THE CODEBREAKERS

by DAVID KAHN

  Hagelin shrank the device to 6 × 4½ × 2 inches—smaller than the base of a standard telephone set—and to under three pounds, or about the weight of a dictionary-sized codebook. To operate it, the encipherer, after first setting the key elements, twirled a knob at the left to the plaintext letter, and revolved a handle at the right. The mechanism spun, and a little typewheel printed the output on a gummed tape. Hagelin even managed to have it print the ciphertext in five-letter groups and the plaintext in normal word-lengths (by using a rare letter as a word-spacer). Its speed averaged 25 letters per minute.

  This was the Type C-36, and when the French saw it, they snapped it up. Their 1935 order for 5,000 machines proved the turning point in the firm’s fortunes. Looking back, Hagelin realized that Damm and the other cipher machine companies had not failed because of any intrinsic flaws in their machines, but only because the time was not ripe for them in the 1920s. Not until the war-weariness of that decade had worn off and the rearmament of the 1930s had begun did a substantial market appear. In 1936, Yves Gyldén, the son of Damm’s early partner, analyzed the machine’s cipher and recommended some important improvements, which Hagelin adopted, substantially strengthening its cipher.

  That same year, Hagelin began corresponding with American cryptologic authorities about the C-36. He went over himself in 1937, and again in 1939 when war broke out in Europe. Now the United States was considerably more interested. Friedman suggested improvements, and Hagelin returned to Sweden to incorporate them and to streamline the machine for mass production. On April 9, 1940, he was in his cabin in Dalecarlia when he heard a radio announcement that the Germans had invaded Norway. His wife told him that if he wanted to do anything with his machine in the United States, he ought to go there at once.

  “A normal visa was unobtainable,” he has recalled, “so I induced the Swedish foreign office to send me as a diplomatic courier. My wife and I sent our luggage off in advance and took the train up to Stockholm. There we learned that the travel bureau had cancelled all trips to the United States, as the Germans had by now invaded France, Holland, and Belgium. We decided to take a chance and try to sail from Italy.

  “With the blueprints in my briefcase and two dismantled ciphering machines in a bag, we boarded the Trelleborg-Sassnitz-Berlin express. Our luck held. We rattled right through the heart of Germany and arrived unmolested three days later in Genoa. That night the windows of our hotel were smashed—because we had innocently chosen to stay at the Hotel Londra and Italy was now at war with Britain. But we reached New York on the last outward-bound voyage of the Conte di Savoia.”

  This breathless escape proved worth it. The U.S. Army liked the machine, though it insisted on further tests. Hagelin got 50 machines flown out secretly from Stockholm to Washington for final exhaustive trials. They passed, and after long contract negotiations, the Army accepted the improved device as its medium-level cryptographic system. Under the U.S. military designation of Converter M-209, the Hagelin machine served in military units from divisions down to battalions. In 1942, L. C. Smith & Corona Typewriters, Inc., began turning out about 400 olive-drab Hagelin machines a day (compared to its output of about 600 typewriters a day) in its 900-man factory at Groton, New York. More than 140,000 were produced. (Ironically, the Italian Navy also used it.) Hagelin’s royalties ran into the millions of dollars. He became the first—and the only—man to become a millionaire from cryptology.

  What is this little jewel of a cipher machine like? What is this infant Hercules of cryptography, which raised its inventor to such financial heights?

  In essence, it is a gear with a variable number of teeth. These turn a cipher alphabet through as many positions as there are teeth for that particular encipherment. The various parts of the mechanism interact to produce an incoherent running key with a very long period. The machine consists of four main operating elements:

  (1) The cage, in which 27* bars are disposed in the form of a horizontal cylinder, which revolves. The individual bars can slide to the left. The ends of those bars that are slid to the left comprise the cogs of the variable gear. The bars that are not slid comprise its gaps. Each bar carries two lugs, or projecting members, that can be set to two of eight locations on the bar. Six of these are operative, two nonoperative. As the cage turns toward the operator, it will bring the lugs in eight columns up over the top, down, and around.

