Fialka — Volume 7 — Security and Cryptanalysis

7.1 About This Volume

Was the Fialka ever broken? The question comes up first whenever the machine is mentioned, and it has no settled answer. The agencies that would know, in the West and in Russia, have published nothing about it. What is published is a set of stories, widely repeated, that trace back to a single book and its anonymous informants.

This volume does not try to answer the question by assertion. It sets out what can be established. That covers the methods that broke the wartime rotor machines and how the Fialka’s design and procedure stood against each of them. It covers what the machine kept from its predecessors, and the threats beyond the cipher itself: capture, compromise and electrical eavesdropping. It covers what the West is known or claimed to have known, and what modern researchers have said. The mathematics is not here. The key space, the period of the stepping and a working attack on the simulator belong to Volumes 3 and 10, written alongside this one. This volume gives the history and the context.

7.2 How Rotor Machines Were Broken

By 1945 the codebreakers of several countries had learned how to break rotor machines, and almost every method relied on a few weaknesses. The Enigma shelf in this collection tells the story at length (Enigma Volume 5 on why the Germans thought it secure, Volume 7 on the Polish break). The Codebreakers shelf covers the American methods, including cribs, stereotypes and isomorphs and the mathematics of irregular stepping. In brief, there were five weaknesses:

1. Regular stepping. In the Enigma, the right-hand wheel moved on every letter and the middle wheel only once every 26 letters, so over long stretches only one wheel moved. A codebreaker could treat a passage of text as enciphered by a fixed scrambler plus one moving wheel, and the Bombe’s attack depended on it.
2. Reflector symmetry. The Enigma’s reflector made every letter’s substitution a swap of pairs, and no letter could encipher to itself. Knowing where a letter could not be let codebreakers slide a guessed word along the cipher text and rule out positions.
3. A weak plugboard. The Enigma’s plugboard swapped up to thirteen pairs of letters. Once a crib fixed a few of the pairs, the rest followed.
4. Known wiring. Captured machines and wheels, or wiring recovered mathematically, removed the largest part of the unknown.
5. Procedure. Repeated message keys, stereotyped openings and signatures, lazy key choices and reuse of keys gave codebreakers their cribs and their footholds.

The American SIGABA, the one major machine of the war that was never read, closed the first of these by making its stepping irregular and key-dependent (SIGABA Volume 8). The Fialka, designed a decade later, closed or narrowed all five.

7.3 What the Fialka Changed

Table 1 — What the Fialka Changed

Weakness	Fialka’s answer	Where described
Regular stepping	All ten wheels can move on every key press; neighbouring wheels turn in opposite directions; blocking pins on each wheel decide whether its neighbour moves. The pin patterns differ from wheel to wheel and with the wheel order	Volume 3
No self-encipherment	The reflector’s “magic circuit” lets a letter come out as itself and makes encipher and decipher distinct settings	Volume 4
Pairwise plugboard	A punched card setting a full 30-letter permutation, not a set of swaps, changed daily	Volumes 4, 6
Known wiring	Wiring different for every country; from 1978, cores that could be swapped between bodies, turned over and offset each day	Volumes 3, 5
Procedure	Printed message keys used once; message key never sent; a fixed message format; off-line working with a decipher check; destruction within 48 hours	Volume 6

The Crypto Museum’s founders put it simply: “the Soviets had clearly learned from the flaws in the Enigma design and its operating procedures” (Crypto Museum). How the Soviet designers learned those lessons is not documented. They may have learned from their own machines’ failures, since the Germans read the K-37 in 1941 (Volume 2). They may have learned from intelligence about Western codebreaking, through John Cairncross at Bletchley Park or through agents in the post-war American agencies. Or they may simply have applied good engineering to a problem that every cipher bureau understood by the 1950s. What is clear is that each change answers a known attack.

7.3.1 Big numbers, and what they mean

Popular accounts like to quote large numbers. The German Spy Museum in Berlin compares the Enigma’s 17,576 wheel positions with the Fialka’s “breath-taking 590,490,000,000,000” (Deutsches Spionagemuseum), and Foreign Policy speaks of “more than 500 trillion codes”. Both numbers are 30 multiplied by itself ten times (30¹⁰, about 5.9 × 10¹⁴), the number of ways the ten wheels can start. That counts only the message key. It leaves out the order of the wheels, the daily card, the ring settings, and, for the PROTON-2 wheels, the choice, orientation and offset of every core. These multiply the total by many more orders of magnitude. The 2015 paper by Eugen Antal and Pavol Zajac in Cryptologia, “Key Space and Period of Fialka M-125 Cipher Machine”, is the published analysis. Volume 3 explains what the full key space and the stepping period mean.

