by Kahn, David
In the end, what France and Britain lacked—and not only in cryptology—were vision and will. Poland had both. It was the great merit of Pokorny and Ciȩżki to have seen, before their counterparts in Europe’s other cipher bureaus, the value of cryptanalysts with a strong mathematics background. And the great need to know what Germany was planning drove those cryptanalysts to extraordinary efforts. So Poland did what no other country had done—and what the Germans believed impossible.
But the work of Rejewski, that modern magus, was far from finished. It had, in fact, just begun.
5
RACING GERMAN CHANGES
REJEWSKI’S GREAT SOLUTION HAD REPRODUCED THE ENIGMA AND solved a few German messages. But it did not enable the Poles to read messages regularly. Indeed, the very concept of the Enigma, the reason for the machine’s adoption, was that even if the enemy had a machine, he would not be able to obtain useful information from messages enciphered with it. So many keys were available, the thinking ran, that no cryptanalyst, or even team, would be able to find the right one before the messages had lost all military value. And the time it would take to solve an intercept was measured not in hours, not in days, but in years, in millennia.
Arthur Scherbius had enlarged the possible number of keys by proposing a machine with seven or even ten rotors. The German army had chosen instead to make the rotors changeable, to add alphabet rings, and to attach a plugboard. Their permutations raised the number of keys available to the astronomical figure of 10½ quadrillion. If 1,000 cryptanalysts, each with a captured or copied Enigma, each tested four keys a minute, all day, every day, the team would take 1.8 billion years to try them all. Since on average the codebreakers would reach plaintext halfway through, the typical solution would take them “only” 900 million years. For the Germans, this sufficed.
Rejewski thus faced a new and daunting task. Using Schmidt’s keys, he had reconstructed the Enigma. Now, using the reconstruction, he had to find each message’s key. And to decipher the German messages quickly enough to make current use of them, he obviously had to find a method other than exhaustive search.
For there were no flaws in the theory of the machine. It offered all the defenses that its inventor and proponents said it did; the Germans’ reasoning was impeccable, and their confidence was, in theory, not misplaced. But it was in practice. The ways in which men used the machine undermined its defenses. The army cryptographers’ requirement that message keys be duplicated and then enciphered created relationships that vastly reduced the number of trials cryptanalysts would have to make to find the right key. Cipher clerks made up message keys, such as ZZZ, that were so easy to guess that the number of trials was reduced even more, and signal officers drafted stereotyped plaintexts, also easy to guess, that cut the number still further. The failure was not, as a later generation would say, in the hardware: it was a software problem.
Rejewski recognized this and struck at the same chink in Enigma’s armor he had attacked at the start of his Enigma reconstruction: the doubling of the three-letter message key and its encipherment into a six-letter indicator.
But this time he had some help. “We can’t have you solving these messages by yourself,” Ciȩżki told him. “Now you’ll work together with your colleagues again. They’ll solve this material for the two months [for which Schmidt had supplied the keys], and I want you to think about how to go on from here.” And so Rejewski’s colleagues from Poznán, who had come to the Biuro Szyfrów with him, Henryk Zygalski, twenty-four, and Jerzy Różycki, twenty-three, were assigned to work with him in finding ways to recover the daily keys.
They were soon given replicas of the Enigma built by a small, specialized radio firm, one of whose founder-directors had served in the army from 1919 to 1922 with Ciȩżki. Another was Antoni Palluth, who had worked in BS-4 a civilian cryptanalyst and had been one of the lecturers at the Poznán cryptology course. The firm was the Wytwornia Radiotechniczna AVA, or AVA Radio Manufacturing Company (the letters were from the radio call signs—TPAV and TPVA—of two of the four owners, all fanatic radio amateurs). From time to time the Biuro Szyfrów had given the little shop orders for highly advanced or very secret or particularly specialized equipment. So it was natural for the cryptologists to turn to AVA when they needed a copy of the Enigma. The firm took as its model the commercial Enigma that the army had bought years before and the photographs of the military Enigma from the booklets provided by Schmidt.
