely to be ‘repeats’, the expected number of new contacts to be made ‘live’ in this way = 25 × (312 – 74)/312 ( = 19). Hence the cumulative total number of activated contacts at the end of the second stage = 74 + 19 = 93. This analysis can be continued for the third stage, fourth stage and so on until no additional new contacts are made ‘live’.

The set of results obtained for six stages is shown in the table overleaf.

The ‘live’ contacts on the diagonal board represent the steckers that can be deduced from the initial false stecker hypothesis that was chosen to start the process. The final number of 305 ‘live’ terminals obtained is only an approximation (about 2% too big) for the total number of (25 × 12) false steckers that would be expected to be obtained when using an open menu with 12 letters.

The final outcome obtained is that all but one of the contacts in each of the connected rows on the diagonal board become ‘live’. The remaining ‘non-live’ contacts will all be on one particular ‘line of electrical continuity’ that is electrically isolated from the others and these contacts represent in electrical terms the true stecker partners of the twelve letters on the menu. If the initial stecker hypothesis used happens to be true then only the contacts on the isolated line of continuity will become ‘live’.

The first machine to be fitted with a diagonal board became operational in late August 1940; it was a considerable improvement on the early prototype and operationally it proved to be very effective. Subsequently a large number of bombes of this type were manufactured, and for a time these was known as spider bombes. The probable reason for this name was that Welchman often referred to bombe menus as ‘webs’.

All of the ‘stops’ given by the bombe are detected by means of a test procedure that is carried out at each of the possible rotor settings, where at each setting the 26 alternative stecker hypotheses for a chosen input letter on the menu are tested simultaneously. In electrical terms the true stecker hypothesis is identified by a particular contact on one line of continuity through the scramblers that is found to be electrically isolated from all the others. Each of the contacts on this isolated line of continuity represents a possible stecker partner for the corresponding letter on the menu. When such a single line of continuity is detected by the logic circuits incorporated in the bombe it will automatically execute a ‘stop’. The information provided by a ‘stop’ consists of the rotor settings together with a corresponding possible stecker partner of the chosen input letter.

A serious problem that had to be dealt with was that in addition to the stop that provided the correct information, additional random stops could also occur. The number of random stops obtained depended on the structure of the menu and clearly it was necessary to be able to predict the number likely to be obtained from a given menu.

Consider a menu consisting of a single open network, (i.e. one without any loops). At each of the possible 26 × 26 × 26 rotor settings for a given rotor order, any initial stecker hypothesis, say g, for the chosen input letter A will lead to one stecker partner for each of the other letters on the menu, and so will satisfy the necessary condition for a ‘stop’ to occur. Hence the expected number of stops resulting from any initial stecker hypothesis = 26 × 26 × 26. In all there are 26 possible initial stecker hypotheses, so it follows that there are 26 × 26 × 26 × 26 (= 26⁴) possible combinations that will all satisfy the condition required for a stop to take place (i.e. 26 ‘stops’ for each of the possible rotor settings)!

Each ‘stop’ will lead to stecker partners for all the letters on the menu. For example the two letters E and F on the menu will have 26 × 26 possible different pairs of stecker partners (including ‘self-steckers’). The diagram shows the pair (E/c and F/k).

The Effect of the Presence of a Loop in the Menu

Suppose that the letters E and F are in positions on the menu such that the introduction of a new link between them will create a closed loop. This link has the important effect of reducing the number of possible stops by a factor of 26 which can be explained in the following way:

When the link between the letters E and F is added to the original menu, a restriction is imposed on the number of possible pairs of stecker partners for the letters E and F.

The diagram showing one possible pair of (x n) when letter x is encrypted through the new scrambler to give n, so that E/x ↔ F/n. consequently the corresponding pair of stecker partners for letters E and F is (x n). Since every scrambler permutation consists of thirteen pairs of reciprocal letter transpositions, the total number of possible pairs of stecker partners for letters E and F is reduced from (26 × 26) to (2 × 13) = 26.