Big numbers, though, prove less than they seem to. The Enigma’s full key space was also astronomically large, and it was broken anyway, by attacks that dealt with one part of the key at a time. A machine is strong only if no attack lets the parts of its key be separated. That is the real question about the Fialka, and only someone who tried to break it in earnest can answer it.

7.4 What It Kept

The Fialka is still a rotor machine with a reflector, and it inherits some of the family’s structure.

• The reflector. The magic circuit breaks the Enigma’s strict rule, but the reflector still pairs most of its contacts. At any one position of the wheels, most letters still encipher in pairs, as on the Enigma, and only a few contacts follow a different rule. Volume 4 describes the circuit. That residual structure is something an attacker could use.
• A fixed set of wheels per country. Within one country’s network, every machine carried the same ten wirings for years. A single captured set of wheels, or a recovered wiring, exposed that network’s wiring until the next issue. The PROTON-2 cores of 1978 made the daily wiring arrangement variable, but the cores themselves stayed the same.
• Clear-text framing. The 1978 East German format put several things in clear at the head of each message: a fixed system indicator (AAAAA), a traffic-type group, the identification groups (repeated three times, character by character, in general traffic), and a service group with the day and group count (Volume 6). None of these reveals the key directly. They do tell an interceptor which system was used, how long the message was and, in general traffic, which input produced the message key. Plain text was also pre-edited to fixed rules, which made openings predictable, such as БББББ at the head of a letter-text message in some key areas. Predictable text is a crib, the oldest foothold in the trade.

Whether any of this was exploited is unknown. These are the places a 1970s codebreaker would have started.

7.5 Beyond the Cipher: Capture, Compromise and Emissions

7.5.1 Compartmentation

The country-specific wiring served politics as well as security. Because a Polish machine could not read Czechoslovak traffic, a defector, a capture or a careless unit in one army exposed that army’s traffic and nobody else’s. Peacetime traffic between allies went through the Soviet side, and a common wheel set was held back for war (Volume 6). For Moscow, the arrangement also meant that the allies’ traffic passed through Soviet hands while the Soviet Union’s own traffic stayed out of theirs.

7.5.2 TEMPEST

The Fialka is an electromechanical printer, and like every teleprinter of its time it radiated. Its current draw changed with each character, its relays and magnets switched in patterns tied to the plain text, and the five-bit code went out on its data socket. Western agencies had known since the Second World War that such emissions could be picked up and read. They called the problem TEMPEST, and the Soviet term was PEMIN.

The BPK-125 power supply, developed in the mid-1960s, was the Soviet answer for the Fialka. A data cable from the machine told it which of the five bits were active, and it switched in five dummy loads so that the current drawn was the same whatever the character. It also injected noise onto the 24-volt line. It weighed 7.6 kg and had its own meter, test buttons and a strobe lamp for checking that the countermeasures worked. According to the Crypto Museum it was issued only in the Soviet Union and Poland. Every other country kept the simple BP-24 (Crypto Museum, TEMPEST PSU). Why Poland and not the others is not known. Volume 5 describes the unit.

7.5.3 Off-line working

The East German rule that the Fialka was never connected directly to a radio was a security measure too. Reuvers and Simons give two reasons, from former operators. A machine left in plain-text mode would send the message in clear. And an operator typing on-line leaves a recognisable rhythm and speed that can reveal something about the message. Enciphering to tape, deciphering the tape as a check and sending it from a separate transmitter removed both risks (Reuvers & Simons 2009, 1.2.4; Library copy).

7.6 What the West Knew

The first public descriptions of the Fialka came in 2003–05, from collectors examining machines that had escaped destruction. Before that, nothing about the machine appeared in open Western literature. Western intelligence agencies certainly knew more, but how much more has not been released.