  (2) Six flat vertical rods called “guide arms” to contact these projecting lugs. Each of the six guide arms is matched with one of the six operative locations. The guide arms can rock forward into an operative position of their own or back into a nonoperative position. In the operative position a guide arm will contact lugs, but if either lugs or guide arms are nonoperative no contact will take place. Each guide arm has its upper end angled to the right so that, when the cage is turning and bringing an operative lug down onto an operative guide arm, the slant will push the lug to the left. This will carry the lug’s bar to the left, adding a tooth to the variable gear.

  (3) Six keywheels, each controlling a guide arm. The keywheels have 26, 25, 23, 21, 19, and 17 indicator letters on their rims and a pin underneath each letter. Each pin can project either from the right or the left side of its keywheel, the right-hand position being its operative position. When an operative pin reaches a certain point in the revolution of the keywheel, it will move the guide arm into an operative position. When a nonoperative pin reaches that point, it will pull the guide arm back into a nonoperative position. Thus the succession of operative and nonoperative pin positions around the circumference of a keywheel will bring its guide arm into and out of operating position. This determines whether lugs will be contacted, and hence whether teeth will be added to the variable gear.

  (4) The displacement and printing mechanism. A knob at the left of the machine turns an indicating disk with the 26 plaintext letters. It also turns, on the same axis, a typewheel that prints the machine’s output on paper tape, and a typewheel gear that connects, through an intermediate gear, with the ends of the slide-bars that are serving as the teeth of the variable gear. At the start of an encipherment, before the slide-bar ends begin to engage the intermediate gear, these three elements can revolve freely (as a unit, not separately), permitting the setting of any plaintext letter opposite a benchmark.

  To encipher, the lugs on each bar must be set in prearranged key locations, and the pins on each wheel must also be set in prearranged key positions. The deciphering machine must naturally be set identically. The encipherer then turns the six keywheels to any random position, which he records by the letters on the rims. The position changes from message to message; hence the letters—PQFPHJ, for instance—are inserted at a prearranged point in the cryptogram to permit the decipherer to set his machine to the same starting position.

  Boris Hagelin’s M-209. 1 Outer cover 2 Inner cover 3 A lug 4 Encipher-decipher knob, set at D for decipher 5 Paper tape 6 Letter counter 7 Indicating disk, on which input letters are set 8 Reproducing disk, on which output letters are shown 9 Typewheel, which prints output letters 10 Windows to display keyletters on keywheels 11 Power handle 12 Cage disk, numbered for each slide-bar 13 A slide-bar, which moves left to become a tooth of the variable gear 14 Keywheel advance gear 15 Upper part of angled face of guide arm of keywheel 4; lugs in column 4 will strike it as cage rotates forward, driving slide-bars to the left 16 Pin for S on keywheel 4, in ineffective position 17 Keywheel 5

  The encipherer now spins the knob on the left to bring his first plaintext letter on the indicating disk to the benchmark. Then he turns the power handle on the right. This rotates the cage, carrying the lugs over and then down toward the guide arms. Suppose that guide arms 1, 3, and 5 are operative. Then all the lugs that have been set in operative locations 1, 3, and 5 will strike the inclined surfaces of those guide arms. Lugs that are in the nonoperative locations or in operative locations 2, 4, and 6 will not strike any guide arms. Lugs that do strike will drive their bars to the left. (Since there are tw
o lugs on each bar, there may be some duplication of effort, if, for instance, a bar has its lugs in locations 1 and 5. The result is the same as if only one lug pushed the bar to the left.) The ends of those bars that have been driven to the left will now be able to mesh with the teeth of the intermediate gear. The ends of the other bars will miss it.

