Fialka — Volume 10 — Running a Fialka — Setting a Key, a Worked Message, and an Attack Demo

10.1 About This Volume

The previous volumes took the Fialka apart. This one puts it to work, following the 1978 operating instructions of the East German National People’s Army, A 040/1/321 (“Operations manual for M-125”). They are the most detailed published account of how the machine was used (English translation; Library copy; the German original is held by Crypto Museum). Section numbers below are that manual’s. Volume 6 describes the key system as a whole: key packages, distribution, traffic types and destruction. This volume follows one operator through one day: setting the daily key, setting a message key, enciphering a message, handing it over, and deciphering it at the other end. It then measures the key and attacks a message on the simulator.

Everything here runs on the unit’s simulator, 03-outputs/tools/fialka_sim.py, which Volume 9 describes and tests, or on a replica built to Volume 9’s design. The key is the series’s demonstration key for a Czechoslovak machine with 6K wheels, invented for this purpose. No real Fialka key list has been published, and none is reproduced here. The message, the identification group and the card number are invented too.

10.2 The Day’s Key

An East German cipher post received its keys in sealed packages. A month’s Daily Key Package contained 31 daily key tables and 31 punched key cards for the KC 30 × 30 reader, numbered 1 to 31 for the days of the month, with a signature sheet to record that each had been taken out (A 040/1/321, 2.2.3). A daily key was valid for 24 hours. For machines with adjustable wheels, the daily key table holds five lines of two five-letter groups:

1. the order of the wheel bodies on the spindle;
2. the ring setting of each body;
3. the cores, in the order of the bodies in line 1;
4. which side of each core faces outwards (written I or 2);
5. the core setting, the letter of the index ring against which each core’s mark is set.

The day’s number is printed beside the table. Machines with fixed wheels had a shorter table: one line for the wheel order, and one or two lines of start positions used in general traffic.

The demonstration key reads:

Table 1 — The demonstration key reads

Line	First group	Second group	Meaning
1	ЖВКАЕ	ИГБЗД	wheel bodies in slots 1–10, counted from the left
2	МЩВТЖ	ЯОАЦИ	ring settings
3	ГЗАКБ	ЕВИДЖ	cores
4	I22II	2I2II	core side outwards
5	ДСЮЛБ	ФИЫОЧ	core settings

The demonstration card, number 07, is the one drawn in Volume 4. In the simulator’s terms, the same key is the file printed by fialka_sim.py --demo-key, with every letter written as its contact number (А = 1 … Й = 30).

10.3 Setting Up

The manual’s procedure for adjustable wheels is short and exact (A 040/1/321, 7.2.3):

1. Remove the spring ring from the spindle, pull the wheels off, loosen each core’s lock-washer and take the cores out of the bodies.
2. Lay the bodies out in the order of line 1: Ж, В, К, А, Е, И, Г, Б, З, Д.
3. Set each body’s ring to the letter of line 2: Ж’s ring to М, В’s to Щ, and so on.
4. Lay the cores beside the bodies in the order of line 3: core Г beside body Ж, core З beside body В, and so on.
5. Insert each core with the side shown in line 4 outwards: Г with side 1, З with side 2, А with side 2, and so on.
6. Turn each core until its mark stands at the letter of line 5 (Д, С, Ю …), and lock it with its washer.
7. Slide the wheels onto the spindle in the order of line 1, fixed contacts against the stop, and fit the spring ring.

Then the day’s card goes into the reader drawer, with its number at the left corner and its edge against the stop (7.2.2). “The Daily Key Settings must always be checked,” the manual adds (7.2.1). Nothing in the machine checks them for the operator. A wrong ring or a core turned the wrong way produces a cipher that the other station cannot read, and nobody knows until it fails to.

Machines with fixed wheels needed only step 7. When a station with adjustable wheels had to work with one using fixed wheels, the adjustable set was put into its basic setting: rings at А, each core in its own body, side 1 out, marks at А. In that setting it behaves as the fixed set (7.2.1). Volume 3 explains why.

10.4 The Message Key

Each message used a new message key: ten letters, one starting position for each wheel. For individual and circular traffic the message keys came in a separate Message Key Package of 40 tables, numbered 01 to 40, each holding two five-letter groups. A table was used for one message and struck out. “Repeated use of a key table for the enciphering of individual, circular or general traffic is forbidden!” (A 040/1/321, 2.2.4, 7.3.1). With the message key in hand, the operator turns the first wheel from the left until the first letter shows just above the ruler, then the second wheel, and so on to the tenth (7.3.2).

The demonstration message uses the message key

ЖУВЩО ЮЛБЦР

which puts the wheels at 07 19 03 25 14 28 11 02 22 16 in contact numbers.