The general picture of the Cold War codebreaking contest is better known. From late 1948, after “Black Friday”, American and British codebreakers largely lost access to high-level Soviet traffic (Volume 2). Stephen Budiansky’s history of the NSA, Code Warriors (2016), argues that from then on the West’s successes against Soviet communications came less from breaking good ciphers than from collecting and analysing everything else, and from the occasional theft, blunder or defector. As Budiansky told Foreign Policy, “It has always been easier to make a good code than to break a good code” (Borshchevskaya 2019). The NSA has released a great deal about its work against Soviet systems of the 1940s and early 1950s. It has released little about later decades, and nothing found in this research names the Fialka.

Other routes into Warsaw Pact communications security existed. Defectors and agents carried documents west. Colonel Ryszard Kukliński of the Polish General Staff passed tens of thousands of pages of Warsaw Pact documents to the CIA between 1972 and 1981 (Wilson Center). Whether any of that material described the Fialka or its keys has not been published, and this series does not assume that it did. Machines could also be captured. Soviet equipment was supplied to client states in the Middle East and elsewhere, and was captured in their wars. Here the story becomes one of claims rather than records.

7.7 The Three Stories

Three claims about the Fialka being broken appear again and again in lectures, articles and on the web. All three appear first, so far as can be traced, in section 1.2.2 of Reuvers and Simons’ reference manual, “Breaking Fialka”, which in version 2.0 (2009) reads in part:

It was believed by Russian crypto experts up to 1989, that Fialka messages could be read by an outsider after approx. 24 hours. It is also known that in 1967, during the 6-Day War, Israel captured some Fialka machines. It is more than likely that they studied the machines thoroughly, which may have compromised the entire cipher for many years. By the 1970’s the American NSA had developed special software on a so-called ‘super computer’ that enabled them to read Fialka messages relatively quickly. It is rumoured that the Austrians intercepted and decoded quite a substantial amount of East-European Fialka traffic.

(Reuvers & Simons 2009, 1.2.2; Library copy.)

The manual’s references are candid. The belief about “24 hours” is credited to the authors’ 2005 interview with the former East German operator Jörg Drobick. The NSA claim is credited to “various undisclosed sources”, with the note that “the history of breaking Fialka is still very clouded” and that the claim “has been confirmed by at least three independent anonymous sources”. The Israeli and Austrian claims carry no reference at all, and the wording itself is hedged: “more than likely”, “may have”, “it is rumoured”.

These passages were repeated almost word for word in Nicolas Courtois’s widely circulated 2012 lecture slides on the Soviet GOST cipher (“Israel have captured Fialka machines during the 6-day war in 1967 and … nothing more was disclosed”; “In the 1970s the NSA would build a supercomputer to decrypt Fialka routinely”) (Courtois 2012, slides 11–14). From there they spread into blogs and popular articles, usually without the hedges. The Crypto Museum’s own current pages on the Fialka no longer repeat them.

Taken one at a time:

• The Israeli captures. Israel captured large amounts of Egyptian and Syrian equipment in 1967. That Soviet cipher machines were among it is plausible. That they were Fialkas, and that Egypt or Syria held Fialkas at all, is not documented in any published source. The Crypto Museum lists the Fialka’s users as the Warsaw Pact and possibly Cuba, not Middle Eastern clients. Unconfirmed.
• Austrian interception. Neutral Austria ran a capable signals-intelligence service close to Hungary and Czechoslovakia. That it intercepted Warsaw Pact traffic is not in doubt. That it decoded Fialka traffic is a rumour, so labelled by its source. Unconfirmed.
• NSA computer attacks in the 1970s. The claim is that the NSA could read Fialka traffic “relatively quickly” by computer, given the machine’s details. By the 1970s that was within reach of the NSA’s computers, at least for a known wiring and a large enough body of traffic. It is not implausible, and it may well be true. It rests on anonymous sources and has not been confirmed by any released document. Unconfirmed.

The “24 hours” belief deserves a separate word. If it is reported correctly, it describes a planning assumption by Soviet-bloc security staff, who assumed the content of a message would be safe for about a day. Cautious security services often plan that way, and it says nothing about whether anyone actually read Fialka traffic.