  Those that mesh will transmit the turning motion of the cage to the intermediate gear, which then turns the typewheel gear. This turns one space for every meshed bar-end, or tooth of the variable gear. Thus, if the combination of lugs and guide arms pushes a total of 15 bars to the left, the typewheel turns 15 spaces, thus shifting the plaintext letter 15 positions in the ciphertext alphabet (which is the alphabet on the typewheel). The end of the power handle’s revolution presses the paper tape against the typewheel (which has been inked by running over the inkpad) and prints the ciphertext letter. At the same time, the power handle advances all six keywheels one space forward, bringing into play a different set of pins, which in turn creates a different arrangement of operative and nonoperative guide arms. The slid-out bar-ends retract to their original neutral position after disengaging from the intermediate gear. This completes the cycle, and the device is now ready for the encipherment of the next letter. Since different guide arms are now in operative positions, different lugs will contact them, different bars will be shoved to the left, different bar-ends will make up the variable gear, and the typewheel will be turned through a different number of positions to encipher the letter.

  The cipher that the M-209 produces in so intricate a fashion is a polyalphabetic. Only one primary ciphertext alphabet is employed, and that the normal reversed alphabet. Thus the encipherment may be reproduced by a St.-Cyr slide with a direct normal alphabet for the plaintext and a reversed alphabet for the cipher. The variable gear shifts this ciphertext alphabet in a highly irregular sequence to its 26 possible positions. Because this sequence cannot repeat until the guide arms repeat their successive positions, because they cannot repeat until the keywheels do, and because the keywheels have no factor in common, the sequence will not recommence until 26 × 25 × 23 × 21 × 19 × 17 letters have been enciphered. This gives the M-209 a period of 101,405,850 letters.

  This figure, nearly ten times greater than that of a five-wheel rotor machine, discourages a straight Kasiski solution. But, as with a rotor system, heavy traffic may produce two settings of the keywheels close enough together to cause two messages to overlap portions of that long sequence. A kappa test can sound out these overlaps. Then, since the cipher alphabet is known, the cryptanalyst can solve these two identically-keyed ciphertexts by seeing whether a plaintext assumption in one message produces intelligible text in the other.

  With the plaintext for a length of ciphertext, the cryptanalyst can then recover the machine’s lug and pin settings. He begins from the observation that each lug can cause a shift of one space in the position of the cipher alphabet. If operative, it will kick this alphabet forward one space. Thus, if the ciphertext letter B would have occurred without this lug, its operation will produce an A (the alphabet is reversed). Conversely, if the cryptanalyst tries a lug in a nonoperative location when in fact it should be operative, it will subtract a kick, producing a B instead of an A. A lug in the wrong operative location will add some kicks and subtract others. These effects will occur at nonperiodic intervals.

  The effects of keywheel pins, on the other hand, will show up at periodic intervals. If, for example, an encipherer has set a pin on the 19-letter keywheel incorrectly, the decipherer will find a wrong letter appearing every 19 letters. This letter will be many kicks removed from the correct one since the guide arm will have wrongly activated many lugs. On the basis of these principles, by considering the lugs in a column as a group, by setting up algebraic equations in from six to four unknowns, and by repeated cross-corrections, the cryptanalyst can determine the key settings. Usually 150 letters will suffice, and, if he is lucky, as few as 35. The required plaintext may be obtained by probable words or stereotyped beginnings in a single message, and even if a complete recovery cannot be made, a partial one can be and then expanded later.

  The machine’s handicap of mediocre security is partially overcome by the ease of changing the internal settings, of which there are, literally, vigintillions. And it presents many operational advantages. It prints the output, properly spaced—ciphertext in groups of five, plaintext in word-lengths (usually z is used as a spacer, so that minimize will come out minimi e). A counter that shows the number of letters enciphered or deciphered allows easy checking of errors. A reset button permits turning the keywheel assembly back to a previous position. If the machine runs out of tape, the ciphertext letters can be read off an indicating disk. Packed within the 3¼ × 5½ × 7 inches of its housing are paper tape, oil, extra inkpads, tweezers, and screwdriver. It weighs about six pounds and is extremely rugged, able to survive jolts, dust, sand, tropic humidity, and arctic chill. Actual operation could hardly be simpler, requiring only the turning of a knob to bring the plain-or ciphertext letter opposite a mark, then the flipping of the power handle to revolve the mechanism. Encipherment runs at from 15 to 30 letters a minute.

