The Zschweigert – A Remarkable Early Machine

Klaus Schmeh Private Scholar www.schmeh.org [email protected]

Abstract chiffrierter Schriftstucke¨ (“Machine for produc- The Zschweigert Cryptograph is one ing enciphered documents”) by German engineer of the many machine designs Rudolf Zschweigert. We will refer to this machine developed in the years following the First as Zschweigert Cryptograph. World War (1914-1918). It was invented To the author’s knowledge, the Zschweigert by textile engineer Rudolf Zschweigert, Cryptograph was never built (perhaps with the ex- who had designed programmable stitching ception of prototypes that are now lost), let alone machines before and apparently transfered used in practice. The only known source de- his computing expertise to cryptology. scribing this machine is a patent filed by Rudolf Unlike the Enigma and as good as all Zschweigert in 1919 and granted one year later other crypto devices of the time, the (Zschweigert, 1920). Zschweigert Cryptograph implements a Though it was never used in practive, the transposition cipher, not a substitution Zschweigert Cryptograph is note-worthy for sev- cipher. To the author’s knowledge, it was eral reasons: the first encryption machine that worked • Contrary to virtually all other mechani- with keys provided on punched cards. cal and electric cipher machine designs, The goal of this paper is to introduce the the Zschweigert Cryptograph implements a Zschweigert Cryptograph and its history, transposition cipher (not a substitution ci- to provide a mathematical specification of pher). This property is the reason why this its encryption algorithm, and to explore machine is mentioned in (LANAKI, 1996) how it can be cryptanalyzed. It will be and (Nichols, 1998). However, both sources shown that the Zschweigert Cryptograph, give no description of the Zschweigert Cryp- which was probably never used in prac- tograph. As far as the author knows, nothing tice, was insecure even by the standards detailed has ever been published about this of the 1920s and not convenient enough to device, except the patent. The Zschweigert compete with other encryption machines Cryptograph should not be confused with the of the time. transposition cipher tool (it’s not really a ma- chine) invented by Luigi Nicoletti in 1918, which is mentioned in (Kahn, 1996). 1 Introduction • The Zschweigert Cryptograph was invented It is a well-known fact that the failure of almost all by a textile entrepreneur. As is well known, important (manual) encryption systems used in the the textile industry adapted computing hard- First World War led to the invention of numerous ware long before encryption technology did. encryption machines in the years after. Among As will be shown, the Zschweigert Cryp- the best-known crypto devices of this era are the tograph represents a design that transferred Enigma, the Hebern rotor designs, the en- computing expertise from the textile industry cryption machines and Arvid Damm’s cipher de- to cryptology. vices – just to name a few. A lesser known encryption machine from the • The Zschweigert Cryptograph is the earliest post-WW1 years is the Maschine zum Herstellen cipher machine the author is aware of that ap-