Thus the introduction of the additional link has the effect of reducing the number of possible pairs of stecker partners by a factor of 26, and consequently there will be the same reduction factor for the number of stops obtained when the new link is added to the menu. Hence the expected number of random stops obtained with a simple menu with one loop = 26⁴/26 = 26³ (i.e. one for each of the possible rotor settings.)

In general if the links in a menu result in the formation of c loops then the number of random stops S obtained is given by the expression:

S = (26⁴)/26^c = 26^4−c

Turing carried out a mathematical investigation to estimate how effective the diagonal board was in reducing the number of random ‘stops’, and produced a very useful table that enabled an accurate estimate to be found for the number of random stops to be expected from a given menu (he described this work as ‘very tedious and uninteresting’). This table was based on an expression for the expected number of random stops in terms of the number of loops c on the menu and a factor F that depended on the number of letters it had:

Estimated number of random stops = 26^4−c × F

He derived numerical values of the factor F for different numbers of letters on the menu showing that the number decreased very rapidly as the number of letters increased. (It is worth noting that without the diagonal board the number of random stops entirely depended on the number of loops.)

One particular entry from Turing’s table shows that for a menu of 12 letters, F = 0.0018. This result can be used to illustrate the beneficial effect of the diagonal board.

Let the number of random stops obtained from a menu with 12 letters and c loops when using the diagonal board = N.

Then	N = 264−c× 0.0018

Suppose that another ‘stronger’ menu with 12 letters and k loops (where k is greater than c) would be required to produce the same number of random stops when the diagonal board is not connected:

Then	N = 264−k
Hence	264−c× 0.0018 = 264−k

After some simplification this reduces to: 26^k−c = 500

Hence	(k−c) = log (500) ÷ log (26) (≈ 1.90)
Hence	k ≈ c + 2

This result shows that for a menu of 12 letters the effect of the diagonal board is approximately equivalent to the addition of 2 additional loops.

In order to identify the correct ‘stop’ from all the other ‘random’ ones, each had to be subjected to a process of hand testing. The first step in this task was to use the information provided by the ‘stop’ to determine the stecker partners for all of the letters appearing on the menu that were implied by it. These implied stecker partners were tested for their logical consistency by checking to see that for every letter on the menu the implied stecker partner was unique. All of the ‘stops’ that failed to satisfy this requirement were regarded as being due to chance and would be rejected.

The task of finding the implied stecker pairs was carried out with the aid of a small ancillary piece of equipment known as a ‘checking machine’, but sometimes there were additional difficulties. If a menu happened to be made up of two or more unconnected parts (known as ‘webs’) then often some of the implied stecker pairs could not be found directly in this way and in such cases some additional deductive work would be necessary to find them.

To come to an understanding of the function of the checking machine, consider again a menu previously given but now re-arranged into the equivalent form shown in the diagram below.

Suppose that a particular bombe stop found from this menu gave the rotor settings: H B L together with the stecker pair S/I. The validity of this stop would have been checked in the following way:

From the ‘stop’ it is known that letter S has letter I as its stecker partner, and so logically letter I should have letter S as its stecker partner. However the partners of the other letters Q, F, E, H and U are currently unknown. Let these unknown letters be represented by the Greek letters: α, β, γ, δ, and ε, so that Q/α, F/β, E/γ, H/δ and U/ε are the unknown stecker pairs.

From the stecker pair S/I given by the ‘stop’ it follows from the information in the diagram that if the letter I is used as the input to the scrambler system adjusted to ‘position 21’ that the output letter from this scrambler will be the implied stecker partner of letter Q on the menu. It is in fact found that α ≡ Q, indicating that letter Q must be ‘self-steckered’ i.e. Q/Q. (The standard German practice was to use six self-steckers in each Enigma key.)

In the same way by using this implied letter Q as the input to the next scrambler adjusted to ‘position 3’ the output letter obtained will be the implied stecker partner of letter I on the menu. For logical consistency this must be the letter S, otherwise there would be a contradiction with the stecker pair S/I given by the bombe ‘stop’. So if a different letter were to be obtained then this would show that the ‘stop’ was a random one.

