Breaking the Enigma Dmitri Gabbasov June 2, 2015 1 Introduction Enigma was an electro-mechanical machine that was used before and during the World War II by Germany to encrypt and decrypt secret messages. Invented by Arthur Scherbius in 1918 and meant initially as a commercial product for the enterprise community, Enigma turned out to be more successful with the German military forces [2]. Enigma had evolved throughout several years, gaining better cryptographic strength, but also being broken time and again. In this report we give a general description of an Enigma machine. We describe the shortcomings of the machine and its early operating procedures. Based on a paper by M. Rajewski [1] we outline the key methods used to break the Enigma before World War II. 2 The Enigma machine The Enigma machine is a combination of mechanical and electrical subsystems. Its main com- ponents are a keyboard, a plugboard, a lampboard and a set of rotating disks called rotors arranged adjacently on a spindle (figure 1). The mechanical parts act in such a way as to form a varying electrical circuit. When a key is pressed, one or more rotors move to form a new rotor configuration, ultimately lighting up one display lamp, which shows the output letter (figure 2). 2.1 Rotors The rotors were one of the most important parts of an Enigma machine. An Enigma had typically three rotors, along with a so called reflector and an entry wheel. The rotors had 26 contacts on both sides – one for each alphabet letter (figure 3). Inside a rotor, small wires connected the contacts on one side with the contacts on the other side in some irregular order – a rotor effectively represented a permutation of the alphabet. Electrical current entering through a contact on one side would leave through some contact on the other side. The reflector had contacts only on one side, and a current entering one of the contacts would leave through some other contact. The entry wheel also had 26 contacts on one side, those were connected to the keyboard. Altogether, a current would enter through the entry wheel, go through a number of rotors, then through the reflector, again through the rotors (in reverse order and using different contact paths) and then leave through the entry wheel. 1 Figure 1: A typical Enigma machine. The entry wheel was stationary. The rotors, however, could be rearranged and each one could be turned into one of 26 possible positions. The reflector was mostly stationary, although there were also Enigma models where the reflector could be set into different positions just like rotors. With each keypress, the leftmost rotor advances by one position, this we refer to as the stepping movement. At certain positions it also makes the second rotor advance by one, which in turn can make the third rotor advance. The movement is similar to that of an odometer. Each rotor consists of two parts – the rotor core and the alphabet ring. The electrical contacts are attached to the core. The ring has letters on its outside surface. These letters can be seen through the holes when the Enigma machine is being used, and they were used to identify the position of the rotor. The alphabet ring can be rotated around the core, meaning there are in fact 26 ways to combine the core with the ring. The alphabet ring also has a notch (or several notches) that determines when the neighboring rotor is to be turned. Early models of Enigma came with a set of three rotors that could be placed into the machine in any order, giving a total of 6 rotor placement combinations. Later, the set was increased to five rotors with three placed into the machine at any given time – this increased the number of combinations to 60. Most of the rotors were identified by Roman numerals, and each issued copy of rotor I was wired identically to all others. By itself, a rotor performs only a very simple type of encryption – a simple substitution cipher. For example, the contact corresponding to the letter E might be wired to the contact for letter T 2 Figure 2: Internal wiring of Enigma (only 4 keys/lamps shown for simplicity). The A key is pressed and the lamp corresponding to the letter D lights up. Red lines and arrowheads show the flow of the current. on the opposite side, and so on. Enigma’s security came from using several rotors in series and the regular stepping movement of the rotors, thus implementing a polyalphabetic substitution cipher. It is also important to note that because of the reflector the Enigma machine was reciprocal, meaning that encryption and decryption procedures were identical. One could type in plaintext and get the ciphertext, and similarly type in the ciphertext and get the plaintext; this is assuming that certain starting settings, which we will describe later, are the same in both cases. 2.2 Plugboard The plugboard allowed for variable rewiring of certain connections by the operator. It consisted of 26 sockets – one for each letter. A wire could be inserted into any two sockets, the effect was to swap the corresponding letters before and after the main rotor scrambling unit. For example, if E and Q are swapped, when an operator presses E, the signal was diverted to Q before entering the rotors. 3 Figure 3: Two Enigma rotors. Electrical contacts on both sides can be seen. There is a notch on the alphabet ring of the right rotor next to the letter D. Initially, only 6 pairs of letters were swapped during normal operation of the machine, meaning that 14 letters were unaffected. Later, the number was increased to 10, leaving only 6 letters unaffected. 2.3 Mathematical analysis The Enigma transformation for each letter can be specified mathematically as a product of permutations. Let S denote the plugboard transformation, L, M, R the transformations of the left, middle and right rotors respectively, U the reflector transformation and P a simple rotation (a → b, b → c,..., z → a). Then the encryption E can be represented as E = S(P xRP −x)(P yMP −y)(P zLP −z)U(P zL−1P −z)(P yM −1P −y)(P xR−1P −x)S−1, where x, y, z ∈ {0,..., 25} represent the starting positions of the rotors. Note, that even though there are 263 = 17576 ways to choose x, y and z and 3! = 6 ways to arrange the three rotors, it is the U (plugboard) transformation that can have ca. 1011 (6 swapped pairs) or 1.5 × 1014 (10 swapped pairs) different forms [4]. For an Enigma with a set of three rotors and a plugboard with 6 swappable pairs the total number of possible transformations E is 10 586 916 764 424 000 ≈ 253. The previous number merely represents the possible transformations of a single letter. Because with each keypress E changes, we will need to also count the number of ways that E can change in order to know how many different polyalphabetic substitution ciphers an Enigma machine can represent. This depends on the position of the alphabet rings on two of the rotors (because the rings have the notches that make the neighboring rotor turn). There are 262 = 767 ways to set the alphabet rings, thus together there are ca. 263 different polyalphabetic ciphers an Enigma may implement. 4 3 Operating procedures For a message to be correctly encrypted and decrypted, both the sender and the receiver had to configure their Enigma in the same way – the rotor order, rotor starting positions and plugboard connections must be identical. Some of these settings were established beforehand and distributed to different German military units in codebooks, others were chosen by the operator to be different for each message. An Enigma machine’s initial state, or what today might be called the cryptographic key, con- sisted of a number of things: • rotor order – in later Enigma models not just the order, but also the chosen subset of rotors (e.g. rotors III, I and VI out of possible 8, in that order), • initial positions of the rotors – usually represented by letters that would be visible through the holes in the machine (e.g. AOH), • ring setting – the positions of alphabet rings with relation to the rotor cores, also repre- sented via three letters, • plugboard connections – the 6 (or in later models 10) pairs of letters that were swapped on the plugboard (e.g. EG DO LP). Most of the key was kept constant for a set time period, typically a day. However, a different initial rotor position was used for each message, a concept similar to an initialization vector in modern cryptography. The starting position for the rotors, referred to as the message key, was transmitted just before the ciphertext, usually after having been enciphered. The exact method used was termed the indicator procedure and changed over time. Design weakness and operator sloppiness in these indicator procedures were two of the main weaknesses that made breaking Enigma possible. In the period 1930–1938 the procedure was for the operator to set up his machine in accordance with the daily settings that he received from the codebook. This included (in addition to the rotor order, the ring setting and the plugboard connections) a global initial position for the rotors – the so called ground setting (e.g. AOH). The operator turned the rotors into that position, he then chose his own arbitrary starting position (e.g. EIN) – the message key – and typed it in twice to get six letters of ciphertext (e.g.