7.8 What the Researchers Say

Few academic cryptographers have published on the Fialka, and none has published an attack on the real machine. The Slovak researchers Eugen Antal and Viliam Hromada, introducing a modern stream cipher modelled on it in 2013, wrote that the Fialka “is considered one of the most secure cipher machines”, that its strength comes “from the elimination of the Enigma’s known weaknesses”, and that “there are no known attacks on this cipher” (Antal & Hromada 2013; Library copy). Their 2015 paper with Pavol Zajac measured the key space and the period of the stepping. Moscow’s Museum of Cryptography says that the Fialka “is believed to have remained unbroken” (Museum of Cryptography). Reuvers and Simons themselves add that “with the current raw processing power available on modern computers, it is theoretically possible to break Fialka messages within a few seconds, provided that exact details of the machine’s operation are known”. No published work has demonstrated that.

That last condition matters. The hard part of attacking any rotor machine is not computing power but knowing the machine: the wirings, the pin patterns and the procedure. For the Western agencies of the 1960s, each country’s wheel wiring was a secret to be captured or reconstructed, and the PROTON-2 cores multiplied the daily arrangements again from 1978. Today, the published wirings for four countries and the published procedure make a simulator possible. That is how Volume 10 is able to attack a message. Its attack shows what modern computing can do with full knowledge of the machine and a guessed piece of plain text. It does not show what anyone could do in 1965 without them.

7.9 A Verdict, Hedged

Five points can be stated with confidence.

1. The Fialka’s design removed every structural weakness that the wartime attacks on the Enigma depended on, and it added protection the Enigma never had: printed one-time message keys, off-line working with a decipher check, country-specific wiring, and, in two countries, TEMPEST countermeasures.
2. It kept the reflector structure of the rotor family and the clear-text framing of its message format. Both are places a determined attacker would look.
3. No document released by any Western agency, so far as this research has found, says that Fialka traffic was read.
4. The three famous stories of its being read come from a single published source that relies on anonymous informants and hedges them. They may be true, and none has been confirmed.
5. With today’s published wirings and modern computers, single messages can be attacked in a simulator (Volume 10). That shows the machine is breakable in principle, not that it was broken.

The honest summary is the one Reuvers and Simons gave in 2009: “Whether or not Fialka was safe in terms of cipher security, remains to be seen.”

Sources

• Paul Reuvers and Marc Simons, Fialka M-125: Detailed description of the Russian Fialka cipher machines (Library copy), v2.0, 2009, sections 1.2.1–1.2.4 and Appendix A, PDF.
• Crypto Museum, “M-125 Fialka” and “TEMPEST PSU (BPK-125)”, cryptomuseum.com (read November 2026).
• Eugen Antal and Viliam Hromada, “A New Stream Cipher Based on Fialka M-125” (Library copy), Tatra Mountains Mathematical Publications 57 (2013), 101–118, doi:10.2478/tmmp-2013-0038, PDF.
• Eugen Antal and Pavol Zajac, “Key Space and Period of Fialka M-125 Cipher Machine”, Cryptologia 39:2 (2015), 126–144, doi:10.1080/01611194.2014.915264.
• Nicolas T. Courtois, “GOST, Self-Similarity and Cryptanalysis of Block Ciphers” (lecture slides, 29C3, 2012), UCL Discovery.
• Stephen Budiansky, Code Warriors: NSA’s Codebreakers and the Secret Intelligence War Against the Soviet Union (Knopf, 2016).
• Anna Borshchevskaya, “The Soviets’ Unbreakable Code”, Foreign Policy, 27 April 2019, foreignpolicy.com.
• Deutsches Spionagemuseum, “The M-125-3 Fialka cipher machine”, deutsches-spionagemuseum.de.
• Museum of Cryptography, Moscow, M-125-3M object page, cryptography-museum.ru.
• Wilson Center, “Documents on Controversial CIA Spy Ryszard Kukliński”, wilsoncenter.org.

---

Next — Volume 8: After 1990 — Declassification, Collectors and Museums. Machines recalled to Russia and destroyed; Czech machines smashed with hammers and burned; a batch of Polish machines that slipped onto the surplus market before Moscow noticed; two Dutch engineers tracing every wire of a machine nobody would explain; KGB retirement presents that surfaced in 2017; auction prices above $20,000; and the day in 2021 when Moscow put its own Fialka on display.