The Enigma machine

The Enigma was the rotor machine Germany used to protect its military radio traffic in the Second World War. Each key press sent a current through a set of rotating wheels and a plugboard, turned it back at a reflector and lit one of 26 lamps. The wheels moved after every letter, so the same letter came out differently each time. Poland broke the early machine in 1932, Britain and its allies broke the wartime versions, and the intelligence that came from it, code-named Ultra, shaped the war. Cleverness alone didn't do it. The machine's weaknesses were small and specific, and some were the operators' fault.

Try it

Nothing you type here leaves your browser.

It's the same simulator as on the Enigma simulator page. Choose "Dönitz message" from the examples to load a real message from 1 May 1945, with its true settings, and watch it decrypt.

How it works

An Enigma is a keyboard, a plugboard, three (or four) rotors, a reflector and a lamp board. A key press does the following, in this order.

1. The rotors step. The right rotor turns one place, and sometimes the middle and left rotors turn too (see below). This happens before any current flows, so even the first letter of a message uses moved rotors.
2. The current goes through the plugboard. If the letter has a cable, it's swapped with its partner.
3. Then through the rotors, right to left. Each rotor is a disc with 26 contacts on each face, wired to the other face in a scrambled order. Each one substitutes the letter, and each is turned a different amount, so the substitutions change as the rotors move.
4. The reflector turns it round. The reflector pairs up the 26 letters, so the current goes back in on a different contact.
5. Back through the rotors, left to right, along the same wires in the opposite direction, then through the plugboard again, and a lamp lights.

Every wire carries current in both directions and the reflector pairs letters, so if A lights B, then B would light A with the rotors in the same position. That makes the Enigma reciprocal: the same settings encrypt and decrypt, so an operator only had to type a message in. It's also the machine's most famous flaw, because the reflector means a letter can never be encrypted to itself.

The double step

Each rotor has a notch on its alphabet ring. When the right rotor passes its notch it pushes the middle rotor one place, and when the middle rotor reaches its own notch it pushes the left one. But the middle rotor's notch also catches a pawl on the left rotor from the other side. So when the middle rotor sits at its notch, it moves again on the next press, along with the left rotor. The middle rotor sometimes steps on two consecutive key presses.

With three rotors the quirk shortens the cycle from 26 × 26 × 26 = 17,576 positions to 26 × 25 × 26 = 16,900 before the settings repeat. That's a small gift to a cryptanalyst, and a standard test of whether a simulator is right.

The key: what had to be set

An operator set up the machine each day from a printed key sheet, then chose a fresh setting for each message. The daily key had four parts.

• Rotor choice and order. Three rotors chosen from five (Army and Air Force, from December 1938) or eight (Navy), in a given order.
• Ring settings. The position of each alphabet ring on its rotor.
• Plugboard. Usually ten cables, swapping ten pairs of letters.
• Start position. The letters showing in the windows when the message begins, chosen by the operator for each message and sent in a short indicator group.

Counting the choices gives these figures, from scripts/examples/enigma-keyspace.mjs:

The first total, about 1.59 × 10²⁰, is the figure usually quoted, and it corresponds to roughly 67 bits. Most of it comes from the plugboard, which on its own contributes more than a fourth rotor would. For comparison, a simple substitution cipher has 26! (4 × 10²⁶) keys and is broken by hand, and a 128-bit AES key has 2¹²⁸. The number of keys was never the point, because a clever attack never tries them all.

History

The German engineer Arthur Scherbius applied for a patent on a rotor cipher machine in February 1918. After the war he founded a company, Chiffriermaschinen AG, in 1923 to sell it to businesses under the name Enigma. The German Navy adopted a version in 1926, and the Army's own version was in place by about 1928. In mid-1930 the Army's Enigma I, with a plugboard, entered service. The Navy brought in the M3 in 1934, the Air Force adopted the Army machine in 1935, and in December 1938 the Army added two more rotors, IV and V, to choose from. The U-boat fleet's four-rotor M4 followed on 1 February 1942. An estimated 40,000 machines were built.

How it was broken

Poland came first. In December 1931 French intelligence passed to the Polish Cipher Bureau documents that a German spy, Hans-Thilo Schmidt, had supplied from the cipher office in Berlin, with more material in 1932. A young Polish mathematician, Marian Rejewski, working with Henryk Zygalski and Jerzy Różycki, used the mathematics of permutations together with those documents to work out the wiring of the rotors in December 1932. A procedural weakness helped him. Operators encrypted the three-letter message key twice at the start of every message, which gave a pattern that could be analyzed without knowing the machine's wiring. The Poles built an electromechanical device to search the possibilities, the bomba kryptologiczna, in 1938 (six were built in Warsaw before September 1939), and a set of perforated sheets, the Zygalski sheets. On 26–27 July 1939, with war near, they shared their results, methods and reconstructed machines with French and British intelligence at a meeting near Warsaw.