Supposing, however, that the letter S was obtained, then the testing procedure would be continued with letter S now being used as the input to the scrambler adjusted to ‘position 12’, so that the output β will be the implied stecker partner for letter F. This process could be continued for all the letters on the menu. If any logical inconsistency were to be discovered between the results then the ‘stop’ would be regarded as ‘random’ and would be rejected. This would happen if, for example, the two inconsistent implied stecker pairs T/F and U/T were to be obtained.

If no inconsistencies were found between any of the implied stecker partners for all of the letters on the menu then the stop was said to have provided a ‘partial key’. If the partial key were set up on an Enigma machine then it would decrypt all the letters from the crib that had been used for the menu, but not usually the complete message because it was unlikely that the restricted number of letters on the menu would have enabled deductions to be made for all the ten stecker pairs that ultimately had to be found.

The checking machine used special drums that were similar in their design to the German Enigma rotors as they also had adjustable rings, unlike the drums used on the bombe. The machine had a fourth drum that functioned as an adjustable pre-set reflector. The machine also had 26 keys for the input letters and the same number of lamps to indicate the output letters. The selection of the drums and their ring settings was made to correspond to the information given by the ‘stop’ on the bombe. The set of drums on the checking machine would then be moved in turn to correspond to the positions given on the menu. As one stecker pair had already been given by the ‘stop’, the implied stecker partners for all of the other letters on the menu could then be found in turn.

Summary

After a menu had been set up on the bombe and a chosen set of drums had been installed, the machine would be systematically run through all of the possible starting positions, and at each of them tested for the condition that had to be satisfied to ensure that a unique stecker partner existed for a preselected letter on the menu. If at the end of a ‘run’ with a chosen rotor order all of the ‘stops’ that had been obtained were found to be false then another rotor order would have to be tried. The small number of partial keys obtained from the ‘stops’ that passed all the tests made by the checking machine were subjected to further examination. A brief account of how this was done will be given later.

If the unfortunate circumstances arose when none of the partial keys provided the complete key, then the validity of the menu had to be questioned, both with respect to its position relative to the letters in the original cipher text and also its literal accuracy.

Further Development of the Bombe

By the end of 1941 a more advanced version of the bombe (known as ‘Jumbo’) had been developed. This was fitted with additional circuitry that enabled a second test to be automatically carried out when the basic conditions for a ‘stop’ had occurred. The second test was designed to eliminate all those ‘stops’ that led to a ‘legal contradiction’, which the earlier versions of the machine were unable to detect. This second test checked the logical consistency of all the stecker pairs that could be directly deduced from the menu and if an inconsistency was detected then the new machine ignored the basic ‘stop’ condition that had occurred and continued with the ‘run’. If, however, no inconsistencies were found then the machine did stop and automatically printed out all of the stecker pairs that could be directly deduced from the menu.

The introduction of Jumbo eliminated a major part of the hand-based work that had previously been necessary but, as only a few of these machines were actually made, the bulk of the work throughout the war was carried out on the spider bombes, of which over 200 were in service by the end of the war in Europe. This new version of the machine provided no more information about the stecker pairs than was intrinsically available on the original bombes, but by automatically eliminating all the inconsistent random ‘stops’ and printing out details of the remaining ones, Jumbo made it possible to run much weaker menus successfully. The few Jumbo machines that were made were reserved for work on important messages that had only provided very weak menus and were expected to generate large numbers of random stops when used with a spider bombe.

