Seizing the Enigma: The Race to Break the German U-Boat Codes, 1933-1945

by Kahn, David

  Bertrand could not conceal his pleasure, and Schmidt, seeing this, was radiant. REX and Bertrand agreed to pay him 10,000 marks, or $4,000 (about $27,500 in 1991 dollars). Bertrand took the documents and, running up the stairs two at a time, brought them to photographer Bintz. The two worked through lunch. About three, Bertrand brought the documents back to Schmidt, whom he found chatting with REX. The army officer, in his poor German, asked if Schmidt was pleased with the agreement.

  “Jawohl, meine Herren. Besten Dank. Alles ist in Ordnung,” Schmidt replied.

  He bowed, took his money, and left.

  Back in Paris, the elated Bertrand brought the documents to his friend Colonel Bassières, one of France’s finest cryptanalysts, an amusing man with a limp who had honed his talents on German ciphers in World War I. Bassières accepted the papers, but he found that they provided only interesting generalities. H.Dv.g.13, warned, for example, “When putting the rotors on the shaft, be careful that the sides with the flat contact surfaces are always pointing to the side of the shaft that has a ring on its end.” The keying instructions were more useful. They specified that the four elements of a complete key consisted of (1) the sequence in which the rotors were placed in the machine, given in roman numerals, such as III I II; (2) the setting of the alphabet ring on its rotor, given by a letter or its corresponding number, B or 2, for example; (3) the so-called basic setting of the rotors, specified by the letter or number of each rotor’s alphabet ring that should appear in the rotor windows of the machine’s lid at the Start of the enciphering; and (4) the six plugboard connections, enciphering twelve letters, indicated by a pair of letters or numbers, such as A/O or 4/15.

  This information seemed, however, to have little value in the absence of two critical elements not provided by the Schmidt documents: the wiring of the rotors and the actual keys in use on particular days. On Friday, November 20, two work weeks after he had given Bassières the documents, Bertrand went to him to learn how he had made out.

  “Impossible to get anything useful from your documents,” Bassières told him. “Too many things are lacking for us to reproduce the machine.” He was referring primarily to the rotor wiring. “And even if we could, we would have to tie ourselves down to a monumental task of finding out the [daily] keys. We just don’t have the means.”

  Hopeful that the British, with whom French intelligence had close relations, might do better, Bertrand immediately obtained permission to show them the documents. On Monday the twenty-third, he gave copies to the Paris representative of the British intelligence services. Commander Wilfred (Bill) Dunderdale. Three days later Dunderdale was back with the same judgment Bassières had rendered: the documents did not make it possible to solve Enigma messages.

  Unwilling to give up without trying every avenue, Bertrand sought approval to give the information to France’s ally Poland. Bertrand may have known, from a 1928 booklet describing Polish cryptanalytic successes in 1920, that the Poles had a good background in code-breaking. Approval was granted, and Bertrand himself was delegated to go to Warsaw. So that he would not be carrying anything compromising or risk losing the documents and so their secret, he sent photographs of the two booklets ahead by diplomatic pouch. He arrived Monday, December 7, 1931, and picked up the photos at the French embassy. At 9 A.M. the next day, he was in the office of the head of the Biuro Szyfrów, where he was warmly received. The chief, Major Gwido Langer, who had succeeded Pokorny, scanned Schmidt’s offering, then exploded with joy. He ran out of the room and returned a few moments later with his boss, Colonel Stefan Mayer, the general staff’s head of intelligence, and with Ciȩżki, head of BS-4. Mayer congratulated Bertrand warmly on his feat and asked for forty-eight hours to study the pamphlets.

