With this modification, the slow bottom drums on the bombe (that now represented the ‘fast’ right-hand position Enigma rotor) only stepped on at infrequent intervals thus making it easy to anticipate their arrival at particular offset positions so that the operator could manually halt the machine. The special menus that required changes to be made to some of the offsets of the middle drums during the course of a single run became known as ‘hoppity’ menus.
To assist with an explanation of this ‘hoppity procedure’, a dummy message consisting of 22 characters was encrypted using the following Enigma key:
Reflector: B
Rotor order (L M R): 3, 2, 1
Ring settings: Z Z J,
Message settings: P S B
Steckers: A/C, B/Z, E/L, D/T, F/M, G/S, J/X, K/N, R/H, U/W
As the turnover notch on the ‘fast’ Enigma rotor (rotor 1) is located between the letters Q and R on its ring, when this rotor steps on from positions Q to R a middle-rotor turnover will occur. The ‘fast’ rotor setting given in the key is B, and this is 2 places ‘in front’ of Z on the ring. Consequently when the plain text was encrypted, a turnover of the middle rotor (from position S to position T) occurred when the right-hand rotor stepped on after the fifteenth position in the message (the seventeenth position on the ring scale) as shown in the following table.
The menu shown below was constructed from this table which spans 22 consecutive positions, with a middle-rotor turnover occurring immediately after the seventeenth position.
If this menu is used on the bombe it will fail to find the correct ‘stop’ unless measures are used to take the Enigma middle-rotor turnover into account. This can be done by advancing the offsets of the middle drums in the links 16 to 22 from Z to A. After the menu had been modified in this way a run on an emulation of a bombe gave the correct bombe stop P S R (the correct initial rotor settings relative to ring settings Z Z Z).
Finding the Ring Settings
According to Welchman in The Hut Six Story: ‘The ring settings had to be worked out by crypto-analytical techniques and that sometimes proved troublesome.’
By means of a menu based on a crib, the bombe provided part of the original Enigma key that had been used to encrypt the message. From this information it was then usually possible to derive the complete set of 10 stecker pairs so that the known parts of the key then consisted of the rotor order, 10 stecker pairs, and the starting positions of the three Enigma rotor cores based on the ring settings Z Z Z.
The original German ring settings would almost certainly have been different from the assumed ring settings, and consequently if the latter were used in an attempt to decrypt the entire message, the turnover positions of the middle and left-hand rotors would be wrong. Frequently it was possible to decrypt a part of the message with these wrong ring settings, up to the position where the first middle-rotor turnover took place. This could happen before or after the position where it had originally occurred when the message was being encrypted, as determined by the unknown German ring settings.
Following on from this position the decryption of the cipher text would ‘go wrong’ producing only random characters. However, it was sometimes found that at some later position in the cipher text, an additional sequence of letters would be correctly decrypted.
A real example of this is given in the table above. The first row is the cipher text, and the second is the decrypt obtained using the key found by means of the bombe which gave the drum starting positions H T N (i.e. Enigma settings H T M) relative to the assumed ring settings Z Z Z. The third row is the correct plain text from the message.
It will be seen that the decrypt does ‘go wrong’ at position 14 but ‘comes right’ again at position 22 (8 places further on). The reason for this is that during the decrypting process, a turnover of the middle rotor occurred ‘too soon’ at position 14 so that the assumed ring-setting Z for the right-hand rotor must be ‘moved back’ by 8 positions from Z to R.
When the ring settings are changed to Z Z R, to maintain the wiring cores of the rotors at their orientations the Enigma rotor starting position must also be changed from H T M to H T E. After making these adjustments the decrypt obtained is entirely correct. This is shown in the third row of the table.
As the ring settings Z Z R enable the entire message to be decrypted it follows that the right-hand ring setting R must be correct because the turnover of the middle rotor now occurs at the correct place. It is, however, very unlikely that the ring settings of the other two rotors are those originally used by the German operator, as there are numerous combinations of ring settings and rotor starting positions that could have been used.
To find the original ring settings of these two rotors used it is necessary to carry out a search procedure involving a sequence of trials carried out on emulations of the Enigma machine. These trials are based upon the two groups of three letters of the message ‘indicators’ that had been included with the cipher message in the original W/T transmission. Some additional information might have been available that reduced the number of possible ring settings (e.g. German Air Force ‘Ringstellung rules’). However, a worst-case scenario will require up to 26 × 26 ( = 676) trials.
The following straightforward example is based upon the wartime message given above with the provisional Enigma key: rotor order 1, 2, 5; message settings T H E; ring settings Z Z R.
