Historical Document · 2015
Full history: Hebern, Friedman's M-134, Rowlett's stepping maze, the Navy, production, wartime security, key-space and mechanics appendices (52 pp.) [writer A]
Center for Cryptologic History The SIGABA / ECM II Cipher Machine : “A Beautiful Idea” This publication presents a historical perspective for informational and educational purposes, is the result of independent research, and does not necessarily reflect a position of NSA/CSS or any other U.S. government entity. This publication is distributed free by the National Security Agency. If you would like additional copies, please e-mail [email protected] or write to: Center for Cryptologic History National Security Agency 9800 Savage Road, Suite 6886 Fort George G. Meade, MD 20755 Timothy Mucklow was a senior historian on the staff of the Center for Cryptologic History following a long career in information assurance at NSA and with the Air Force. After a decade in academia, he served as a military historian at the wing, division, and major command levels and produced a series of monographs and articles on such topics as information assurance, telecommunications and computers, and national defense issues, and has offered IA seminars at military facilities around the world. He received his Ph.D. in 1982. He retired from the CCH in 2013. Acknowledgments. The Center for Cryptologic History is grateful to Dr. Craig Bauer, professor of mathematics at York College of Pennsylvania and editor-in-chief of the journal Cryptologia, for his assistance with this project, and to LeeAnn Tallman for earlier research. The SIGABA / ECM II Cipher Machine: “A Beautiful Idea” Timothy J. Mucklow National Security Agency Center for Cryptologic History 2015 Contents Introduction ....................................................................................... 1 And Hebern Saw the Wheel .................................................................... 2 Deus ex Machine ................................................................................. 5 Rowlett’s Epiphany .............................................................................. 7 Iacta Alea Est. [The Die Is Cast.] ........................................................... 10 Enter the Navy .................................................................................. 12 A Disagreeable but Rewarding Surprise .................................................... 14 SIGABA Is Built ................................................................................... 16 An Impenetrable Machine ..................................................................... 22 The Big Machine That Did ..................................................................... 25 Appendix A: Technical Analysis of SIGABA’s Key Space .................................. 29 Appendix B: The Mechanics of SIGABA...................................................... 32 Notes .............................................................................................. 38 Selected Bibliography .......................................................................... 42 SIGABA / ECM II Cipher Machine Introduction D uring World War I, both the Americans and the Europeans had used manual code and cipher systems to secure their critical information. With the advent of the machine age, however, it was only a matter of time before cryptography became mechanized. Two decades later, as the world embroiled itself in another major conflict, the use of cipher machines became commonplace, and the old craft of cryptology at long last became mathematically based. With the dawn of this new cryptologic age, a worldwide scramble for even stronger encryption began. Well before the First World War, much work had been done to formalize the cryptographic discipline. One of those who made a major contribution to this process was the 19th-century polyglot Auguste Kerckhoffs, who, besides teaching languages, dabbled in cryptography. In 1883 he penned a two-essay series, La Cryptographie Militaire, for the Journal des Sciences Militaire, which earned him a niche in cryptographic history. Kerckhoffs in his writings had articulated six basic principles of cryptography, but he is most commonly remembered for his second, which states that 1 the “design of the system should not require secrecy, and compromise of the system should not inconvenience the correspondents.”1 His argument was that neither the elements of an encryption algorithm nor the workings of an encryption machine should constitute the basis of a cipher’s security. Instead, an easily changeable key should be the critical component. In the 1930s, the U.S. Army cryptologist William Friedman and his assistant Frank Rowlett drew on this simple precept to conceive a cipher machine that was easy to use, simple to rekey, and ostensibly impossible to break. Then, in a fit of collaboration with the Navy, as unprecedented as it was peculiar, the two services went on to perfect and jointly field their device. To the Army it was known as SIGABA, to the Navy, ECM (Electric Cipher Machine) II. (The technical aspects of SIGABA’s operation can be found in Appendixes A and B.) Not only was SIGABA the most secure cipher machine of World War II, but it went on to provide yeoman service for decades thereafter. The story of its development is improbable. Its impact was incalculable. 