by DAVID KAHN
If this were all there was to it, the rotor would not be so remarkable a device. Each time the a key was pressed, the current would trace the same path through the rotor to indicate R. This would be nothing more than a fancy and extremely expensive way of performing a monalphabetic substitution.
But there is much more. The rotor does not remain stationary. It turns. Suppose that it clicks forward one step. The current that formerly emerged at R after starting at input plate contact a will now exit at an entirely different letter because a new rotor contact, with a different wire path, now stands opposite input plate contact a. Similarly, all the other plaintext letters will have cipher letters different than before. This creates a new ciphertext alphabet. Each time the rotor moves forward a space, a new alphabet comes into play. A list of these alphabets can be made, and, since they are all based on the primary alphabet of the rotor, they will form a 26 × 26 tableau with a single mixed alphabet shifting one space forward in each successive line. If the machine is so constructed as to nudge the rotor forward one space each time a letter is enciphered, the result will be the same as using the tableau line after line, from top to bottom, and then repeating. This constitutes, of course, nothing more than a progressive-key polyalphabetic substitution with a mixed alphabet and a period of 26.
This is likewise not worth the expense of a machine. If, however, a second rotor be added by the side of the first, a great stride is taken. Two successive encipherments are produced. If the rotors move together, the result will still be a mixed-alphabet polyalphabetic with a period of 26, though with a tableau that represents their combined encipherments. But if the second rotor shifts a space only after the first rotor has completed its revolution, the change will vary the total encipherment: for though the first rotor is back in its original position with regard to the fixed plates, the second has moved. This new displacement brings into play a new cipher alphabet, the 27th. Each new variation in position between the two rotors and the plates creates a new alphabet. If the machine is so constructed that the second rotor moves forward a space only as the first is returning to its starting point, then it will take 26 revolutions of the first rotor to drive the second through one full revolution so that both return to their original stations. Since the second rotor assumes 26 positions, and the first rotor assumes 26 positions for each one of the second rotor’s, the two combined assume 26 × 26, or 676, different positions with regard to the fixed plates.
Each of these 676 different positions produces a different wire maze inside the pair of rotors, and each different maze means a different ciphertext alphabet. For imagine that both rotors are held steady in one position while each letter from a to z is tapped out on the keyboard. The bulbs that light up comprise the ciphertext equivalents for these letters, and those ciphertext equivalents taken as a whole comprise the ciphertext alphabet representing that particular maze. Let one rotor turn one space and the process be repeated, begetting another ciphertext alphabet. These two alphabets are brothers under the skin but superficially they differ. The substitute for e may be X in one and Z in the other. Consequently, the two-rotor machine produces a polyalphabetic substitution with a period of 676.
The addition of a third rotor multiplies that figure by 26, since all three rotors will not return to their starting position for 26 × 26 × 26, or 17,576, successive encipherments. Fourth and fifth rotors result in periods of 456,976 and 11,881,376 letters, respectively.
Each of those letters, moreover, is enciphered with a different ciphertext alphabet. In that lies the strength of the rotor system. The case differs from one in which an 11,881,376-character Vernam tape keys a message. The period is the same in both cases, but the Vernam employs only 32 different alphabets. Secrecy resides in the nonpattern in which they serve. Rotors, however, unfailingly turn one space per letter (barring gears to vary this), and consequently its alphabets succeed one another in the most rigid order, whose predictability hardly adds to the system’s security. When all have been used the sequence repeats. This is a progressive-key system and, considering that it was originated by the Abbot Trithemius, it is hardly new. But the rotor device carries the process to such astronomical lengths that a difference in degree becomes a difference in kind. The special merit of the rotor system springs from its outpouring of cipher alphabets in such hemorrhaging profusion as to provide a different alphabet for each letter in a plaintext longer by far than the complete works of Shakespeare, War and Peace, the Iliad, the Odyssey, Don Quixote, the Canterbury Tales, and Paradise Lost all put together.