Proceedings of the 3rd International Conference on Historical Cryptology, HistoCrypt 2020 126 plies a punched card as .  0 0 0 1 0 0 0 0 0   0 0 0 0 0 0 1 0 0     0 0 0 0 0 1 0 0 0    2 Rudolf Zschweigert  1 0 0 0 0 0 0 0 0  0 0 0 0 0 1 0 0 0 Rudolf Zschweigert (1873-1947) was a German In the following, we will denote the position of engineer, who lived in the cities of Chemnitz, the one in row i as ki. In other words: Plauen, and Hof, Germany. In the 1930s, he was a member of the city council of Hof. He was mar- ki = j :⇔ Ki, j = 1 ried to Gertrud (1891-1982). Zschweigert is best remembered for having built up a major mineral The key space of the Zschweigert Cryptograph and meteorite collection, which is today preserved is, of course, dependent on n, the number of rows in the Museum Reich der Kristalle in Munich, Ger- of the matrix. As there are nine possibilities for many (Wilson, 2019). each row, the number of keys is 9n. This means Rudolf Zschweigert’s professional dedication that with a 40-rows matrix, exhaustive key search was that of a textile manufacturer and factory is about as laborious as with a 128-bit key. owner. The Weberei Zschweigert (“Weaving Mill The alphabet used by the Zschweigert Crypto- Zschweigert”) existed from 1921 to the 1960s. Be- graph is not specified in the patent. Instead, it is tween 1909 and 1934, Zschweigert was granted assumed that every character provided by the type- at least 15 patents in Germany, Austria, Switzer- writer in use can be encrypted. To keep things sim- land and the USA. 14 of these patents concerned ple, we assume that only upper-case letters from A textile technology, especially looms and stitching to Z are encrypted, which makes an alphabet of 26 machines. Zschweigert’s only patent not related characters. It seems likely that such an alphabet to textiles is the one relating to the encryption ma- would also have been used in practice. chine discussed in this paper. We denote the plaintext as P = pi with i = Rudolf Zschweigert was not the only cipher 0,1,...,l − 1 and l being the number of letters in machine inventor with a background in the tex- the plaintext. As an example, we take Pexample := tile industry. A second and much more promi- ”HISTOCRYPTTWENTY”, which means that nent person of this kind was Swedish engineer p0 = ”H”, p1 = ”I”, p2 = ”S”,..., p15 = ”Y” and Arvid Damm (1869-1927), who cooperated with l = 16. his country man in the 1920s and The is represented by another matrix, laid the foundation of what was to become Crypto C. C has nine columns. The elements of C are AG, a company that still exists today (Hagelin, from the set {A,...,Z,−} with ”−” representing a 1994). null character. At the beginning, all elements of C are set to ”−”. When we write C, we omit all lines containing only the null character. 3 Specification of the Encryption Algorithm 3.1 Encryption To define the encryption algorithm, we need the In the following, we provide a formal specifica- following function: tion of the encryption algorithm implemented by the Zschweigert Cryptograph. It is based on the Write-to-Matrix (C,column ∈ {1...9}, p ∈ informal description in the patent. {A,...,Z}) The Zschweigert Cryptograph uses a 9×n i = 0 binary matrix K as key, with n being a positive while Ci,column 6= ” − ”: i = i + 1 integer. Every row of K has a Hamming weight Ci,column := p of one, which means that there is exactly one one return C per row, while the eight other values are set to zero. Here’s an example (with n = 5) we denote The encryption algorithm is specified as fol- as Kexmpl: lows:

Proceedings of the 3rd International Conference on Historical Cryptology, HistoCrypt 2020 127 Encrypt (P,K) 4 Construction of the Machine n := number of rows of K For i = 0 to l − 1: While the patent provides only short coverage of the encryption method (not to mention a theoreti- C := Write-to-Matrix (C,ki mod n, pi) return C cal foundation), the construction of the machine is described in great detail. This is probably because This means that the first letter of the plain- Rudolf Zschweigert was familiar with mechanical text takes the column of the one in the first line engineering, but not with cryptology. of the key matrix. The second character takes the As can be seen in figure 2, the Zschweigert column of the one in the second line and so on. Cryptograph is based on a mechanical typewriter. Each letter is written into the highest line of the Instead of printing on a piece of paper, this type- plaintext matrix that is still empty. writer prints on nine separate paper rolls. The roll used for a certain letter is controled by a unit that With Pexmpl and Kexmpl, we get the following works with a punched card. This punched card ciphertext (denoted as Cexmpl, see also figure 1): corresponds with the matrix introduced in the pre- vious chapter.  T − − H − SI − −  The punched card has nine columns and an ar-  P − − C − OR − −    bitrary number of rows. In each row, there is ex-  N − − T − YW − −    actly one hole. The mechanics of the machine al-  − − − Y − T − − −    ways move the type used to the paper roll that cor-  − − − − − E − − −  responds with the column of the current punched − − − − − T − − − card row and types a letter. Noting the ciphertext this way is unpractical After a letter has been typed, the respective if it is, for instance, sent by telegram. The patent roll turns up by one unit and the next row of therefore suggests the use of separators, but the punched card is read. When the end of the details are not given. A possible way to write punched card is reached, the control unit starts down the ciphertext is: TPN - - HCTY - SOYTET with the first row again. IRW - -. At the end, the user takes the nine paper rolls and reads the letter sequences on them. According to the patent, this can be done in a key-dependent 3.2 Decryption order. However, from a cryptographic point of view, changing the order of the rolls doesn’t make To define the decryption algorithm, we need the much sense, as this is equivalent with changing the following function: order of the columns on the punched card, which can be done while the card is produced (unless, the Read-from-Matrix (C,column ∈ {1...9}) card is reused and a different order of the rolls is i = 0 applied each time – a case we don’t cover in this while Ci,column = ” − ”: i = i + 1 paper). p := Ci,column If the encrypted message is transmitted by ra- Ci,column := ” − ” dio, the sender can read the ciphertext directly return p from the nine paper rolls and transmit them. If sent by letter, it is necessary to copy the ciphertext The decryption algorithm now can be speci- from the rolls (unless, of course, one doesn’t mind fied as follows: sending nine paper strips by mail). Decrypting works very similar as encrypting. Decrypt (C,K) Of course, an identical punched (key) card is nec- n := number of rows of K essary. No stylus is needed. The operator presses For i = 0 to l − 1: the space key repeatedly. The control unit will pi := Read-from-Matrix (C,ki mod n, pi) always move the paper roll to the center, where return P the next plaintext letter can be read. The receiver needs to copy each letter and thus receives the plaintext.