1 And Hebern Saw the Wheel M r. Edward Hebern of Madera, California, is generally credited with inventing the first American electromechanical rotor cipher machine.2 According to lore, he came up with the idea around 1912 while serving a term in the state penitentiary for horse thievery. If there were any connection between breaking rocks and his cryptographic epiphany, Hebern never offered one. By the end of 1915 he had built a working model, filed a patent, and was knocking on the doors of potential buyers.3 It was not long before the U.S. Navy began showing interest in Hebern’s device, and in the years that followed the Navy would buy and test a number of his successive machines. As something of a historical twist, one of Hebern’s early employees, Agnes (Meyer) Driscoll, went on to become a luminary of American cryptology in her own right. Half a century after Hebern set out to peddle his original device, the Army cryptologist Frank Rowlett acknowledged in his memoirs that the Hebern cipher machine was an important invention in pre-World War II American cryptography. Rowlett, nevertheless, went on to add, Navy cryptographers asked [William] Friedman for his assessment of the security it afforded … [T]he Navy [supplied] a set of messages prepared exactly in accordance with the procedures which they had pro- 2 posed, but using a set of cipher wheels whose wiring was to be unknown to Friedman … Friedman was successful in his attack on the system.4 With little effort, Friedman was able to decipher every Hebern-enciphered message sent his way. To do this, Friedman, who had already married cryptanalysis and mathematics, used a statistical approach along with a “divide-and-conquer” strategy to break the Hebern machine. As Friedman saw it, there were only two unknowns, the cipher wheel (with twentysix characters) and the rest of the machine. Since the cipher wheel stepped regularly and predictably, the rest of the machine could be considered a constant. It was then a simple matter of sequentially analyzing the individual components. Friedman realized from experience that the regular advancement of the Hebern cipher rotors, like all machines of that era, posed an intrinsic cryptologic vulnerability that was mathematically exploitable. He conjectured that to make a cryptographically sound machine, one would need a countermeasure to address predictable rotor movements. But just how such pseudorandom movement could be achieved consumed Friedman’s thoughts for years. Friedman’s solution, when it finally came to him around 1926, was conceptually simple and the technology proven.5 It occurred to him that paper tape similar to that used by telegraphers And Hebern Saw the Wheel Edward Hebern and his electromechanical rotor cipher machine (courtesy of Ralph Simpson, CipherMachines.com) could also be used to dictate the movements of the cipher wheels. Friedman reasoned that it would be relatively easy to generate long sequences of random fiveunit keys and that the tape itself was easily replaceable and relatively inexpensive. Holes punched in a tape would permit feeler contacts to turn an electrical current on or off, causing a cipher machine’s rotors to step. Thus, with each key stroke, randomly placed holes in a five-group tape would produce an apparent random stepping for one or more of the cipher rotors. The cipher text is printed on a small tape. The decryption process simply works in reverse. Key tape could be manufactured in secure facilities, distributed to the appropriate recipients, and inserted into the machine according to rigidly imposed, pre-established schedules.6 William Friedman with AT&T printing telegraph, 1920 (courtesy of the George C. Marshall Foundation, Lexington, Virginia) 3 SIGABA / ECM II Cipher Machine The crypto rotor wheels William Friedman envisioned for his device were flattened cylinders with an alphabet around the circumference. One face of the cylinder had twenty-six spring-loaded copper pins protruding from it; the other face had twenty-six flush copper contacts. Inside each cylinder was a wire maze connecting the electrical contacts on one side to the pins on the other. Thus, an electrical impulse beginning with, say, the letter A on one side might connect to H on the other side and so on around the wheel in random fashion. Several cylinders serially juxtaposed on a spindle sideby-side could further scramble impulses. (Image courtesy the online Crypto Museum, www.cryptomuseum.com) Five-group punched hole paper telegraphic tape 4 Deus ex Machine O n April 23, 1932, Friedman revealed his idea of randomly stepping rotors to his three junior cryptanalysts: Frank Rowlett, Solomon Kullback, and Abraham Sinkov.7 This foursome at the time constituted the bulk of the U.S. Army’s cryptanalytic organization, the Signal Intelligence Service (SIS). At the meeting Friedman enthusiastically explained that “the inherent weakness of all such devices” (where the devices were cipher machines that determined their own rotor stepping pattern) is that “the keying mechanism is a part of the device itself.” 8 He then went on to draw for them several rough sketches of a cipher machine with a “key tape transmitter” that, in conformity with Kerckhoffs’ second principle, would separate keying material from the cipher machine. His colleagues were duly impressed with his visionary countermeasure; certainly Friedman had good reason to be pleased with his own inventiveness. William Friedman, over the course of his life, demonstrated a penchant for collecting cryptographically related patents. Ultimately he was granted thirty of them.9 Like inventors before and since, he discovered that dealing with the U.S. Patent Office was neither a pleasant nor an alacritous proposition. In fact Friedman’s own experiences with government red tape proved to be an ongoing source of exasperation that consumed his time and sapped his energies. As many times as he explained it to them, patent office officials simply could not—or would 5 not—recognize the unique contribution to cryptology presented by randomly stepping rotors. There remain today bundles of letters between Friedman and the patent office, often in duplicate and triplicate copies, meticulously detailing the merits of his respective patents years after the initial patent applications were filed.10 In spite of his repeated petitions, patent office officials sitting only blocks away from Friedman obdurately continued to presume that any cipher rotor machine was just an unimaginative derivation of the Hebern machine. In a letter from Friedman to the U.S. Patent Office dated December 5, 1934, regarding Patent Serial No. 682,096, he stated, “the cipher key here serves as the physical embodiment of the ‘keying principle’ … and that its sole purpose is to serve as the controlling element in effecting the displacements of the cipher wheels in a variable manner. Contrast this situation with that in Hebern.”11 In