Then Britain. At Bletchley Park, from September 1939, Alan Turing and Gordon Welchman built on the Polish work and designed the British Bombe, which tested possible rotor settings against a guessed piece of plaintext. Welchman's idea of a diagonal board, which exploited the plugboard's symmetry, made it far more effective, and the first Bombe, Victory, was delivered on 18 March 1940. The Germans stopped doubling the message key on 1 May 1940, which ended the Polish method, but by then the British had other tools. They read a great deal of German traffic for most of the war, and the intelligence they gained, called Ultra, was shared with Allied commanders under tight control.

The four-rotor M4 introduced for U-boat communications in February 1942 was a setback. For most of 1942 the U-boat traffic couldn't be read, until captured material and more Bombe capacity brought it back.

The weaknesses that did it

• No letter encrypts to itself. This is a consequence of the reflector. If you know or guess a word in the plaintext (a crib), you can slide it along the ciphertext and throw out every alignment in which a letter lines up with itself. In the Dönitz message, the 15-letter word REICHSMARSCHALL has 358 possible places in the 372-letter ciphertext. The rule removes 161 of them at once, 45%, and the true position survives. That's how the cribs the Bombe needed were found.
• Predictable text. Many messages, such as the daily weather reports, followed a fixed format, which gave cribs. Operators also sometimes chose lazy message keys such as AAA or BBB, which Bletchley Park staff called cillies.
• Short, rigid procedures. The doubled indicator was the Poles' way in. Later operator shortcuts gave the British another, known as the Herivel tip after John Herivel, who worked it out at Bletchley Park in January 1940.

The machine's mathematics was never the whole story. The Enigma was a very good cipher used with human habits, and it was broken at the point where the two met.

The Dönitz message

On 1 May 1945, Admiral Karl Dönitz sent the last major message of the German Navy's high command, announcing that Hitler had named him as his successor. It went out on an M4 with the Greek rotor Beta, rotors V, VI and VIII, ring settings EPEL, thin reflector C, and the plugboard AE BF CM DQ HU JN LX PR SZ VW, started at CDSZ. The simulator above decrypts it exactly, down to the garbled letters from transmission errors. It begins KRKRALLEXXFOLGENDESISTSOFORTBEKANNTZUGEBEN, German for "to all … the following is to be made known at once", where X stands for a full stop. It's also a unit test of this site, since the project's tests decrypt the whole text.

The code

// The Enigma, in one function. `rotors` run left to right, each {wiring, notch, ring, pos} with ring and pos as numbers 0-25 (notch is a
// string of letters; four rotors means an M4, whose first, Greek, rotor never steps). `reflector` is a 26-letter wiring and `plugboard` a
// string of paired letters such as 'AVBSCG'. Returns the text with every letter put through the machine.
function enigma(text, rotors, reflector, plugboard) {
  var A = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ', n = rotors.length, out = '';
  rotors = rotors.map(function (r) { return { wiring: r.wiring, notch: r.notch, ring: r.ring, pos: r.pos }; });   // leave the caller's settings alone
  function plug(c) { var i = plugboard.indexOf(c); return i < 0 ? c : plugboard[i ^ 1]; }                         // 'AV': A and V swap
  function through(r, c, back) {                                                                                  // one rotor, one direction
    var shift = (r.pos - r.ring + 26) % 26, i = (A.indexOf(c) + shift) % 26;
    var o = back ? r.wiring.indexOf(A[i]) : A.indexOf(r.wiring[i]);
    return A[(o - shift + 26) % 26];
  }
  text.toUpperCase().replace(/[^A-Z]/g, '').split('').forEach(function (ch) {
    var R = rotors[n - 1], M = rotors[n - 2], L = rotors[n - 3];
    var stepM = R.notch.indexOf(A[R.pos]) >= 0, stepL = M.notch.indexOf(A[M.pos]) >= 0;                          // look at the notches first
    if (stepL) { L.pos = (L.pos + 1) % 26; M.pos = (M.pos + 1) % 26; }                                            // the double step
    else if (stepM) M.pos = (M.pos + 1) % 26;
    R.pos = (R.pos + 1) % 26;
    var c = plug(ch), i;
    for (i = n - 1; i >= 0; i--) c = through(rotors[i], c, false);                                                // right to left
    c = reflector[A.indexOf(c)];                                                                                  // the reflector turns the current round
    for (i = 0; i < n; i++) c = through(rotors[i], c, true);                                                      // left to right, by the same wires backwards
    out += plug(c);
  });
  return out;
}

Common questions