  From a purely mechanical point of view the device is an absolute marvel. Hagelin has engineered a mechanism that spouts an extremely long key from relatively few elements in an astonishingly compact format, which also permits of practically unlimited key changes. It is the most ingenious mechanical creation in all cryptography.

  In 1944, Hagelin, now a multimillionaire, returned to Sweden on a safe-conduct vessel that took 30 days to cross the Atlantic. “With my earnings,” he said, “I bought myself a 2,000-acre estate with a brick factory 30 miles south of Stockholm, outside Södertäge, as I thought that the cipher machine business was finished.” How wrong he was! First came the cold war. As the two great powers built up their military might and those of their satellites in mutual fear and mistrust, a new market came into being for cipher machines. Then the old colonial empires broke up. The dozens of new nations that emerged from the ruins created a market for cipher machines far wider than any that had yet existed. To safeguard the communications of their little armies and of the diplomatic posts that they established all over the world, these countries turned to Hagelin.

  At first his entire Aktiebolaget Cryptoteknik organization was concentrated in Stockholm. But a Swedish law enabling the government to appropriate inventions that it needed for national defense compelled him to take his developmental work to Zug, Switzerland, in 1948. Zug proved so attractive—not least because of its tax benefits, for which it is widely known—that in 1959 Hagelin moved the rest of the firm there, incorporating it as Crypto Aktiengesellschaft.

  The corporation is housed in a four-story tan stucco factory building at 10 Weinbergstrasse on a hillside in the middle of a residential section. It looks out at the sparkling Lake of Zug and beyond to the distant bluish Swiss Alps—probably the loveliest setting in which cryptology has ever been practiced. From inside come the humming, buzzing sounds typical of any light industry. The 170 employees mostly just assemble parts that Hagelin has purchased from manufacturers in Switzerland and Germany; if he made all his own parts, he would need a work force of 300. The building’s top floor holds the drafting offices, and the third floor the administrative, where Hagelin has a two-shelf “museum” of cipher machines. Tool-making occupies the first floor, together with some die-stamping; assembly takes place on the second floor, where stacks of parts stand next to a tiny watchmaker’s lathe and where workmen solder ultrasonically. In a laboratory, engineers create and test new mechanisms, such as electronic devices that simulate mechanical operation to attain very high-speed operation. Hagelin does not attempt to cryptanalyze his own machine ciphers, however, probably because he fully understands the principles of solution and realizes that the success of his machines depends on proper usage. Instead he draws upon the reactions of his users for improvement ideas.

  The firm sells three basic mac
hines. The C-52 is a vastly improved form of the C-48, the firm’s designation for the M-209. Though it employs the same basic mechanism, its keywheels have 47, 43, 41, 37, 31, and 29 pins on them, whose period of 2,756,205,443 reduces the likelihood of overlap. The key-wheels can be removed and reinserted in a different order. The typewheel carries a mixed alphabet. The indicating disk appears as a dial that shows all letters at once and is easier to operate. With some modifications, it is crypto-graphically compatible with the older C-48’s, a thoughtful arrangement that enables countries that have bought the older ones to use them with the newer ones until they wear out, thereby easing the strain on the communications budget. Price: $600.

  The CD-55 is a pocket machine, 5 × 3 × 1½ inches, or slightly larger than a transistor radio. It weighs only 22 ounces. Its mechanism differs from the C-52 but produces the same cipher. A power lever that springs out from the side of the machine is pressed in and released by the thumb. This turns the inner ring of the two circular alphabets—one plain, one cipher—displayed on the face of the machine. This midget sells for $200.