by DAVID KAHN
The cryptanalysts’ raw material was intercepted by either military radio stations or the post office telegraph bureau. In Silesia, it came in by courier about noon. Most of the diplomatic messages bore address and signature, so few traffic-analysis problems of discovering language, cryptographic family, and the like, arose. The cryptanalyses required enormous volumes of text and corresponding quantities of statistics. The army of clerks, mostly women, compiled these, but it usually paid the cryptanalysts to work up a few statistics themselves. The solutions took a heavy toll of nervous energy. “You must concentrate almost in a nervous trance when working on a code,” Miss Friedrichs recalled. “It is not often done by conscious effort.” The solution often seems to crop up from the subconscious.
The subconscious got considerable help, however, from an information group headed by Pastor Joachim Ziegenrücker. The group collated information from radio broadcasts, Foreign Office memoranda, Allied newspapers (it read The Times throughout the war), and the Pers Z output so that, as Miss Friedrichs said, they could give the answer when the cryptanalysts asked them “Who beginning with w spoke with somebody ending with n in a place with a kind of po on Thursday?”
More help came from the financial bonuses that kept up the codebreakers’ knowledge of foreign languages. The amount depended upon the difficulty of the tongue; nothing was paid for English and French, which they were expected to know anyway. The codebreakers had to take an examination in the language every four years to prove their continued competence, and many of them learned four languages, taking an examination each year and brushing up at the local Berlitz school for a month before the test. Pers Z had experts in the language of almost every country large enough to maintain a diplomatic corps. One Olbricht attacked the difficult problems of breaking Chinese codes. A man named Benzing took such delight in the Turkish language and Turkish cryptanalysis that his confreres regarded him as a veritable Turcomaniac.
The cryptanalysts received some of their greatest help from robots—mechanisms that speedily performed some of the highly repetitious tasks required, or that simplified the handling of many items. Many were tabulating machines that used punched cards in ordinary ways. But many others were assembled out of standard parts for special purposes by Hans-Georg Krug, a former high school mathematics teacher who possessed a positive genius for this sort of thing.
Messages were punched onto the cards (or sometimes, in the case of some Siemens machines, onto paper tape) and run through the mechanism to tabulate frequencies, to search for repetitions or interrupted (partial) repetitions and calculate the intervals between them, to sort texts. One arrangement of the machines, called the special comparer, automatically solved single columnar transposition. Using the punched cards, it extracted a portion of the ciphertext of the probable length of a column of the transposition tableau. Then it paraded the rest of the ciphertext past this fixed portion, calculating the frequency of digraphs at each juxtaposition. The match that yielded the highest frequency probably represented two adjacent columns of the tableau. The process was then repeated with the new column to extend the reconstruction. Since the device could compare the digraphs against any set of frequencies stored in it, it may have been adapted to solve transposed code, if the underlying code were known.
The machines were ideal for what was probably the single most common cryptanalytic procedure of the war—the stripping of a numerical additive from enciphered code. Axis, Allied, and neutral cryptanalysts employed the identical technique, which each major power apparently developed independently, probably between the wars. Military cryptanalytic units in the field employed it on a manual, pencil-and-paper basis.
It is generally called the “difference method.” The cryptanalyst first identifies, by indicators or traffic analyses or other information, a group of encicode messages that he believes used the same basic code and portions, at least, of the same long additive key. Using repetitions or clues from indicators as anchor points, he places the messages one under another so that the identical portions of the additive key will stand in vertical alignment. (If no information suggests an alignment, the cryptanalyst may have to try one after another to see if any produces results.)
He subtracts every encicode group in a column from every other. He subtracts the first group from itself, from the second, third, fourth, and so on, encicode groups, the second group from itself, from the third, fourth, and so on. The differences resulting from these “runs” are listed in a difference book, which also gives the location of the two encicode groups that produced each difference. The cryptanalyst repeats the subtractions for every column and indexes all differences in the difference book. He then examines this book for two columns that have a difference in common. This common difference indicates that the two columns include the same placode group, which each column has enciphered with its own additive.
The identity makes it possible for the cryptanalyst to reduce the two columns to an equivalent form. In the first column, he simply subtracts the encicode group whose run produced the same difference as the second column from every other encicode group in the first column—or, in other words, he just picks up the figures for that run. He does the same for the second column with its encicode group. This produces a relative placode in both columns. All groups in the two columns that were identical in the original placode will emerge as identical in this relative placode. They will, however, differ from the original absolute placode by a constant factor. The cryptanalyst repeats this process with other columns having a common difference, thus reducing as many columns as have such a difference all to the same relative placode. He then solves the code. If it is a one-part code, he can quickly determine the constant factor and obtain the absolute placode; if it is a two-part code, this step is usually neither possible nor necessary.