  At 4 P.M. on Thursday, Bertrand met Mayer and Langer in Mayer’s office. This time the atmosphere was more temperate. The Poles explained that the documents showed that the machine had three rotors with movable alphabet rings on them and that the reflecting rotor did not turn during encipherment. The documents had further revealed the presence of the plugboard, which did not exist in the commercial Enigma. The Poles could not thank Bertrand enough. But, they explained, they did not know the rotor wiring, the rotor order, or the plugboard connections for a keying period. They did not know the alphabet ring positions on the rotors and therefore did not know the rotor positions for each message. All this could be determined by analysis, they said, but it would take much time. If Bertrand’s informant could provide these details, and if the French could give the Poles specifics of their cryptanalytic progress on the basis of the new information, years of work could be saved.

  Bertrand, embarrassed by his country’s cryptanalytic ineffectualness, admitted that both French and English efforts on the Enigma had not produced as much as Langer presumed.

  Langer sought to ease his chagrin. “You don’t have the same motivation as we do,” he said generously. And on that note the two parted, with promises of further cooperation.

  The next weekend, December 19 and 20, Bertrand and REX again met Schmidt in Verviers. The German had by then been admitted to the Nazi party with membership number 738,736. This demonstration of nationalistic orthodoxy did not keep him from delivering the keys that gave the daily settings for the machine for December 1931. Nor did it prevent him from meeting with Bertrand and REX three times during 1932: on May 8 in Verviers, on August 2 and 3 in Berlin, and on October 19 and 20 in Liège, Belgium. At each meeting, in addition to other information, Schmidt provided keys: for May, for September and October, and for November and December. Bertrand brought the keys to Warsaw.

  The complexity of the Enigma problem led Ciȩżki to expand the plan he had instituted in 1929 of employing mathematicians to attack the new electromechanical forms of encipherment. The three young mathematicians he had brought to Warsaw from Poznán had gained experience in at least two different systems. Ciȩżki placed Marian Rejewski, the oldest and most apt, alone in a room on the third floor of the north wing of the general staff building, overlooking the tomb of Poland’s Unknown Soldier. He gave Rejewski the photographs of the two instructional pamphlets from Schmidt and some obsolete key lists and in October 1932 assigned him in the greatest secrecy to solve the Enigma.

  Rejewski read the stolen pamphlets and the few sheets of paper in the archives from earlier attempts and examined a curious equivalent of the commercial Enigma: a 2-foot-square frame with mobile vertical rods studded with nails that could be joined by multicolored threads to reproduce the wiring of the rotors. Then he picked up where his predecessors had left off: by analyzing the six-letter indicators with which each Enigma message started.

  In these messages, all one day’s indicators that had a particular letter, say, R, in the first position invariably had a certain letter, say, V, in the fourth position. The same held for the second and fifth and for the third and sixth positions. Rejewski saw that this pattern derived from the German keying method, which he knew from one of Schmidt’s documents, H.Dv.g.14. The method utilized a three-letter key, say MGK, that was repeated: MGKMGK. (The repetition assured the person receiving the message that the key had not been garbled in transmission. If the triads differed, the recipient could determine the right one in three trials.) The three letters were chosen at random by the cipher clerk for each message so that every cryptogram would have a different key. The recipient had to be told what this key was, but the information could not be transmitted in the clear and so was enciphered.

  The instructions showed Rejewski that the clerk plugged in the six plugboard connections according to the key list. He inserted the rotors in the order given in the key list for that quarter of the year. He set each rotor’s alphabet ring so that its spring-driven stud fit into the hole at a letter given in the key list for that day. Next he looked up that day’s basic setting in the table of daily keys. He turned his rotors until the three letters given as the basic setting—say, PDX—appeared in the windows of the cover. He enciphered MGKMGK. Suppose that the s
ix letters that lit up were OFLWZZ. This was his indicator, which he placed at the head of his message. He then turned his rotors until MGK appeared in the rotor windows. Only then did he begin enciphering the actual text of the message. This complicated procedure gave each message its own key and concealed that key in its transmission to the decipherer.