When the Enigma first went into army service, many cipher clerks used patterned keys such as AAA and RXR. Because several clerks sometimes chose the same key, identical encipherments resulted now and then. The Poles occasionally solved these by the classical method of superimposition, but this did not lead them to a general solution of the Enigma. For when the Germans recognized that repeated letters in their message keys were letting clerks create identical keys too often, they prohibited the use of keys with repeated letters. The Poles discovered this when superimposition stopped working.
With his new AVA machines and his new assistants, Rejewski returned to the six-letter indicators. If he had between sixty and a hundred intercepts from a single day, he could generate several chains of letters, as he had done in his original solution. He used these chains to construct tables of letters that enabled him to determine whether the first and second letters of the message key were the same at a particular setting of the alphabet rings. If he found that the letters were the same, he ruled out that setting, because repeated letters in the message key were forbidden. With enough messages, he could eliminate enough settings so that only the correct settings would be left. (Of course, if a German cipher clerk violated the regulations, the Poles might not solve any messages that day.)
But this work told the Polish cryptanalysts only the letters on the alphabet rings that showed through the windows of the Enigma’s lid. They did not tell them which rotor was where. To ascertain this, they slid a grille—a sheet of paper with six narrow horizontal slots cut in it—with the first chain of letters written on it over tables of the cipher alphabets generated by each rotor. At each position of the grille, they sought pairs of letters. Six pairs on one table meant that they had found the correct rotor and its starting position. The tedium of this work was extreme. It took perhaps ten minutes to test just one setting of a rotor, and twenty-six settings had to be tested on all three rotors. Rejewski, Zygalski, and Różycki probably needed a whole morning to complete a test and find out which rotor was in the rightmost, or fast, position.
At first, the cryptanalysts had to repeat this process to determine the middle rotor. But they soon built up a catalogue that reduced this time to a few minutes.
They next had to find out where the alphabet rings had been set on the rotors. This was important because the rings carried the notches that stepped the rotor to the left. The cryptanalysts had two ways of determining this. One was to guess that a message began with An (German for “To”) followed by an X as a word separator. One out of every five German army messages began this way, and good results would eliminate many ring positions on the fast rotor, leaving only the 26 × 26, or 676, positions of the other two rings to be discovered. For the four out of five messages in which AnX did not work, the cryptanalysts had to try all 17,756 positions one after another, sometimes rubbing their fingers raw and bloody on the gearlike setting wheels.
Now the cryptanalysts had ascertained three of the four keying elements: rotor order, rotor setting, ring setting. Still unknown were the plugboard substitutions. But these affected only twelve letters; a test decipherment at this point would produce a quasi-plaintext such as (to use an English example) slarmlartsdmpaqmd, which a cryptanalyst could determine meant sparepartsdelayed. This would tell him the plugboard connections. With this information the day’s keys would be entirely reconstructed, that day’s messages could be read in their totality, and the work—painstaking, boring, grueling, but gloriously successful—could be completed, not in the 900 million years the Germans thought
it would take, but in less than a day.
This unbelievable solution, which enabled the Poles to read many German cryptograms, swamped the cryptanalysts. They could not both recover the keys and then apply them each day to decipher the several dozen intercepts that the monitoring posts sent in. So in February 1933, the Biuro Szyfrów hired five or six clerks, swore them to secrecy, hastily trained them in deciphering Enigma messages, and set them to work around the clock using the AVA Enigmas to turn the intercepts into plain language. By mid-1934, a dozen Enigma replicas were available for message reading and for key recovery.
For a couple of years this work proceeded smoothly. Even the unexpected signing in January 1934 of the Declaration of Nonaggression and Understanding with the German government, by then headed by Adolf Hitler, did not decrease the flow of solutions. The cryptanalysts looked down from their offices at German visitors, such as the fat and bemedaled air minister Hermann Göring, laying wreaths at the tomb of Poland’s Unknown Soldier, and smiled to themselves that he didn’t know that they knew his secrets.