Proceedings of the 3rd International Conference on Historical Cryptology, HistoCrypt 2020 128 Figure 1: Using a matrix (represented by a punched card) as key, the plaintext HISTOCRYPT TWENTY is encrypted to a ciphertext that can be written as: TPN - - HCTY - SOYTET IRW - -.

It should be clear that encrypting a message To our knowledge, this question has never been re- with the Zschweigert Cryptograph is not espe- searched. cially convenient. The sender needs to copy the In the case of Rudolf Zschweigert, we have output in order to bring it to a format that can be found a source that might link the computing tech- sent by telegram or teletype. The receiver needs nology of the textile industry with cryptology. In to copy every decrypted letter from the machine. 1908, Zschweigert was awarded two patents for a This means that although the Zschweigert Cryp- stitching machine that is controlled by a punched tograph includes a typewriter, manual writing is card. The one patent concerns the machine it- necessary. self (Zschweigert, 1908a), the other one a device 5 Historical Background for punching the holes into the card (Zschweigert, 1908b). As is well-known, the textile industry played an It seems likely that this stitching machine laid important role in the history of information tech- the foundation for the Zschweigert Cryptograph nology. In 1804, Joseph Marie Jacquard intro- that was invented a decade later. While the duced the Jacquard machine, a loom controlled punched card in the stiching machine controled by punched cards (Jacquard, 2019). The Jacquard the production of a pattern on a piece of cloth, the machine (figure 5) is generally regarded as the first punched card in the cipher machine controled an programmable hardware in history. The concept encryption process on a typewriter. of programming a machine with a punched card became widely accepted in the 20th century, first To the author’s knowledge, the Zschweigert in Hollerith machines, later in computers. Cryptograph is the earliest cipher machine that It is an interesting question whether the crypto used punched-card keys. Many others were to fol- machine designs of aforementioned Swedish engi- low, including the HC-9 (Reuvers, 2019), the Fi- neer Arvid Damm were influenced by computing alka (Reuvers, 2019), the KW-7 (Reuvers, 2019), technology he encountered in the textile industry. and the T-310 (Schmeh, 2006).

Proceedings of the 3rd International Conference on Historical Cryptology, HistoCrypt 2020 129 Figure 2: The Zschweigert Cryptograph is based on a mechanical typewriter. It uses nine movable co- axial paper roles (left) that are contoled by a unit (right), the details of which are not depicted in this diagram. Source: Patent

Figure 3: The key of the Zschweigert Cryptograph is provided on a punched card with nine columns (right). Source: Patent

Proceedings of the 3rd International Conference on Historical Cryptology, HistoCrypt 2020 130 Figure 4: The Jacquard machine is a 19th century loom controled by a punched card. It is considered the first programmable device in history. Rudolf Zschweigert, a textile engineer, might have been influence by the Jacquard machine when he designed his punched-card controlled cryptograph. Source: Wikimedia Commons / 29263a,b / Dmm2va7

Proceedings of the 3rd International Conference on Historical Cryptology, HistoCrypt 2020 131 Figure 5: Rudolf Zschweigert invented a stitching machine that is controled by a punched card. It seems likely that this device machine laid the foundation for the Zschweigert Cryptograph. Source: Patent