Take, for example, the following five cryptograms, presumed selected from a day’s intercepts. Experience has taught the cryptanalyst that the first group of each message, the indicator, designates the starting point for the additive sequence contained in the enemy keybook. Thus, 6218 means to begin with the group on page 62, line 1, column 8. Three of the messages have this indicator, and therefore overlap from their very first groups. But the second message, with indicator 6216, begins in column 6 of the same line. Consequently, its third group would have been enciphered with the same additive group as the first group of the three other messages, and it is so aligned. The same procedure aligns the message that has indicator 6217. When all five are brought into position, each column of encicode groups will share the same additive key.
The cryptanalyst makes his runs in each column (temporarily by-passing the short ones). He sets out the results in ten tables, of which those for columns A and E are:
Table A shows, for example, that 6260 has been subtracted from itself, leaving a difference of 0000; from 1169, leaving 5909; from 4061, leaving 8801; and so on. (Subtraction, like the addition, is noncarrying.) Each horizontal line records a run.
A portion of the difference book for these five messages would show that columns A and E share the differences 8801 and 5909. It would also show other columns with differences in common:
difference column messages run group
…. … …. ….
8736 F 1, 5 2574
8801 A 3, 1 6260
8801 E 4, 2 7572
9077 B 3, 1 7532
9106 J 4, 3 6810
9220 A 4, 1 6260
9220 D 3, 1 2661
9308 C 4, 3 4513
9391 D 2, 1 2661
9391 I 4, 1 7046
9391 J 3, 2 7529
9510 E 4, 1 6863
…. … …. ….
Since encicode group 6260 produced in column A the difference 8801 that column A shares with column E, the cryptanalyst subtracts 6260 from every encicode group in column A. He does the same with 7572 in column E. Likewise, 9391 constitutes a difference common to columns D, I, and J and permits them to be reduced to equivalent form in the same way—by
subtracting in each column the encicode group whose run produced the common difference. These five reductions yield relative placode in five columns:
It is easy to see the numerous repeated relative-placode groups—0000, 5909, 9391, and so on. Because this is a contrived example, the entire message (except for the two short columns) can be reduced to this relative form. In practice, however, it is not always possible to reduce messages fully, and partial solutions result. Accidental common differences will occur occasionally. In this series, 1480 results in columns F (4882-3402) and I (8426-7046). If 3402 were used as the relative key for column F, it would produce a false relative placode that would be corrected in the cryptanalysis of the code itself. Here, however, a preponderance of correct common differences outweighs this accident. If the underlying code proved to be one-part, the cryptanalyst would discover that the relative placode differs from the absolute placode, or base, by a correction factor of 2371.
The thousands of repeated subtractions, first to find differences and then to reduce to relative placode, and the routine compilation of the difference tables, furnish an almost ideal subject for the mechanical operation of the tabulators, and it was for this that similar machines were most frequently used in cryptanalytic offices throughout the world. In addition to these punched-card machines, Pers Z invented or adapted several special-purpose devices.
One of them employed translucent paper and light to strip a new additive from a base code that had been previously solved. By indicators or repetitions, the cryptanalyst lined up messages so that a column of encicode groups represented encipherments of the same additive group. If the code used four-digit groups, the cryptanalyst reached for a sheet of translucent paper imprinted with a square 200 cells by 200. The top and the side were indexed with coordinates that ran from 00 to 99 twice. Thus the four cells at the intersections of the two side coordinates 31 and the two top coordinates 50 represented the codegroup 3150, repeated four times.
The cryptanalyst’s previous solution of the code had told him that the most frequent placode groups were, say, 6001, 5454, 5662, and 7123. (If the code were two-part, these could be relative placode; if one-part, they would probably be absolute.) The cryptanalyst punched holes in several sheets for all five placode groups at each one’s four locations. He inked out the four cells of the first encicode group of the column on one sheet, of the second on another, and so on, and positioned the sheets over a source of light so that the marked encicode cells lay one atop the other. The brightest spot of light then represented the greatest congregation of punched-out placode holes, and the numerical difference between the coordinates of this light spot and those of the dark pile of encicode cells constituted the additive for that column of encicode messages. The difference was usually measured on the top sheet. Thus, if the encicode on that sheet were 8808, and the light spot were at 6001, the additive for that column would be 2807, and the placode for that particular encicode group would 6001, one of the common ones.
The method is analogous to determining which of the 26 possible decipherments of a column of letters in Vigenère (a column enciphered by a single keyletter) is correct by virtue of having the most high-frequency letters. Often these tests are made with alphabet strips on which the high-frequency letters are printed in red; the strips are aligned so that the ciphertext letters stand under one another, and the columns out to the right are scanned to see which is the reddest and therefore most probably the correct set of plaintext letters. In both this case and the Pers Z device, the high-frequency elements that underlie the cipher are known (plaintext in Vigenère, placode in enciphered code), and the cipher alphabets are known (normal alphabet in Vigenère, ordinary noncarrying addition in enciphered code). Since a strip thousands of cells long would be unwieldy, the Pers Z device uses two dimensions instead of one, but it must repeat its coordinates just as the Vigenère strip must repeat its alphabet. In both cases, all possible solutions are tested simultaneously. The high-frequency elements concentrate to make the brightest spot in one, the reddest column in the other.
