The M-209 cipher machine

The M-209 was the American Army's pocket cipher machine of the Second World War, a mechanical device about the size of a lunch box that a sergeant could carry, crank by hand and use in a foxhole. It came from the Swedish engineer Boris Hagelin, more than 140,000 were built, and it stayed in American service through the Korean War. It was good enough for tactical messages, which need to stay secret for hours or days, and not good enough to protect much beyond that.

How it works

The M-209's secret is a set of six key wheels, each with a different number of positions: 26, 25, 23, 21, 19 and 17. Each position on a wheel carries a pin that the operator sets to one of two states, active or inactive, and the machine turns every wheel one place with each letter. Next to the wheels is a drum made of 27 bars, each with two lugs that the operator sets against particular wheels. For each letter, a bar whose lug sits against an active pin gets moved, and the number of bars that move gives a shift for that letter, as in a Caesar cipher.

The result is Beaufort-style: the ciphertext letter is the shift (from the drum) minus the plaintext letter, taken modulo 26 on a reversed alphabet. As with the Beaufort cipher, that makes the machine reciprocal. The same settings decrypt, and the operator only has to turn a knob from "encipher" to "decipher".

The key wheel sizes are chosen so they share no factor. All the wheels line up again only after 26 × 25 × 23 × 21 × 19 × 17 = 101,405,850 letters, far longer than any message. The daily key told the operator how to set each pin on each wheel and the lugs on the drum, and the message key told them where to start the wheels.

From Hagelin to the US Army

Boris Hagelin, a Swedish cryptographer, developed the machine as the C-38, an improvement on his earlier C-36. The US Navy designated it CSP-1500, and the US Army adopted it as the M-209. Smith Corona began building it in 1942 and made over 140,000, at about 400 a day. It gradually replaced the Army's older tactical cipher, the M-94 wheel cipher. Hagelin's postwar C-52 had a period of up to 2,756,205,443 letters.

Strength and weakness

The machine was designed for tactical use, where speed and portability mattered more than a long shelf life. It worked, and the Army used it widely, through the Korean War too. But it was never perfect. Its security was good for its time and far from complete. Early in 1943, German codebreakers could read between 10% and 30% of M-209 messages. A cryptanalyst with two messages that overlapped, a depth, could get a foothold into the settings, and the machine had quirks that helped an attacker. Operators who reused keys, or sent several messages with the same starting position, made it easier.

Much later, in the 1970s, the researchers James Reeds, Dennis Ritchie and Robert Morris developed an attack that could solve an M-209 message from the ciphertext alone, given at least 2,000 to 2,500 letters. The NSA asked them not to publish it. In 2016 and 2018, Lasry, Kopal and Wacker showed that modern computers could attack short messages that earlier attacks couldn't handle, using either ciphertext alone or known plaintext.

Timeline

The M-209 sits between the hand ciphers and the machines of the war's high commands. It was cheaper and simpler than the SIGABA, and stronger than a Vigenère cipher on paper.

What it shows

• Different jobs need different ciphers. A tactical message may lose its value in an hour, so a machine that costs a few days of effort to break is enough. A diplomatic message needs years.
• Coprime periods give length, not strength. A period of 101 million letters sounds secure, but the structure underneath it (a drum of bars, a fixed set of wheels) gives an attacker something to work on, and the period can run far longer than the effective security.
• Reciprocal is convenient. Like the Enigma and Beaufort, the same operation decrypts, which keeps the machine simple and also gives the cipher properties an attacker can use.

Common questions