The following extract from an internal memorandum from Welchman to Travis (September 1941) is of interest:

Dear Commander Travis,

The problems which we have to deal with in HUT 6 fall into two main classes – those in which we have to try 17,576 positions per wheel order, and those in which we need only try a limited number of positions. Problems of the first class can only be dealt with by means of a bombe, and the possibility of dealing with a particular problem depends chiefly on the strength of the menus that can be prepared. For running on a standard bombe a menu must be strong enough to produce a small number of stops because the testing of a large number of stops would take too much time. Weaker menus can be run on Jumbo because the machine tests its own stops, but the menus that can be run are limited by two factors. When a menu is so weak that Jumbo has to stop hundreds of times in each run, the running time is too long. Also when Jumbo produces a large number of stories, which have to be examined, the time and labour required for this part of the work becomes excessive …

At present we have eight bombes of which only one is a Jumbo.3

Difficulties Caused by Middle-Rotor Turnovers

A matter of vital importance that arose during the construction of the menus was the possibility that at some position within the span of the crib a middle-rotor turnover had occurred on the Enigma machine when the message had been encrypted. There was no prior way of knowing if this had happened, and if one had taken place and was not allowed for in the menu, then the ‘stops’ found in the subsequent bombe runs would all be wrong. Since a turnover on the middle rotor of an Enigma machine always occurred at some position during the encrypting of a sequence of 26 consecutive letters, it follows that for an menu to have more than an even chance of success its span could not exceed 12 consecutive positions of the cipher text.

During the war several procedures were devised to overcome this difficulty, for example from a crib spanning consecutive positions it was possible to derive two menus each spanning 13 of these positions so that if the middle-rotor turnover occurred in one of them then it could not have occurred in the other. However, this approach often resulted in two relatively ‘weak’ menus (i.e. containing less than 2 loops) which could result in an undesirable large number of random stops.

Other methods involved making a sequence of trial runs using different assumed positions for the middle-rotor turnover. As these runs had to be repeated for each of the rotor orders that were to be tested, these procedures were often very time-consuming.

The bombes were designed with three banks of 12 ‘scramblers’, each scrambler consisting of three vertically aligned drums to emulate the three rotors in the Enigma machine. Then, provided that the menu used did not contain more than 12 letter pairs from the crib, this arrangement made it possible to try out three different menus or rotor orders simultaneously.

One remarkably innovative procedure was proposed by John Herivel, the originator of the ‘Herivel Tip’. It appears in a BP research paper he wrote in the autumn of 1940 and required only one bombe run for each of the rotor orders to be tested.4 However, during this single run on the bombe the machine had to be manually halted by the operator several times to enable changes to be made to the offsets of some of the middle drums.

In his paper Herivel expressed his understanding that there were plans to modify the electrical design of the first bombes and ‘to interchange the slow and fast wheel’. This change made it possible for the bombe operators to use this new procedure he proposed. (In more recent times this perhaps unexpected design feature of the standard British bombes has often been a source of confusion.)

With this modification, the slow bottom drums on the bombe (that now represented the ‘fast’ right-hand position Enigma rotor) only stepped on at infrequent intervals thus making it easy to anticipate their arrival at particular offset positions so that the operator could manually halt the machine. The special menus that required changes to be made to some of the offsets of the middle drums during the course of a single run became known as ‘hoppity’ menus.

To assist with an explanation of this ‘hoppity procedure’, a dummy message consisting of 22 characters was encrypted using the following Enigma key:

Reflector: B

Rotor order (L M R): 3, 2, 1

Ring settings: Z Z J,

Message settings: P S B

Steckers: A/C, B/Z, E/L, D/T, F/M, G/S, J/X, K/N, R/H, U/W

As the turnover notch on the ‘fast’ Enigma rotor (rotor 1) is located between the letters Q and R on its ring, when this rotor steps on from positions Q to R a middle-rotor turnover will occur. The ‘fast’ rotor setting given in the key is B, and this is 2 places ‘in front’ of Z on the ring. Consequently when the plain text was encrypted, a turnover of the middle rotor (from position S to position T) occurred when the right-hand rotor stepped on after the fifteenth position in the message (the seventeenth position on the ring scale) as shown in the following table.

The menu shown below was constructed from this table which spans 22 consecutive positions, with a middle-rotor turnover occurring immediately after the seventeenth position.