A period of that length thwarts any practical possibility of a straightforward solution on the basis of letter frequency. This general solution would need about 50 letters per cipher alphabet, meaning that all five rotors would have to go through their combined cycle 50 times. The cryptogram would have to be as long as all the speeches made on the floor of the Senate and the House of Representatives in three successive sessions of Congress. No cryptanalyst is likely to bag that kind of trophy in his lifetime; even diplomats, who can be as verbose as politicians, rarely scale those heights of loquacity.
Consequently the cryptanalyst must fall back on special cases. They furnish him with what he must have for a practicable rotor solution: the plaintext for a length of ciphertext. He can get this in several ways. A Kerckhoffs superimposition is possible when several messages begin at the same rotor setting, or with settings so close to one another that the cipher-alphabet sequence overlaps among messages. The kappa test will reveal these. Sometimes two cryptograms have the same plaintext: one was sent in the wrong key, or identical orders are being sent to several units. Probable words or stereotyped beginnings will sometimes provide good clues. And sometimes the plaintext itself becomes available, through wireless queries, a cipher clerk’s carelessness, published diplomatic notes, and the like. All of these situations have occurred often enough for the cryptanalyst to exploit them.
That exploitation entails resolving the millions of secondary alphabets into the few primary ones. It calls upon the resources of higher mathematics, especially group theory, whose techniques are particularly suited to handle the many unknowns involved in a rotor solution. Basically these unknowns are the paths taken by the wires of each rotor from one face to the other. The cryptanalyst-mathematician quantifies them by measuring the distance, or displacement, between the input and the output contacts. For example, a wire from input contact 3 to output contact 10 marks a displacement of 7. Similarly, letters are given numerical values, usually a = 0, b = 1, … z = 25. Using his known or assumed plaintext values, the cryptanalyst sets up equations in which the displacements of the several rotors constitute the unknowns, and then solves the equations for them.
For example, the cryptanalyst may find two identical ciphertext letters in the first 26 letters of the cryptogram. Only the first rotor is turning; the last four have not moved. Since the two electrical impulses emerged at the same ciphertext lamp, they had to trace the same course through the maze of the last four rotors. Their paths differed only in the first rotor. The cryptanalyst can set up two equations. In each, the ciphertext’s numerical value equals the known plaintext value plus the unknown displacement on the first rotor plus the unknown displacement on the last four together. He takes into account by a correction the first rotor’s having turned several spaces. He subtracts one equation from the other in the standard algebraic process for solving simultaneous equations. This will reduce the substitutive effect of the last four rotors to zero. It will also give the cryptanalyst a numerical value that equals the difference between the two displacements in the first rotor. By repeating this process, the cryptanalyst can list the differences between many of the displacements on the rotor. He can then seek an arrangement of wires having these differences that will reproduce the known cryptographic effects.
In similar fashion, he will reconstruct another rotor. To isolate it, he must neutralize the movement of its fellows. Thus the first rotor will return to its original position at th
e 1st, 27th, 53rd, 79th, and so on, letters of the cryptogram. The second rotor remains in its first position for the first 26 letters of the cryptogram, in its second position for the second 26, and so on, not resuming its starting position until the 677th letter, when it again remains fixed for 26 letters. The other rotors likewise stand and turn in their own rhythms. By selecting letters at the proper intervals, the cryptanalyst can “stop” the revolution of a rotor much as stroboscopic flashes do.