When used with the correct set of steckers, the ring settings Z Z R and rotor settings H T E, the provisional key correctly decrypted the entire message. The intercepted indicator letter groups for the message (included in the original W/T transmission) were: M A F P K R.
Theory of the Procedure
Suppose that the true message settings and ring settings are respectively x y z and α β δ. Then from the given indicator groups M A F and P K R it follows that with:
Enigma rotor settings =
M A F and ring settings = α β δ
x y z will be encrypted as P K R
The procedure begins by configuring an Enigma machine (or an emulation of one) so that with:
Enigma rotor settings =
M A F and ring settings = Z Z R
H T E will be encrypted as ? ? ?
As the two rotor configurations H T E/Z Z R and x y z/α β δ decrypt the message correctly both of them must define the same set of orientations of the rotor cores
It follows that, starting with the message indicator H T E and the ring settings Z Z R, if both are progressively advanced by one position at a time, the orientation of the rotor cores will remain the same and consequently at some stage the rotor settings H T E will have been transformed to x y z and the corresponding ring settings will have been transformed to α β δ. When this stage is reached then the unknown letters x y z will be encrypted to P K R.
So the procedure begins with the Enigma rings set to Z Z R and the letter group H T E is encrypted to see if the outcome is indeed P K R. If this is not the case then the ring setting is advanced from Z Z R to Z A R and likewise the middle letter of the letter group H T E advanced by one position from T to U and the resulting letter group H U E is encrypted and the outcome checked as before.
This procedure may have to be repeated many times. However, eventually, at some stage in this process, the outcome will be P K R, at which point the true ring settings α β δ and the original message settings x y z will both be given by the current configuration of the machine.
The ring settings and letter groups for the first four trials are as follows:
At some stage the required combination as shown below is bound to arise:
Enigma rotor settings
M A F and ring settings X N R
F H E will be encrypted as P K R
Thus it is evident that the original ring settings and message settings were respectively X N R and F H E.
The Rotor Turnovers
The turnover notches on the Enigma rotors are located at particular positions on their rings. For the first five roto
rs the positions of the single notch were as follows:
The extra rotors VI–VIII used by the German Navy had 2 turnover notches on their rings and this could result in a considerable reduction in the length of the Enigma rotor cycle. For example if Navy rotors were used in the middle and right-hand position of the Enigma machine then the rotor cycle length was reduced to 4,056 (26 × 12 × 13). This shows that, although the use of rotors with more than one notch gave some advantages, it also had the effect of reducing the length of the Enigma rotor cycle. (The number given can be obtained by an analysis similar to that given above.)
Using ‘Cillies’ to Reduce the Possible Number of Rotor Orders
The fact that rotors I–V have distinctive notch positions on their rings made the Enigma machine less secure than it would have otherwise been. Indeed in 1940 one of the repeated lapses in security made by the Enigma operators made it possible to use the distinctive turnover positions of these rotors to reduce the number of rotor orders that had to be checked when recovering the keys. (The first success using the procedure now to be described was achieved with a German message in which the three letters C I L formed part of the indicator, hence the term ‘cillies’.)
Cillies resulted from a lazy practice adopted by some Enigma operators when encrypting a multi-part message. After encrypting the first part of such a message, some operators often used the three letters of the current positions of the rotors (known at BP as the ‘end positions’) as the indicator settings for the second part of the message and would repeat this practice for any further parts.
As the number of letters in each part of the message was invariably included in its preface (transmitted in clear) it was then possible to reduce significantly the number of rotor orders that could have been used. Beginning with the known length of the first part of the message and ‘working back’ from the ‘end positions’ of the rotors (as disclosed by the first group of three letters in the indicator for the second part of the message), the possible message settings used for the first part of the message could be found.
Let the number of letters in the first part of the message be X. Suppose that at the completion of the process of encrypting the first part of the message the middle rotor had moved on by q positions and that the right-hand rotor had finished p positions from its starting position, then X = 26q + p (where q and p are positive integers). Note also that, because of the limit the Germans set on their message lengths, for all the messages X < 250. Thus 26q + p < 250, and hence q < 10.
For example, given that X = 247 then the only possible values for p and q are p = 13 and q = 9 (247 = 26 × 9 + 13)
The rotor order that had been used would have been unknown and hence so would the positions of the turnover notches on the rings of the three rotors. However, the charts below and overleaf give the procedures that were used for ‘working backwards’ to find the possible rotor starting positions to encrypt the first part of the message. This shows that there are 4 possibilities to consider, each based on different assumptions for the locations of the turnover notches on the middle and right-hand rotors.
Length of the message =
X characters
X = 26q + p
(i.e. Rotor R makes q complete revolutions + p additional steps)
The notch on rotor R is not within the p steps.