These Pers Z robots helped solve codes of France and Italy, both of which used at times four-digit codes with additive superencipherments. One English code, however, remained invulnerable, because the 40,000-group length of her additive key prevented enough material from accumulating. At the start of World War II, most countries probably employed the additive system of enciphered code in a hierarchy of codes for their foreign services. Germany herself did, using sometimes a four-digit, sometimes a five-digit code, only her additive was the one-time pad. Despite all the mechanical help, however, solution of most codes came right down to pencil-and-paper work by individual cryptanalysts.
Such was the solution of the superencipherment of the Japanese TSU diplomatic code—the columnar transposition with blank spaces in the transposition blocks that American cryptanalysts called the K9 transposition to the J19 code. The Japanese embassy in the Soviet Union began relying heavily on this code in October of 1941, when the Soviet government moved its capital eastward from threatened Moscow to Kuibyshev. The diplomats had to stay close to the seat of government, and the Japanese may have junked their heavy cipher machine instead of moving it, using their paper codes instead. Pers Z made its first break by spotting two messages which had patches of identical letters separated by nonidentical sections. Deducing that these differing portions represented the same placode text, the cryptanalysts compared the two messages until, in a single afternoon, they found a transposition and blank arrangement that yielded the same texts in a form that resembled legitimate codewords. In one of their greatest technical successes, the mathematical cryptanalysts cracked the approximately 30 transposition and blank patterns; the linguists read the code, and the subsequent solutions provided the Germans with information about Russian war production and army activities.
It would, of course, be embarrassing for the Germans to admit that they were reading the code messages of their allies, and this led to a touchy situation early in 1941. Franz von Papen, ambassador to Turkey, reported on February 4 that the Iraqi minister to Turkey had told him “that the English can plan with a full knowledge of Italian intentions because they can read the Italian cipher.” Ernst Woermann, director of the Foreign Ministry’s political department, undertook inquiries. By the end of March he learned from Selchow that “the Italians make use of three groups of ciphers, of which the first group is easily readable, while the second is harder to solve. Of the third group, it is considered probable, though not certain, that into that complicated system the English cannot break. Even this cipher can be read by our offices…. The Rome-Bagdad cipher belongs to the second group.”
Woermann suggested various ways of getting the word across to the Italians, one of them Germanically subtle: “We could say that the information from Ankara led us to try our hand at decrypting a radiogram from the Rome-Bagdad traffic, and we have just succeeded.” The Italians were duly warned, though it is unknown whether the hint of German diplomat Prince Otto von Bismarck to an Italian Foreign Office official a few months later that the Germans had the Italian codes (without mentioning the English) was how it was done or whether that was merely an indiscretion. The Italians were the despair of the Germans in this, as in everything else; they did not change their codes and Pers Z continued to read them. But they were not quite as shiftless as the Germans thought. Count Galeazzo Ciano, the Foreign Minister, commented in his diary when he heard that the Nazis were reading his messages: “This is good to know; in the future, they will also read what I want them to read.”
The codes of small countries are usually simpler to solve than those of large, and not only because of intrinsic qualities as smaller code size and fewer codes and additive tables. Their personnel is less well trained, and so they often ask for repeats if, as happens more often than with major powers, they cannot decode a message. Moreover, not having the courier services or communications of larger and richer countries, they cannot get new codes to distant outposts as
often as the large countries and so continue using the older codes too long. While their messages usually do not contain the crucial portents of those of great powers, their diplomats are sometimes well situated and can provide information of value. Yet even these small nations sometimes seem to have a feel for knowing when their codes are broken. “You just get to a point where you are reading a good part of the traffic when one morning you come in and it’s all changed,” said Miss Friedrichs.
The Pers Z solutions, typed up, went to Selchow. He submitted them to the state secretary of the Foreign Office before Ribbentrop became Foreign Minister, and afterwards to both the state secretary and the Foreign Minister’s office, at Ribbentrop’s order. Those for the Führer were marked with a green “F.” He did not always see them, since Ribbentrop did not dare give him bad news. Those that he did see, he did not always appreciate. Across the face of one long dispatch that gave considerable information on agricultural conditions in Russia, which bore importantly upon military possibilities, Hitler scrawled “Kann nicht bir stimme” (“This cannot be”). Nazidom preferred its own lies and propaganda to unpalatable truths, and so, as Miss Friedrichs said, “Even if we had a plum, it was not considered as one.”
In April of 1945, the American front engulfed the cryptanalysts at Burgscheidungen Castle and swept past. A few days later, Haskell Cleaves, a Signal Corps officer from Maine, discovered what they were doing. Headquarters sent out a mixed commission of American, British, and French experts to interrogate them. On May 8, while the world was celebrating V-E Day, 35 of them were flown to London for several months of questioning; among their interrogators was a “Major Brown,” who was really William P. Bundy, later U.S. Assistant Secretary of State for Far Eastern Affairs. For the cryptanalysts of the German Foreign Office, the war had ended.