Such are the basic principles of the rotor solution. But their practice wracks the cryptanalyst with some of the most excruciating mental torture known to man. The equations seem to stretch from here to the moon and to involute their parts as confusingly as the Gordian knot. In part, this complexity results from the need to index all displacements against the fixed input and output plates, which, after all, represent the plain- and ciphertext components, and the consequent continual corrections that must be made. In part, it results from the frequent necessity of expressing one displacement difference in terms of several others. A difference on the third rotor may only be known as the sum of differences on the first and fourth rotors, and the difference on the fourth may, in turn, be known only as the sum of differences on the second and fifth. Thus one unknown may be represented by four or five terms. Group theory is particularly fitted to handle this sort of problem, but it is also peculiarly prone to error. A false assumption will spread and grow like a malignant fungus over the treelike branches of these equations. Finally, the pattern of displacements that the cryptanalyst reconstructs may be correct only in a relative sense and may require permutation to the absolute form. These inherent problems are aggravated by external ones. The enemy cryptographers seldom oblige by beginning all their messages with the rotors in their starting position. The cryptanalyst is forced to determine first when the several rotors change positions. This problem, in turn, is made more difficult by the use of devices that impart an irregular movement to the rotors. Furthermore, the cryptographer can alter his substitution just by changing the order of the rotors.
All in all, the rotor system produces an extremely complex and secure cipher from simple elements in a simple construction. Who are the four contrivers of this miniature labyrinth, the four modern Daedaluses of cryptography?
The inventor of the first machine to embody the rotor principle gave the best efforts of his life to it. Edward Hugh Hebern was born April 23, 1869, in Streator, Illinois, and was raised in the Soldiers’ Orphan Home in Bloomington. When he was 14 he began living and working on a farm near Odin, where he got a high school education. He headed West at 19, and, after selling a timber claim in California to a sawmill where he worked for a time, he turned to carpentry and built and sold houses in Fresno. Soon after he turned 40, he somehow became interested in cryptology. Hebern was at this time a blue-eyed, brown-haired man of medium height and build, mustachioed, quiet, a great reader, kind, and even-tempered.
From 1912 to 1915, he filed for patents for cryptographic check-writing devices, cipher keyboards for typewriters, movable letter blocks to form mixed reciprocal monalphabets, and a ciphering typewriter. In 1915, he devised an arrangement in which two electric typewriters were connected by 26 wires in random fashion; thus when a letter was struck on the plaintext keyboard, it would cause a ciphertext letter to print on the other machine. Since the wires remained plugged into the same jacks during an entire message, the cryptogram would be monalphabetic—but it would have been electromechanically enciphered.
The wire interconnections comprised the germ of the rotor—a means to vary the monalphabetic encipherment. In 1917, Hebern reduced his ideas to the first drawings made of a rotor system, which, a year later, grew into actual apparatus.
Early in 1921, he advertised an “unbreakable” cipher in a marine magazine, but Miss Agnes Meyer, a cryptanalyst in the Navy’s Code and Signal Section, solved the sample message. When Commander Milo F. Draemel, the officer in charge, sent Hebern the solution, he came at once to Washington and showed the Navy his machine, filing his first rotor patent while he was there. The Navy had been looking, a director of naval communications later recalled, for “something radically better [in secret communications]. Something automatic came into our minds, and it had been in the back of our heads for some time. Along came Mr. Hebern from the West Coast with the Hebern machine. He made one, as I recall, and we were very thrilled when he showed us what it could do…. I remember we wanted to get some right away for the whole Navy.”
Edward Hebern’s “Electric Code Machine,” U.S. Patent 1,683,072. Rotors are 75a-e; plates, 18, 20, 21; the output letters glow behind the imprinted windows 37
Hebern had, in 1921, incorporated Hebern Electric Code, the first cipher machine company in the U.S., and with this kind of encouragement from the Navy, and believing—rightly—that his new rotor device was the cipher machine of the future, he began selling shares in his firm to raise capital. Since it controlled scores of patents in the United States and abroad, not only on the cipher machine but on such other pioneering devices as electric typewriters and directional indicators for cars, he had no trouble selling about $1,000,000 worth of stock to 2,500 shareholders, mostly from Oakland, where he then lived.