6 Considerations sage, this can best be explained with a five-row matrix, the first row of which is used four times, When it comes to cryptanalyzing the Zschweigert while rows 2-4 are used three times each. This Cryptograph, two steps need to be distinguished. means that the key matrix has five rows. In the first one, the codebreaker tries to find out Of course, it is also possible that the number of how many rows the key matrix has; in the second rows is 16, which would mean that the matrix is as step, the position of the ones in the matrix is de- long as the plaintext. However, following Occam’s termined. When the matrix is completely recon- Razor, which states that the simplest explanation structed, the ciphertext can be easily decrypted. should be taken first, a cryptanalyst will usually start with examining the five-rows hypothesis. 6.1 Determining the Number of Matrix Rows Things might not always be this easy, especially The most obvious method for determining the when the plaintext is longer than in our example number of rows in the key matrix is brute force. If and the matrix has more rows. However, we as- we look at the example ciphertext Cexmpl, we see sume that guessing the number of rows in the key that it consists of 16 letters. With a computer pro- matrix will usually be possible. To find out more, gram it is not very difficult to check every matrix further research is necessary. length between, say, 4 and 16. We need to apply the second step (locating the ones in the matrix) 6.2 Locating the Ones in the Matrix on each of these candidates. We now assume that the number of matrix rows is While brute force (with a computer program) is known or that a guess has been made (for instance, certainly an appropriate approach today, the crypt- in the course of a brute-force attack). In the next analysts of the 1920s needed an attack that could step, we need to detemine the location of the ones. be carried out manually. In fact, such a method The task of the cryptanalyst becomes easier if the is available. If we look at our example ciphertext number of rows is considerably smaller than the Cexmpl=TPN - - HCTY - SOYTET IRW - -, we see message length, i.e., if each row is used to encrypt that the number of letters in the nine columns is 3, several letters. The case where the number of ma- 0, 0, 4, 0, 6, 3, 0, and 0. With the exception of 4, trix rows exceeds the plaintext length is not rele- each of these numbers is divisible by three. When vant, as we can always ignore the rows not used. 4 is divided by 3, the remainder is 1. Taking into In the example shown in figure 1 five matrix account that we are dealing with a 16-letter mes- rows encrypt a plaintext consisting of 16 letters.

Proceedings of the 3rd International Conference on Historical Cryptology, HistoCrypt 2020 132 One weakness of the Zschweigert Cryptograph sage encrypted with the Zschweigert Cryptograph is obvious: Just by looking at the ciphertext we is feasible, even with the means of a 1920 crypt- can easily derive the number of ones of each col- analyst. The machine can be made more secure by umn (i.e., the Hamming weight). If we look at using matrices with more columns and by forbid- the example ciphertext Cexmpl=TPN - - HCTY - ding the use of matrices that are shorter than the SOYTET IRW - -, we immediately see that the plaintext. Nevertheless, the author’s impression is second, the third, the fifth, the eigth, and the ninth that the concept of the Zschweigert Cryptograph column of the matrix must be empty, because there is not suitable for a reasonably secure encryption are no letters in the corresponding positions of the machine. Future research might go into more de- ciphertext. tail about this question. Considering that there are three letters in both 7 Future Work the first and in the seventh column of the cipher- text, we can conclude that each of the correspond- As far as the author of this work knows, this pa- ing matrix columns contains exactly one one. The per is the first publication about the Zschweigert six letters in the sixth ciphertext column lead to Cryptograph, except the patent. It is therefore ob- the conclusion that the sixth matrix column con- vious that additional research work is necessary tains two ones. The four letters in the fourth ci- in order to understand this machine and its back- phertext column are especially helpful, as they not ground. Especially, the following items should be only tell us that there is one one in the fourth ma- researched: trix column but also that this one is located in the top matrix row. • The biography of Rudolf Zschweigert ap- We have now reconstructed the first matrix row, pears to be not especially well documented. and we know that columns 2, 3, 5, 8, and 9 are While there is some information available on- empty. This leaves us with 4!=24 possibilities for line, the author of this paper is not aware of the positions of the ones in rows 2 to 5. We can a comprehensive overview, let alone a de- even reduce this number to its half because we tailed account of Zschweigert’s life. The know that there are two equal rows, which are in- author assumes that one needs to research terchangeable. So, in the end, there are only 12 the archives in Zschweigert’s home places combinations to try. With a computer program, Chemnitz, Plauen, and Hof in order to learn this can easily be achieved by brute force. more. If no computer is available, as it was the case • It is not known how Zschweigert came to the when the Zschweigert Cryptograph was invented, idea to construct an encryption machine and the technique of multiple anagramming, as de- how much he was influenced by the textile scribed by Helen Fouche´ Gaines in her book technology of the time and his own inven- Elementary Cryptanalysis, can be used (Fouche´ tions in this area. Perhaps, things become Gaines, 1939). The details are not within the scope clearer when more about Zschweigert’s biog- of this paper. raphy is known. Things become a little more complicated, of • In this paper, the author provided a few course, if we use a key matrix with more rows. approaches to cryptanalyze the Zschweigert This is especially the case if the matrix is as long Cryptograph. Further research might exam- as the plaintext. Multiple anagramming still seems ine this topic in more detail. Especially, it possible, even if it is much more laborious than will be interesting to explore additional meth- in the simple example we provided. We assume ods for determining the number of rows of that the computer-based technique of hill climb- the key matrix. In addition, the use of hill ing (Schmeh, 2017), which has proven extremely climbing or a similar technique for locating powerful in the breaking of historical , is the posisitions of the ones in the matrix de- the best means to attack a of this kind serves further investigation. and we believe that this approach would work well against the the Zschweigert Cryptograph. Again, • As mentioned, the Zschweigert Cryptograph the details are out of scope in this paper. is one of the first (or even the first) encryption Overall, we can conclude that breaking a mes- machines working with a key provided on a