For general traffic, messages that any station holding the key could read, there was no message key table. The operator generated the key at the machine. They set the wheels to the daily start position, typed two five-character identification groups (either taken from an issued table or chosen at random), and read the message key from the printed result. The two groups enciphered under the daily setting became the ten letters of the message key. The manual forbids identification groups that repeat one character or follow the keyboard in order. It also requires the resulting message key to contain at least three different characters, and a new identification group to be used if it does not (7.3.3). This is the Enigma indicator procedure in reverse: the receiver deciphers the identification groups at the daily setting to recover the message key. Unlike the Enigma procedure, nothing is enciphered twice.

10.5 A Message

The plaintext is a short exercise message, typed with the Czechoslovak Latin print head:

EXERCISE BEGINS AT DAWN ON THE TWELFTH ALL UNITS REPORT READINESS BY NOON ON THE ELEVENTH

The manual’s procedure for printing to tape runs as follows (7.5.2):

1. TEXT MODE to letters (Б); MODE to plain text (О); printer on; automatic five-letter grouping on.
2. Type the system indicator group in clear: AAAAA for a letter message (11111 for a numeric one), so the receiver knows it is a Fialka message (7.4.2).
3. Type the identification group, also in clear. In individual traffic it identifies the message key table that was used. With a Latin print head, its Cyrillic letters print as their Latin key tops (7.4.4). The demonstration message uses the invented group ЛНЕАУ, which prints as KZTFE.
4. MODE to coding (З). Reset the letter counter; switch the automatic grouping off, since the machine now groups the cipher.
5. Set the message key on the wheels.
6. Type the plaintext. A space is typed with the space bar and enciphered as the key Й (on this head, the key 2).
7. If the last group is incomplete, finish it with spaces, checking the count on the counter.
8. MODE back to plain text, one space, and type the service group.

Typed through the simulator at the message key ЖУВЩО ЮЛБЦР, the 89 characters of plaintext and one padding space produce eighteen groups:

QYZAZ PMWEM TFOJX H8C8U 2KRHD 88IQY IGYES 77IOO YUDNU JWFI8 RKG7X 5YCAF 8WWHB DRHF2 HVAWI ORTJW WJTW2 CAQAV

The cipher text contains figures, because the Czechoslovak Latin head uses 2, 5, 7 and 8 for the four Cyrillic letters that have no Latin equivalent. The figure 2 is the key shared with the space bar. Three plaintext letters are enciphered as themselves: the E of TWELFTH (letter 34), the A of READINESS (59) and the T of THE (78), which print as E, A and T in the cipher. On an Enigma none of the three would have been possible.

10.6 Deciphering It

The receiving operator has the same daily key and card, and the second copy of the Message Key Package. In the manual’s words, “copy 1 for enciphering, the other copy is for deciphering” (2.2.4). Reading the identification group KZTFE from the head of the tape, the operator finds the message key table it names and sets the wheels to ЖУВЩО ЮЛБЦР. Then the MODE switch goes to decoding (Р) and the cipher groups are typed. The simulator, given the same key, prints:

EXERCISE BEGINS AT DAWN ON THE TWELFTH ALL UNITS REPORT READINESS BY NOON ON THE ELEVENTH

The receiving machine turns every Й (key 2) that comes back into a space, so the word divisions return and the padding space disappears at the end. The 2s that appear in the cipher text are ordinary cipher letters and are typed as such.

10.7 When Things Go Wrong

The manual devotes a chapter to de-garbling, the procedures for a message that will not decipher or deciphers partly (A 040/1/321, chapter 9). The simulator shows what the common faults look like.

Mode switch left at coding. Deciphered with the switch at З instead of Р, the message comes out recognisable but wrong in places:

EXER8ISE2BEGINS2AT2YAWN2OF2THE2TWELATH2ALL2UNLTX2REPORT27EADSNESY2BY2NOON2ON2THE2ELE8ENTH2

Ten of the ninety letters are wrong. These are the letters whose path ran through the three-point circuit, which turns the other way in coding mode (Volume 4). The rest are right, and the spaces show as 2 because the machine is not decoding. To an operator this pattern points straight at the switch.

A lost letter. If the twentieth cipher letter, U, is dropped in transmission, the receiver’s wheels fall one step behind at that point:

EXERCISE BEGINS AT R8USPRNPMR7QBPCXFS5 JKP8N5SZKV8MGPQRIS7HXWNI CSGTF…

Everything before the loss is correct and everything after it is garbage. The manual’s remedy is to find where the text breaks off, step the wheels on by hand, and try again from there, or to ask for a repeat (chapters 9 and 10).

A mis-set ring. With the ring of the tenth wheel one letter out, every letter of the message is wrong from the start. The ring moves the wiring, and the tenth wheel is in the path of every letter. The same happens with a core in the wrong body, the wrong side out or one notch off. Faults in the daily key garble everything; faults in transmission garble from the point of error. The pattern is a guide to where to look.