The notch on rotor M is not within the q steps it makes.
To restore to the original message settings:-
Move rotor R back by p positions
Move rotor M back by q positions
(Setting position of rotor L is not changed)
The notch on rotor R is within the p steps
The notch on rotor M is not within the resulting (q + 1) steps it makes.
To restore to the original message settings:-
Move rotor R back by p positions.
Move rotor M back by (q + 1) positions.
The notch on rotor R is not within the p steps.
The notch on rotor M is within the q steps it makes (i.e. double stepping of M occurs).
To restore to the original message settings:-
Move rotor R back by p positions
Move rotor M back by (q + 1) positions.
Move rotor L back by one position.
The notch on rotor R is within the p steps.
The notch on rotor M is within the resulting (q + 1) steps (i.e. double stepping of M occurs).
To restore to the original message settings:-
Move rotor R back by p positions.
Move rotor M back by (q + 2) positions.
Move rotor L back by 1 position.
So on the assumption that the German operator had used the lazy procedure previously described, it followed that one of only four possible message settings could have been used to encrypt the first part of a multipart message.
Another procedural mistake was often made by the operators that enabled three of these possibilities to be eliminated. Some of them adopted the practice (contrary to instructions) of using 2 related groups of three letters for their indicators based on their own choice of 6-letter word or obtained by using letters that were in convenient (adjacent) positions on the German key-board.
When this practice had been adopted it was often fairly obvious from the first group of letters in the indicators that this had been done thus enabling the message settings to be inferred.
Indicator setting
Indicator
Likely message setting
LON
XJF
DON
QWE
GHT
RTZ
HIT
VZQ
LER
QAY
HMB
WSX
WER
RTG
ASD
Bearing this in mind, the 4 possible message settings derived for the first part of the message would be compared with those directly inferred from the indicators to see if there was a common three-letter group.
The occurrence of such a letter group provided strong evidence to support the conclusion that the common message settings thus identified were in fact correct. Once the message settings had been found they could be used to reduce the number of possible rotor orders that had to be tested.
For example suppose that the first part of a multi-part message consists of 247 letters and has the indicators LONMRF, and that the second part of the message has the indicators EZAFVQ.
Consider the first part of the message. From the indicator settings LON it is feasible to assume that the message settings are possibly DON.
Supposing that after the operator had encrypted the first part of the message he had used the ‘end positions’ of the rotors as the indicator settings for the second part of the message. Then by working back from the ‘end positions’ EZA through the 247 letters of the first part of the message, using the procedures outlined in the above chart, 4 possible message settings are found: EQN, EPN, DON and DPN. (Readers may wish to confirm these results!). This new evidence now confirms the assumption that the message setting is likely to be DON. This result can now be used to derive some information about the rotor order used.
When the 247 characters (= 26 × 9 + 13) of the first part of the message were encrypted the positions of the three rotors changed from DON to EZA, showing that the left-hand rotor had moved on by one place.
This implies that the notch on the middle rotor must have been located between letters O and Z on its ring, so that only Rotors I or III could have occupied the middle position in the Enigma machine.
Since the position of the middle rotor changed from O to Z, it must have stepped through 11 positions, while the right-hand wheel made 9 complete revolutions and an additional 13 steps.
In each revolution of the right-hand rotor the notch on its ring would have caused the middle rotor to move on by one place thus resulting in 9 places in all. However, when the notch on the middle rotor caused the left-hand rotor to step from D to E, the middle rotor wou
ld step on again by one place because of the ‘double stepping’ of this rotor that would occur. This brings the total number of steps of the middle rotor so far accounted for to 10 steps.
The fact that the middle rotor stepped on by a total of 11 places, implies that another step must have occurred at some point during the additional 13 steps of the right-hand rotor between letters N and A. Consequently the notch on the ring of the right-hand rotor must have been located at one of the 13 positions between these two letters.
Hence it has been deduced that the right-hand rotor must have been either rotors I or III or V. The following table shows all of the rotor orders that are possible when the above restrictive conditions are applied.
So by means of these empirical methods the number of possible rotor orders has been reduced from 60 to 12. (The above example was created by means of a computer emulation of an Enigma machine using the rotor order III, I, V). Appendix 3 includes an authentic description of this method written by Dennis Babbage in correspondence with Welchman in 1982.
Appendix 3
A Comedy of Errors
Most of the books that were published in the 1970s to tell the story of Bletchley Park gave the impression that Enigma was a problem which the British and American cryptanalysts had solved. It would seem that both GCHQ and the NSA had no quarrel with this impression being given. However, Welchman and most of his Hut 6 colleagues did not agree and he explained why in The Hut Six Story:
Gordon Welchman Page 32