If this menu is used on the bombe it will fail to find the correct ‘stop’ unless measures are used to take the Enigma middle-rotor turnover into account. This can be done by advancing the offsets of the middle drums in the links 16 to 22 from Z to A. After the menu had been modified in this way a run on an emulation of a bombe gave the correct bombe stop P S R (the correct initial rotor settings relative to ring settings Z Z Z).

Finding the Ring Settings

According to Welchman in The Hut Six Story: ‘The ring settings had to be worked out by crypto-analytical techniques and that sometimes proved troublesome.’

By means of a menu based on a crib, the bombe provided part of the original Enigma key that had been used to encrypt the message. From this information it was then usually possible to derive the complete set of 10 stecker pairs so that the known parts of the key then consisted of the rotor order, 10 stecker pairs, and the starting positions of the three Enigma rotor cores based on the ring settings Z Z Z.

The original German ring settings would almost certainly have been different from the assumed ring settings, and consequently if the latter were used in an attempt to decrypt the entire message, the turnover positions of the middle and left-hand rotors would be wrong. Frequently it was possible to decrypt a part of the message with these wrong ring settings, up to the position where the first middle-rotor turnover took place. This could happen before or after the position where it had originally occurred when the message was being encrypted, as determined by the unknown German ring settings.

Following on from this position the decryption of the cipher text would ‘go wrong’ producing only random characters. However, it was sometimes found that at some later position in the cipher text, an additional sequence of letters would be correctly decrypted.

A real example of this is given in the table above. The first row is the cipher text, and the second is the decrypt obtained using the key found by means of the bombe which gave the drum starting positions H T N (i.e. Enigma settings H T M) relative to the assumed ring settings Z Z Z. The third row is the correct plain text from the message.

It will be seen that the decrypt does ‘go wrong’ at position 14 but ‘comes right’ again at position 22 (8 places further on). The reason for this is that during the decrypting process, a turnover of the middle rotor occurred ‘too soon’ at position 14 so that the assumed ring-setting Z for the right-hand rotor must be ‘moved back’ by 8 positions from Z to R.

When the ring settings are changed to Z Z R, to maintain the wiring cores of the rotors at their orientations the Enigma rotor starting position must also be changed from H T M to H T E. After making these adjustments the decrypt obtained is entirely correct. This is shown in the third row of the table.

As the ring settings Z Z R enable the entire message to be decrypted it follows that the right-hand ring setting R must be correct because the turnover of the middle rotor now occurs at the correct place. It is, however, very unlikely that the ring settings of the other two rotors are those originally used by the German operator, as there are numerous combinations of ring settings and rotor starting positions that could have been used.

To find the original ring settings of these two rotors used it is necessary to carry out a search procedure involving a sequence of trials carried out on emulations of the Enigma machine. These trials are based upon the two groups of three letters of the message ‘indicators’ that had been included with the cipher message in the original W/T transmission. Some additional information might have been available that reduced the number of possible ring settings (e.g. German Air Force ‘Ringstellung rules’). However, a worst-case scenario will require up to 26 × 26 ( = 676) trials.

The following straightforward example is based upon the wartime message given above with the provisional Enigma key: rotor order 1, 2, 5; message settings T H E; ring settings Z Z R.

When used with the correct set of steckers, the ring settings Z Z R and rotor settings H T E, the provisional key correctly decrypted the entire message. The intercepted indicator letter groups for the message (included in the original W/T transmission) were: M A F P K R.

Theory of the Procedure

Suppose that the true message settings and ring settings are respectively x y z and α β δ. Then from the given indicator groups M A F and P K R it follows that with:

Enigma rotor settings =	M A F and ring settings = α β δ
	x y z will be encrypted as P K R

The procedure begins by configuring an Enigma machine (or an emulation of one) so that with:

Enigma rotor settings =	M A F and ring settings = Z Z R
	H T E will be encrypted as ? ? ?

As the two rotor configurations H T E/Z Z R and x y z/α β δ decrypt the message correctly both of them must define the same set of orientations of the rotor cores

It follows that, starting with the message indicator H T E and the ring settings Z Z R, if both are progressively advanced by one position at a time, the orientation of the rotor cores will remain the same and consequently at some stage the rotor settings H T E will have been transformed to x y z and the corresponding ring settings will have been transformed to α β δ. When this stage is reached then the unknown letters x y z will be encrypted to P K R.