  Now another cipher clerk in the same net that day might have chosen MIH as his message key. Since he would have the same plugboard connections, rotor order, alphabet ring positions, and rotor starting position as the first clerk, his two M’s would be enciphered into the same letters as the two M’s in MGKMGK, namely, O and W, even though the other letters differed. This relationship led Rejewski to build chains from the first and fourth letters of each indicator. If, for example, on a single day, two indicators were RTMGNU and GWAIZZ, Rejewski could string RG and GI together to make RGI. This constituted a chain—or at least the first links in one. Other indicators provided other links. Eventually each chain closed upon itself, returning to its first letter. Rejewski rapidly found that no single chain included all 26 letters, but that if he had enough indicators (usually around 60) all 26 would be included in other chains. The maximum of 26 was reached in only three ways, or cycles: two chains of 13; six chains of 10, 10, 2, 2, 1, and 1 letters each; and six chains of 9, 9, 3, 3, 1, and 1 letters each.

  At this point, Rejewski’s analysis branched into a path that differed fundamentally from all methods hitherto used in cryptanalytic attacks. In the past, cryptanalysts had depended upon statistics. Which letter was the most frequent? Which of several possible plaintexts was the most likely? Even the only known previous solution of a rotor machine, the dazzling 1924 success of American William F. Friedman in reconstructing the wiring of Edward Hebern’s five-rotor machine, used a probabilistic and lower-algebraic approach. But Rejewski, for the first time in the history of cryptanalysis, utilized a higher-algebraic attack. He applied one of the first theorems taught in the theory of groups. In simplified form, the theorem states that if P and Q are permutations, then the permutation PQP−1 (read P, Q, P inverse) has the same cycle structure as the permutation Q. In the Enigma encipherment P could represent the plugboard input; P−1, the plugboard output; and Q the total rotor encipherment. Group theory thus told Rejewski that his cycles depended only on the rotor setting and not on the plugboard encipherment. It told him, in other words, that the plugboard, in which the Germans placed great trust as enhancing the machine’s security, could be ignored in at least part of the cryptanalysis.

  The cycles Rejewski had discovered were produced by the substitutions generated by the six steps of the rightmost, or fast, rotor (the one that turned at the encipherment of each letter of the six letters of the key). Rejewski used the cycles to set up six huge equations that, if solved, would disclose the wiring of the fast rotor. The unknown terms of the equations were not simple ones like 3x, but arrays of 26 elements. These elements consisted of Rejewski’s quantification of the machine encipherment. If a rotor input contact was at the 12th position and the wire inside connected it to the output contact at the 20th position, the encipherment for that input position would be given the numerical value of 8. But for Rejewski, all 26 values, representing all 26 connections, were unknown.

  Each of Rejewski’s six equations had four complex terms. Three terms were unknown: the array of numbers representing the wiring of the fast rotor (which moved each time a letter was enciphered); the array of numbers representing the combined wiring of the middle and left rotors (which were assumed to be stationary, as they were in 21 cases out of 26) plus the reflector; and the connections of the six letter-pairs that were enciphered in the plugboard. (The plugboard could be ignored in the cycles but not in the eventual recovery of plaintext.) Rejewski assumed that he knew the fourth term, but in fact it was unknown. It represented the connections of the typewriter keys to the input plate that fed the current to the rightmost rotor. On the basis of the commercial Enigma that BS-4 had bought, Rejewski thought that these connections ran in keyboard order, from key Q to the first, or A, position on the input plate, from key W to input plate position B, from E to C, and so on. Finally, Rejewski introduced a permutation that would correct for the movement of the fast rotor as successive letters were enciphered.

  He then tackled the equations. But the number of their unknowns overwhelmed him. It became clear to Ciȩżki, who visited him in his solitary office every day, that Rejewski was not going to succeed by himself. He would have to be given some of the material that Schmidt had supplied. Ciȩżki and Langer had thus far withheld this material, perhaps to make Polish cryptanalysis less dependent on gifts from France, which was just then cooling toward Poland’s insistence on retaining the Corridor and on being superior in armed forces to Germany. On December 9, 1932, some six or eight weeks after Rejewski had started work, Ciȩżki gave him a copy of the daily keys for September and October 1932, which Schmidt had given REX in August and which Bertrand had brought to Warsaw in September.