A dirty contact prints an asterisk in place of the letter, because no current comes back (Volume 4). Asterisks scattered through a tape meant the wheels needed cleaning, not that the key was wrong.

10.8 How Big Is the Key?

The settings an operator controlled, and the number of ways to choose each, are:

Table 2 — The settings an operator controlled, and the number of ways to choose each, are

Setting	Choices	Number
Order of the ten wheel bodies (which pins are where)	10!	3,628,800
Start positions (message key)	30¹⁰	5.9 × 10¹⁴
Key card	30!	2.65 × 10³²
Adjustable wheels only:
Ring settings	30¹⁰	5.9 × 10¹⁴
Core order	10!	3,628,800
Core sides	2¹⁰	1,024
Core settings	30¹⁰	5.9 × 10¹⁴

Multiplying everything gives about 7 × 10⁹² for adjustable wheels, but that overstates the key. As Volume 3 showed, a wheel’s position and its ring setting enter the cipher only as their sum; the simulator’s self-test confirms that moving a wheel five places on and its ring five places back gives the same cipher. For a single message, therefore, positions and rings together are worth 30¹⁰, not 30²⁰. The number of genuinely different machine states for one message is:

• fixed wheels: 10! × 30¹⁰ × 30! ≈ 5.7 × 10⁵³, about 2¹⁷⁹;
• adjustable wheels: 10! × 10! × 2¹⁰ × 30¹⁰ × 30¹⁰ × 30! ≈ 1.2 × 10⁷⁸, about 2²⁵⁹.

These are upper bounds computed for this volume. Antal and Zajac’s 2015 Cryptologia paper treats the key space formally (doi:10.1080/01611194.2014.915264); its figures are not reproduced here. The card alone, at about 2¹⁰⁸, is larger than the whole key of a three-wheel Enigma with its plugboard, the “159 quintillion” (about 1.6 × 10²⁰) of the Enigma unit. Two cautions apply. First, the wiring and pins of a series were fixed for years and shared by every machine in a country, so they are not part of the daily key. An opponent who captured one set of wheels knew them for every message, as an opponent who captured an Enigma rotor did. Second, a large key space says nothing about shortcuts. Enigma’s key was already far too large to search, and it was broken through its structure and its operators. Volume 7 discusses which shortcuts the Fialka closed and what is and is not known about Western successes against it.

The machine’s period is the number of key-presses before the wheel positions repeat. For the demonstration key, the simulator finds that each stepping chain of five wheels runs 24,300,000 key-presses, exactly 30⁵, before it returns to its start. The two chains repeat together at the same count, so the whole drum’s cycle is 24.3 million letters. The blocking-pin counts, all primes coprime to 30, appear designed to give each chain its full cycle (Volume 3). At 500 letters a minute, a machine would have to type for more than a month without stopping to repeat itself once.

10.9 An Attack Demonstration

No cryptanalysis of the Fialka has been published in the open literature. Antal and Hromada wrote in 2013 that “there are no known attacks on this cipher” (Tatra Mt. Math. Publ. 57; Library copy), and Antal and Zajac’s later analysis concerns key space and period, not a break. Claims that Israel, Austria or the NSA read Fialka traffic all trace to anonymous sources in the 2009 Reference Manual, and Volume 7 examines them; nothing below bears on them. A challenge document titled “The Fialka Challenge – Part 1” (August 2024, author “madness”, apparently from the MysteryTwister puzzle series) asks for five missing message-key letters of a 3K message from cipher text alone. It has not been confirmed on the MysteryTwister site, and its solution is not attempted here.

What the simulator can show is how the Fialka’s design defeats the two oldest tools against rotor machines: the crib and the brute-force search. The program is 03-outputs/tools/fialka_attack.py, and every number below is its output.

10.9.1 The Crib That Fails

Against Enigma, a crib (a stretch of plaintext believed to be in the message) could be placed against the cipher text by elimination. Because no letter enciphered to itself, any position where a crib letter stood over the same cipher letter was impossible. Fialka’s contact 13 ends that. In the worked message, the crib THE TWELFTH (with its spaces, as the machine enciphers them) stands at letter 28 and contains one coincidence, the E at letter 34. Of the 78 places the crib could stand, the Enigma rule would strike out 29, including the right one. The rule does not merely fail to help; it removes the answer.