So the procedure begins with the Enigma rings set to Z Z R and the letter group H T E is encrypted to see if the outcome is indeed P K R. If this is not the case then the ring setting is advanced from Z Z R to Z A R and likewise the middle letter of the letter group H T E advanced by one position from T to U and the resulting letter group H U E is encrypted and the outcome checked as before.

This procedure may have to be repeated many times. However, eventually, at some stage in this process, the outcome will be P K R, at which point the true ring settings α β δ and the original message settings x y z will both be given by the current configuration of the machine.

The ring settings and letter groups for the first four trials are as follows:

At some stage the required combination as shown below is bound to arise:

Enigma rotor settings	M A F and ring settings X N R
	F H E will be encrypted as P K R

Thus it is evident that the original ring settings and message settings were respectively X N R and F H E.

The Rotor Turnovers

The turnover notches on the Enigma rotors are located at particular positions on their rings. For the first five rotors the positions of the single notch were as follows:

The extra rotors VI–VIII used by the German Navy had 2 turnover notches on their rings and this could result in a considerable reduction in the length of the Enigma rotor cycle. For example if Navy rotors were used in the middle and right-hand position of the Enigma machine then the rotor cycle length was reduced to 4,056 (26 × 12 × 13). This shows that, although the use of rotors with more than one notch gave some advantages, it also had the effect of reducing the length of the Enigma rotor cycle. (The number given can be obtained by an analysis similar to that given above.)

Using ‘Cillies’ to Reduce the Possible Number of Rotor Orders

The fact that rotors I–V have distinctive notch positions on their rings made the Enigma machine less secure than it would have otherwise been. Indeed in 1940 one of the repeated lapses in security made by the Enigma operators made it possible to use the distinctive turnover positions of these rotors to reduce the number of rotor orders that had to be checked when recovering the keys. (The first success using the procedure now to be described was achieved with a German message in which the three letters C I L formed part of the indicator, hence the term ‘cillies’.)

Cillies resulted from a lazy practice adopted by some Enigma operators when encrypting a multi-part message. After encrypting the first part of such a message, some operators often used the three letters of the current positions of the rotors (known at BP as the ‘end positions’) as the indicator settings for the second part of the message and would repeat this practice for any further parts.

As the number of letters in each part of the message was invariably included in its preface (transmitted in clear) it was then possible to reduce significantly the number of rotor orders that could have been used. Beginning with the known length of the first part of the message and ‘working back’ from the ‘end positions’ of the rotors (as disclosed by the first group of three letters in the indicator for the second part of the message), the possible message settings used for the first part of the message could be found.

Let the number of letters in the first part of the message be X. Suppose that at the completion of the process of encrypting the first part of the message the middle rotor had moved on by q positions and that the right-hand rotor had finished p positions from its starting position, then X = 26q + p (where q and p are positive integers). Note also that, because of the limit the Germans set on their message lengths, for all the messages X < 250. Thus 26q + p < 250, and hence q < 10.

For example, given that X = 247 then the only possible values for p and q are p = 13 and q = 9 (247 = 26 × 9 + 13)

The rotor order that had been used would have been unknown and hence so would the positions of the turnover notches on the rings of the three rotors. However, the charts below and overleaf give the procedures that were used for ‘working backwards’ to find the possible rotor starting positions to encrypt the first part of the message. This shows that there are 4 possibilities to consider, each based on different assumptions for the locations of the turnover notches on the middle and right-hand rotors.

Length of the message =	X characters
	X = 26q + p
(i.e. Rotor R makes q complete revolutions + p additional steps)

The notch on rotor R is not within the p steps. The notch on rotor M is not within the q steps it makes. To restore to the original message settings:- Move rotor R back by p positions Move rotor M back by q positions (Setting position of rotor L is not changed)

The notch on rotor R is within the p steps The notch on rotor M is not within the resulting (q + 1) steps it makes. To restore to the original message settings:- Move rotor R back by p positions. Move rotor M back by (q + 1) positions.