Proceedings of the 3rd International Conference on Historical Cryptology, HistoCrypt 2020 133 punched card. Many others were to follow. References A comprehensive treatise of punched cards in Fouche´ Gaines, Helen. 1939. Cryptanalysis. Dover cryptology would be an interesting research Publications, New York, USA. project. Boris Hagelin. 1994. The Story of Hagelin Cryptos. • A software implementation of the algorithm Cryptologia Volume 18, 1994 (3):204-242 The Codebreakers of the Zschweigert Cryptograph or even a David Kahn. 1996. . Scribner, New York City, NY:764. simulator of the machine could be created. Such a program could be integrated into LANAKI. 1996. Classical Course. CrypTool or a similar software. www.ahazu.com/papers/lanaki:Lesson 21. Randall K. Nichols. 1996. ICSA Guide to Cryptogra- 8 Conclusion phy. McGraw-Hill, New York City, NY:153.

The 1920s were a special time in the history of Paul Reuvers, Marc Simons. 2019. The HC-9. mechanical encryption technology. On the one www.cryptomuseum.com. hand, the necessity for automated encryption had Paul Reuvers, Marc Simons. 2019. The . become evident, which led to the first generation www.cryptomuseum.com. of encryption machines being developed. On the other hand, the topic was not especially well un- Paul Reuvers, Marc Simons. 2019. The KW-7. derstood yet. This resulted in numerous cipher www.cryptomuseum.com. machine designs that were not suited for practi- Klaus Schmeh. 2006. The East German Encryption cal use. For instance, the first prototypes of the Machine T-310 and the Algorithm It Used. Cryp- Enigma (with up to seven rotors and a typewriter tologia Volume 30, 2006 (3):251-257 functionality) proved too complex and too expen- Klaus Schmeh. 2017. A mird in the hand is sive. Alexander von Kryha’s encryption machines worth two in the mush: Solving ciphers with had an impressing visual design and were mar- Hill Climbing. http://scienceblogs.de/klausis- keted very well, but were completely insecure. krypto-kolumne/2017/03/26/a-mird-in-the-hand-is- worth-two-in-the-mush-solving-ciphers-with-hill- The same is true for devices such as Cryptocode climbing/ and the Beyrer Cryptograph. Arvid Damm’s orig- inal designs were not very successful, either. Wikipedia entry ”Jacquard machine”. retrieved 2019- The Zschweigert Cryptograph fits perfectly 12-15. well with the aforementioned crypto devices. Wendell E. Wilson. 2019. Mineralog- Though it implements a few promising concepts – ical Record. Biographical Archive, at especially the punched card used as key –, it must www.mineralogicalrecord.com. be considered an experimental machine that was Rudolf Zschweigert. 1908. Einrichtung zum Verstellen not suited to be used in practice. des Stickrahmens fur¨ automatische Stickmaschinen. The transposition cipher the Zschweigert Cryp- Patentschrift 45620 des Eidgenossischen¨ Amts fur¨ tograph realizes turned out to be an evolutionary geistiges Eigentum vom 31. August 1908. dead end. No machine of this kind ever played a Rudolf Zschweigert. 1908. Kartenschlagmas- major role when machine encryption became pop- chine zum Lochen von Karten fur¨ Vorrichtun- ular in later years. gen zum automatischen Bewegen von Strickrahmen. Patentschrift 46570 des Eidgenossischen¨ Amts fur¨ Acknowledgments geistiges Eigentum vom 31. August 1908. Rudolf Zschweigert. 1920. Maschine zum Herstellen The author would like to thank Christiane Anger- chiffrierter Schriftstucke¨ . Patentschrift 329067 des mayr. Reichspatentamts ausgegeben am 12. November 1920.

Proceedings of the 3rd International Conference on Historical Cryptology, HistoCrypt 2020 134