Then, in 1935, Hitler threw off the restrictions of the Versailles treaty and began to triple the size of his army. This expansion was soon reflected in an upsurge in military communications. The cryptographers of the ChiStelle knew that the more messages in a given key a cryptanalyst has, the easier it is to read them. So, on February 1, 1936, they required that the rotor order be changed not quarterly but monthly. This reduced by a third the number of messages sent using a particular order. In October, as rearmament further swelled the volume of messages, they changed the number of connections in the plugboard from a fixed six to a variable five to eight. And at the same time, they raised the tempo of the changes in rotor order from monthly to daily.
The Poles saw that they could not rest on their laurels. The race between codemaker and codebreaker had quickened from a pace that in ages past had been measured in centuries and more recently in decades to one that was measured in years or months.
By this time the cryptanalysts were working in a communications and radio intelligence installation newly built in an area that was relatively free of radio interference: the Kabacki woods some 6 miles south of Warsaw and half a mile east of the village of Pyry. The installation was enclosed by a high wall, several hundred yards long on each side. Within stood two brick buildings, the larger a garage and warehouse, the smaller a two-story bombproof radio station and cryptanalytic office. Trees screened the facility from the air. The three young cryptanalysts and their deciphering staff commuted in a dark blue official bus that left Warsaw’s Theater Square near the general staff building every day at 7 A.M. and arrived twenty minutes later at the Pyry center.
They had plenty of work. The additional plugboard encipherments had caused solutions to plummet by some 40 percent, and the acceleration of the rotor order changes had greatly increased the cryptanalysts’ workload. They fought back with new insights and with mechanization.
Sometimes they found in the day’s harvest of six-letter indicators that a few Enigma operators had coincidentally chosen identical message keys out of the 17,756 possible keys. The cryptanalysts guessed that this happened because the operators had looked at the Enigma’s typewriter keyboard and had selected patterns that merely looked random, such as QWE or the diagonal REV. In those cases, instead of testing all 17,756 ring settings for the identical keys, the cryptanalysts had to try only some 30 or 40.
Mechanization saved more time. AVA built an electromechanical device that accelerated the recovery of rotor orders and settings. Called a cyclometer, it consisted of two linked sets of Enigma rotors. It served the Poles from 1936 to 1938, when, on September 15, the Germans changed their keying method. Rejewski soon found a way of determining the keys when the indicators in three messages fulfilled certain conditions. To speed this determination, he envisioned a device that consisted of three pairs of Enigmas. Each pair would have its rotors set at certain positions relative to one another based on the letters of the indicators. One pair would be testing the indicators of messages 1 and 2, another those of messages 1 and 3, and the third those of messages 2 and 3. The rotors of all three pairs would be driven through all their 17,756 positions looking for a three-way match. Such a match would reveal the rotor setting. It would not reveal the rotor order, however. So Rejewski proposed six machines to try all rotor orders at once.
His specifications were delivered to the AVA plant at Stepinska Street in the middle of October; less than a month later, the technicians under Palluth’s direction had manufactured the necessary parts for the six machines. They were assembled in a room called the clock room—from the large clock over its black-curtained door—in the BS-4 offices in the Pyry facility. The machines worked perfectly. The parallel processing of the keys took a maximum of two hours, but often a possible solution was reached sooner. The machine would stop when it came to a possible solution; the cryptanalyst would read off the key and try it on one of the Enigma replicas. If the key produced plaintext, it was right; if it produced gibberish, the cryptanalyst restarted the machine to try again. The Poles called the machines bomby, or bombs, perhaps from the rounded ice cream sundae (a bomba) Różycki was eating when the idea was being discussed, perhaps from their time-bomb-like ticking, perhaps from the idea that they would destroy the German cryptograms.