The notch on rotor R is not within the p steps. The notch on rotor M is within the q steps it makes (i.e. double stepping of M occurs). To restore to the original message settings:- Move rotor R back by p positions Move rotor M back by (q + 1) positions. Move rotor L back by one position.

The notch on rotor R is within the p steps. The notch on rotor M is within the resulting (q + 1) steps (i.e. double stepping of M occurs). To restore to the original message settings:- Move rotor R back by p positions. Move rotor M back by (q + 2) positions. Move rotor L back by 1 position.

So on the assumption that the German operator had used the lazy procedure previously described, it followed that one of only four possible message settings could have been used to encrypt the first part of a multipart message.

Another procedural mistake was often made by the operators that enabled three of these possibilities to be eliminated. Some of them adopted the practice (contrary to instructions) of using 2 related groups of three letters for their indicators based on their own choice of 6-letter word or obtained by using letters that were in convenient (adjacent) positions on the German key-board.

When this practice had been adopted it was often fairly obvious from the first group of letters in the indicators that this had been done thus enabling the message settings to be inferred.

Indicator setting	Indicator	Likely message setting
LON	XJF	DON
QWE	GHT	RTZ
HIT	VZQ	LER
QAY	HMB	WSX
WER	RTG	ASD

Bearing this in mind, the 4 possible message settings derived for the first part of the message would be compared with those directly inferred from the indicators to see if there was a common three-letter group.

The occurrence of such a letter group provided strong evidence to support the conclusion that the common message settings thus identified were in fact correct. Once the message settings had been found they could be used to reduce the number of possible rotor orders that had to be tested.

For example suppose that the first part of a multi-part message consists of 247 letters and has the indicators LONMRF, and that the second part of the message has the indicators EZAFVQ.

Consider the first part of the message. From the indicator settings LON it is feasible to assume that the message settings are possibly DON.

Supposing that after the operator had encrypted the first part of the message he had used the ‘end positions’ of the rotors as the indicator settings for the second part of the message. Then by working back from the ‘end positions’ EZA through the 247 letters of the first part of the message, using the procedures outlined in the above chart, 4 possible message settings are found: EQN, EPN, DON and DPN. (Readers may wish to confirm these results!). This new evidence now confirms the assumption that the message setting is likely to be DON. This result can now be used to derive some information about the rotor order used.

When the 247 characters (= 26 × 9 + 13) of the first part of the message were encrypted the positions of the three rotors changed from DON to EZA, showing that the left-hand rotor had moved on by one place.

This implies that the notch on the middle rotor must have been located between letters O and Z on its ring, so that only Rotors I or III could have occupied the middle position in the Enigma machine.

Since the position of the middle rotor changed from O to Z, it must have stepped through 11 positions, while the right-hand wheel made 9 complete revolutions and an additional 13 steps.

In each revolution of the right-hand rotor the notch on its ring would have caused the middle rotor to move on by one place thus resulting in 9 places in all. However, when the notch on the middle rotor caused the left-hand rotor to step from D to E, the middle rotor would step on again by one place because of the ‘double stepping’ of this rotor that would occur. This brings the total number of steps of the middle rotor so far accounted for to 10 steps.

The fact that the middle rotor stepped on by a total of 11 places, implies that another step must have occurred at some point during the additional 13 steps of the right-hand rotor between letters N and A. Consequently the notch on the ring of the right-hand rotor must have been located at one of the 13 positions between these two letters.

Hence it has been deduced that the right-hand rotor must have been either rotors I or III or V. The following table shows all of the rotor orders that are possible when the above restrictive conditions are applied.

So by means of these empirical methods the number of possible rotor orders has been reduced from 60 to 12. (The above example was created by means of a computer emulation of an Enigma machine using the rotor order III, I, V). Appendix 3 includes an authentic description of this method written by Dennis Babbage in correspondence with Welchman in 1982.