On February 5, 1922, Hebern bought a machine works to help his production facilities make cipher machine dies, molds, and patterns. Then, thinking that “we are very close to a great financial success with our code inventions and that it is sensible to be prepared to take care of a big business in a permanent way,” he decided to erect a plant large enough to house a 1,500-man factory. A steam shovel, with Hebern at the controls, broke ground on September 21 for a three-story neo-Gothic building occupying half a square block on the west side of Harrison Street between Eighth and Ninth Streets in Oakland. Plans called for a buffing-and-polishing room, a plating room, a 200-foot-long assembly room, a tool-and-die room, and numerous other facilities, including a corner office with fireplace for the president. In February of 1923, he hired Agnes Meyer (by now Mrs. Driscoll) for cryptologic help and liaison with the Navy.
While the building was going up, Hebern sold more stock in the company (“Remember, your stock is participating stock, and has the same chance to advance as the original stock of the telephone, wireless and other great inventions”), inundated his stockholders with optimistic reports, and kept his offices open until 9 p.m. every night, including Sundays, so that stockholders could examine the wonderful device. His handiwork filled Hebern with such awe that he extolled it in what may be the first ode to a cipher machine:
Marvelous invention comes out of the West
Triumph of patience, long years without rest
Solved problem of ages, deeper than thought
A code of perfection, a wonder, is wrought
Of international scope, is the code electric
With merit so obvious, no nation can reject it
Result of deep study, when necessity goads
Hebern Electric, is the peer of all codes
Sphinx of the wireless, guardian of treasure
Brain of a nation, safety beyond measure
Heart of a battleship, preserver of lives
When brute force, against intellect strives
Keeper of secrets, of state and alliance
Inscrutable, wonderful, a mystery to science
Of depth so profound, brainy traitors, beware
Invisible around you, is the genii’s snare
Conceived of the world war, in desperate need
Brains of all nations, competing in speed
Trained minds of the highest, seeking for might
An American achievement, is now brought to light
Overlooking this, the Chief of Naval Operations convened a board in 1923 to look into the Hebern machine. On it were Commander R. E. Inger-soll, later Commander in Chief Atlantic Fleet, Commander Russell Willson, and Lieutenant Commander W. W. Smith. It recommended the machine’s adoption when perfected, and when the Secretary of the Navy approved the re
port, the Navy felt committed to the Hebern machine. None of this, however, had resulted in any cash sales by the time the grandiose factory was completed late in 1923 at a cost of $380,000—half again as much as the original $250,000 estimate. This lack of income made it impossible for Hebern to bear the burden of its overhead, and, in the spring of 1924, the firm defaulted on the interest on its $100,000 mortgage. In the subsequent reorganization, Hebern was removed as president, though he remained in control. On April 30, an angry group of stockholders, at a stormy meeting that attracted newspaper coverage, protested a 10 per cent assessment levied by the firm to pay the interest. They prompted a state investigation into charges that Hebern had sold stock in the firm at $3 and $5 a share instead of at the legally authorized $1 par value. In the summer Mrs. Driscoll returned to the Navy Department.
The investigation—largely under Alameda County District Attorney Earl Warren, later Chief Justice of the United States—continued through 1924 and 1925 and into 1926. During that time the U.S. Navy ordered two Hebern machines at $600 each, and the Army paid him $500 for two that he had already delivered. The Pacific Steamship Company bought seven at $120 (the difference in price was due to the variation in the number of rotors in the machines offered for sale) for use aboard four ships and in three shore offices. The Italian government purchased a machine, and Britain’s Admiralty was studying one.
But shareholder pressure was mounting. Only twelve machines had been sold, they complained. As many as 500 stockholders thronged the protest meetings, and 150 crowded the Oakland Police Court at preliminary hearings of Hebern’s case, which attracted considerable public notice. Hebern was finally brought to trial March 1, 1926, in the Superior Court on a charge of violating California’s corporate securities act. After four days—during which such witnesses as 74-year-old Mrs. Caroline Gowdy testified how she had purchased 200 shares at $5 apiece—the jury retired. Twelve minutes later it returned, having found Hebern guilty. Though this verdict was later set aside and the charge dismissed for lack of evidence, it killed Hebern’s chances of attracting large amounts of capital. Three months later, Hebern Electric Code, Inc., went into bankruptcy.