  The keys at once transformed one of the unknowns—the plugboard connections—into a known and simplified the rest of the equations. But they remained complex, and Rejewski continued to wrestle with them for several weeks. Then one day it struck him that his assumption for the wiring from the typewriter keys to the input plate could be wrong. Perhaps the wire from key Q ran to position Q rather than position A. He adjusted his equations. “The very first trial yielded a positive result. From my pencil, as if by magic, began to issue numbers designating the wiring in rotor N [the rightmost, or fast, rotor],” he wrote.

  The twenty-seven-year-old cryptanalyst had uncovered part of the secret heart of the Enigma: the wiring of one rotor. This enabled him to lay the first Enigma solutions on Ciȩżki’s desk at the end of December, as Christmas and New Year’s lifted people’s spirits in the Polish capital.

  But these solutions comprised only a selected few, and further work was needed to complete the reconstruction of the machine. Here the Poles had a stroke of luck. The Germans changed the order of the rotors in the machine every three months, or quarter of a year. Fortunately, the keys that Schmidt had supplied straddled two different quarters: the third, for the September keys, and the fourth, for the October ones. This meant that in October the rotor in the right-hand position was different from the one in that position in September. Using the same technique as before, Rejewski determined the wiring on this rotor. After this, “finding the wiring in the third rotor, and especially in the reflecting rotor, now presented no great difficulties.” Cleaning up the work—eliminating ambiguities to obtain completely correct information on wiring and rotor stepping—was greatly eased by a sample encipherment in one of the manuals that Schmidt had provided.

  The solution was Rejewski’s own stunning achievement, one that elevates him to the pantheon of the greatest cryptanalysts of all time. Much of the solution was due to his brilliance. Yet mathematics—even with Rejewski’s extraordinary ability—had not sufficed. Pure analysis alone had not achieved a solution. The machine was too complex. Rejewski needed help from outside information, as he acknowledged:

  To this day, it is not known whether equation 3 [of the set of six equations with the arrays of 26 unknowns] is solvable. Admittedly, another approach to the reconstruction of the rotor wirings was found, in theory at any rate. But that approach is imperfect and laborious…. It requires the possession of messages from two days of identical or very similar settings of the rotors; therefore, finding the wiring of the rotors would depend on luck. In addition, it requires so many trials that it is not clear whether the director of the Cipher Bureau would have had enough patience to employ several workers for a long period without certain attainment of success, or whether he would have once more discontinued work on the Enigma. Hence the conclusion is that the intelligence material furnished to us should be regarded as having been decisive to the solution of the machine.

  Britain and France also had these documents. Why had they not solved the Enigma?

>   They lacked mathematical cryptanalysts. Their cipher establishments, like generals still fighting the last war, saw no need to change the linguistic orientation that had brought them their successes of 1914–1918 and that was continuing to solve many diplomatic codes in the 1920s. France, for example, was breaking the codes of some ten countries. The cipher bureaus had no guarantee that an inexperienced mathematical cryptanalyst would succeed where experienced linguistic cryptanalysts had failed: Dillwyn Knox, a leading light of Britain’s agency, had not broken the German Enigma despite great efforts. Though this agency had once considered training university mathematicians as reserve cryptanalysts, it had rejected the idea for fear that their indiscretions might reveal its codebreaking efforts. But Britain, at least, seemed justified in not expending more of its resources on the Enigma. The Admiralty maintained that Japan was Britain’s chief threat, not Germany, where even that far-right exponent of revanche, Adolf Hitler, had written in Mein Kampf that to win England as an ally he would offer a “renunciation of a German war fleet.”