One weakness of this method was that the indicator letter relationships could be changed by the plugboard. When five to eight plugs were used, the method still worked, but only about half the time. To avoid this problem, Henryk Zygalski devised a method that used sheets of cardboard about 2 feet square. Each Zygalski sheet was divided into 51 × 51 squares by a repeated alphabet (A … Z, A … Y) along the top and side. Each sheet recorded, for a given position of the fast rotor, the positions of the other two rotors that created certain indicator letter relationships; this was done by cutting a hole at the proper intersection. The four sheets would be aligned and stacked over a source of light; the holes through which light shone would indicate a possible rotor sequence and ring setting, without having to know the plugboard connections. It was therefore a powerful technique. But each sheet needed to have about a thousand holes cut into it at precise points, and 26 sheets were needed for each of the 6 rotor orders—a total of 156 sheets. So their preparation went more slowly than the manufacture of the bomby.
Nevertheless, the volume of Polish solutions of Enigma messages swelled in 1938 to its greatest ever. Most of the intercepts were of transmissions from the War Ministry in Berlin to German Military District I in East Prussia, bordering Poland to the north. They dealt with personnel transfers and postings and the buildup of the army. The head of the German desk of the intelligence branch of the Polish general staff incorporated the information from the twenty-odd intercepts he received each week into his briefings of the chief of the general staff, which took place two or three times a week early in 1938 and daily from June on.
During all these years, France’s ace spy, Schmidt, met again and again with his handlers. After his six meetings in 1931 and 1932, he met eighteen more times with his French customers. Bertrand was present at all but three.
For him, the meetings began long before the actual contact with Schmidt. “Ah! Those departures from Paris, by taxi, at night, across the city, to get to the Gare du Nord or the Gare de l’Est [stations for rail lines to the north or to the east], among the neon lights and the often anxious thoughts, while I left all behind me—to find what ahead? And could ASCHE have been followed from Berlin?”
The circumstances of the meetings varied. Near the Czechoslovakian ski resort of Spindleruv Mlyn, Bertrand and another officer were astonished in September 1933 to see Schmidt get off a train in full Bavarian alpinist costume, complete with Tyrolean hat, suede shorts, and rucksack. He started hiking through the woods toward the Davidova Bouda Hotel, a twenty-seven-room mountain chalet somewhat off the beaten track. The Frenchmen, guns loaded, followed. At the rendezvous, they discovered, to their pleased surprise, tha
t the rucksack was filled with secret documents.
Schmidt was paid in reichsmarks in small and medium denominations placed in a small suitcase and deposited in the baggage room of a Berlin railroad station. The claim ticket was sent to him under a false name at general delivery, where he used a false identity card to pick it up. A postcard to his home notified him when the suitcase was ready.
The meetings from 1934 on took place in Switzerland, usually in Basel or Bern, except for one in Copenhagen in 1935 and one in Paris in August 1938. After his arrival in the City of Light, Schmidt drew the Enigma cipher keys for August and September out of a package of delicatessen food; he had given the package to the train conductor to put in a cool place, the conductor himself agreeing that the heat in the compartment would ruin the food. Schmidt expressed a desire to visit the Moulin Rouge nightclub in Montmartre, famous for its gorgeous seminude showgirls. Bertrand took him, accompanied by a young member of the French intelligence service, Paul Paillole. When Schmidt danced with one of the pretty women who hung around the club, Paillole was impressed by his unexpected grace and elegance. The two Frenchmen left Schmidt, in high good humor, drinking champagne with not one but two attractive women.
A few days later, Bertrand left for Warsaw, his twelfth trip delivering keys. But out of all this effort, the French were getting, they felt, no results. Bertrand had wondered about this situation as early as 1932. He had given the Poles the operating and keying instructions and one month’s keys in 1931 and had personally delivered three months’ worth of keys in two trips to Warsaw in 1932. As far as he knew, the documents had produced nothing of value. Was Schmidt feeding him phonies? Such things had happened before in espionage.
At the meeting at the Hotel d’Angleterre in Liège, Belgium, on October 29 and 30, 1932, Schmidt, after handing over a report on German maneuvers and the Enigma keys for November and December, had remarked to Bertrand, addressing him by his cover name: “Monsieur Barsac, I hope to be able to give you the daily keys every two or three months. With that you ought to be able to solve messages without too much trouble!”