10.9.2 A Search With Almost Everything Known

The second demonstration gives the attacker every advantage short of the answer. They have the whole daily key: wheel order, rings, cores, sides, core settings and the card. They know the first twelve letters of the plaintext, EXERCISE BEG. They are missing only the last three letters of the message key, the positions of wheels 8, 9 and 10. That leaves 30³ = 27,000 candidates. For each, the program enciphers the crib letter by letter and abandons the candidate at the first mismatch:

Table 3 — The second demonstration gives the attacker every advantage short of the answer. They have the whole daily key: wheel order, rings, cores, sides, core settings and the card. They know the first twelve letters of the plaintext, EXERCISE BEG. They are missing only the last three letters of the message key, the positions of wheels 8, 9 and 10. That leaves 30³ = 27,000 candidates. For each, the program enciphers the crib letter by letter and abandons the candidate at the first mismatch

Crib letters tested	0	1	2	3	4	5–12
Candidates left	27,000	875	33	4	1	1

Each crib letter keeps about one wrong candidate in thirty, because a wrong setting gives a random letter. After four letters only the true setting, 07 19 03 25 14 28 11 02 22 16, is left, and the remaining eight letters confirm it. The whole search takes about a sixth of a second in Python on an ordinary desktop computer, at roughly 6 to 8 microseconds per candidate (the exact figure depends on the computer and its load).

The same program extrapolates at that rate:

Table 4 — The same program extrapolates at that rate

Unknown message-key letters	Candidates	Time (Python, one core)
3	27,000	a fraction of a second
4	810,000	a few seconds
5	24,300,000	a few minutes
10 (the whole message key)	5.9 × 10¹⁴	one to two centuries

These figures still assume that the attacker holds the daily key and a crib. Without the card, the search for a single message grows by a further factor of 30! ≈ 2.65 × 10³². Without the wheel order and cores, it grows by at least 10! × 10! × 2¹⁰ more. No amount of computing power finds keys of that size by trial. An attack would have had to exploit structure, as the attacks on Enigma, SIGABA and the Lorenz machine did, or to obtain the daily key some other way: capture, betrayal or an operator’s mistake. Whether anyone found such a route against the Fialka is not on the public record.

10.10 Running the Replica: A Checklist

1. Daily key. Bodies in order (line 1), rings (line 2), cores (line 3), sides (line 4), core settings (line 5), lock-washers, spindle, spring ring. Card in the drawer, number at the left.
2. Check. Set the basic setting on a spare set, or use the simulator: type a test line at a known setting and compare with fialka_sim.py --encrypt.
3. Header. MODE О, TEXT Б: AAAAA, identification group.
4. Message key. Set from the left, wheel 1 first. Check the row of ten letters above the ruler against the table.
5. Encipher. MODE З, counter to zero, type, pad the last group with spaces, MODE О, space, service group.
6. Decipher. Same daily key, message key from the identification group, MODE Р, type the groups.
7. If it garbles. Mode switch first, then the point where the garble starts, then the daily key.
8. Afterwards. Strike out the message key table. In the original system, key material was destroyed and signed for at the end of its validity (Volume 6).

10.11 The End of the Series

The Fialka was designed in the Soviet Union and introduced in about 1956 (Volume 2), by engineers who evidently knew how the Enigma had been broken. It was issued across the Warsaw Pact and to allies such as Cuba, each country with its own wheel wirings, and stayed in service until the early 1990s. After that, most machines were returned to Russia and destroyed. The few that survived, and the work of Reuvers and Simons and the collectors who followed them, made it possible to trace every wire. That is why a machine that was secret for forty years can now be simulated letter for letter, checked against independent programs, and rebuilt on a workbench. Volume 1 begins the story again for any reader starting here, with the questions this series set out to answer: what the “Russian Enigma” was, how much of the Enigma it kept, and what it changed.

Sources

• Nationale Volksarmee, A 040/1/321 — System M-125 (M-125-3MN and M-125-MN) — Operations manual, in force 1 December 1978, English translation by “JMcC” (sections 2.2, 7.2–7.5, 9): PDF (Library copy); German original via Crypto Museum.
• Paul Reuvers & Marc Simons, Fialka M-125 Reference Manual, version 2.0, Crypto Museum: PDF (Library copy).
• E. Antal & V. Hromada, “A new stream cipher based on Fialka M-125” (Library copy), Tatra Mountains Mathematical Publications 57 (2013) 101–118: PDF.
• E. Antal & P. Zajac, “Key Space and Period of Fialka M-125 Cipher Machine”, Cryptologia 39(2), 2015, 126–144: doi:10.1080/01611194.2014.915264 (abstract consulted).
• “The Fialka Challenge – Part 1” (author “madness”, August 2024), copy in github.com/Lumenman/FIALKA (materials/challenge/); source site not confirmed.
• Worked examples and measurements: 03-outputs/tools/fialka_sim.py and fialka_attack.py (this series).

---

Back to the beginning — Volume 1: The Soviet Rotor Machine. What the M-125 Fialka was, why “the Russian Enigma” is only half right, who built it and who used it, and how the ten volumes of this series fit together.