the Hebern cipher machine, the complexity is the machine’s wiring, not the initial setting of the cipher wheels or the placement of the rotors. Friedman continued, “Referring now only to the mechanism for displacing the cipher wheels, in Hebern there is embodied no such thing as a cipher key which corresponds to a ‘keying principle which is variable in character’ because the mechanism for displacing the cipher wheels is absolutely fixed.”12 In the Hebern cipher machine, the cipher wheels advanced in the 5 SIGABA / ECM II Cipher Machine these movements are regular or periodic in character, and controlled by ratchet mechanisms internal to the device itself. In the present invention [Friedman’s], these movements are controlled by the cipher key transmitter in an aperiodic manner … It will be recognized that the Hebern structure has the inherent weakness of all such devices where the keying mechanism is a part of the device itself. Periodical recurrence of movements is a natural characteristic of all such mechanisms and the predictable factor thus introduced defeats the essential purpose.14 As the months turned into years, it probably occurred to Friedman that his purposes might have better served by addressing his letters to Santa Claus. Friedman’s M-134 converter. Note plugboard at upper left. same regular manner for every message. Friedman’s complaint was in response to a letter from the Patent Office, posted June 6, 1934, which states that Friedman’s claims were “rejected on Heburn [sic].”13 In still another letter from Friedman to the Patent Office, dated April 3, 1934, he again contended, In Hebern the movements or displacements of the code wheels are purely mechanical; 6 From the time Friedman had identified the weakness in contemporary rotor cipher machines and had conceptualized an effective countermeasure, the subsequent refinements to his pseudorandom stepping rotors were entirely evolutionary. As Friedman’s design for his new devices became more sophisticated, they manifested themselves under a succession of names, including M-134, M-134A, M-134-T1, and M-134-T2. When Friedman’s M-134 Converter went into production, it “consisted of the chassis, the machine itself, an assembly of wheels,” a plugboard, and a punched tape transmitter (reader).15 Drawing on a pool of ten different rotor wheels, the M-134 used five wheels at a time, but it was the paper key tape that provided movement to the respective rotors and gave it cryptographic strength. Rowlett’s Epiphany F rank Rowlett, who had received several years of cryptanalytic training under Friedman, was given the unenviable task of creating the quantities of key tape necessary to drive Friedman’s electric cipher machines. Rowlett recorded why and how in 1934 he had been assigned the job of making key tape. He said, “Now Friedman’s thought was that we ought to get cracking on the construction of these tapes so that when the machines came off the assembly line” they could be sent out to field stations right away. Unfortunately, the machine Friedman had designed for the process of generating key tapes was beset with problems, and Rowlett spent much of his time trying to make it work properly. Rowlett continued with a touch of irony: “I got stuck with the job of making the tapes because I had a little bit more practice in mechanical things than the rest of the group and I think they were smarter than I because they didn’t let it be known.”16 Being the dedicated mathematician that he was, Rowlett set out to make the key as random as possible. Since theory and practice are frequently at odds with one another, he discovered that producing key tape proved to be a more difficult undertaking than Friedman had envisioned. Rowlett struggled with the problem of key generation until he became completely frustrated. It was obvious to him that producing loops of paper tape with holes randomly punched throughout their lengths was too labor intensive and probably rife 7 with vulnerabilities. Too, Rowlett really doubted the overall practicality of Friedman’s key tape transmitter. He surmised that in stressful environments operators might easily tear or misuse key tapes. Just as disturbing to him was the prospect of their succumbing to the temptation to reuse the key tapes and their starting places. Rowlett was also concerned about numerous issues associated with Friedman’s machine. Not only were Friedman’s key tapes lengthy, but they required all parties on a particular network to maintain the same large inventories of keying material. The distribution of and the accountability for tape alone would entail untold manpower and resources, not to mention acquiring secure facilities for its storage. Besides his reservations about Friedman’s key tape transmitter mechanism, Rowlett just didn’t like making the paper key tapes for the M-134 and would do almost anything to return to the more exciting work of breaking into Japanese ciphers. Given Rowlett’s affinity for machine solutions, he sought a means of automating this impossible assignment. With a burst of inspiration, he decided that it might be possible to use one set of rotor wheels to generate the random stepping movement for the M-134 cipher rotor wheels. If he could find a way to do that, the entire process would become much easier and undoubtedly more secure. He would later admit in an interview, 7 SIGABA / ECM II Cipher Machine Key tape for the M-134 converter I don’t know that I ever was confronted with a more hopeless task than making these [Friedman’s] devices work and do what was needed and I soon became desperate. It didn’t take more than a month for me to realize that I was fighting a real losing battle here, and as you are apt to do in the case of where necessity becomes very evident you try to figure out some better way of doing things and I was dreaming about how rotors could be made to do other [things] and decipher [messages].17 As the drudgery of developing key tapes became more tedious, the solution came to him. I thought it would be a helluva good idea if we replaced these key tapes with a second set of rotors which in effect would generate five screens of impulses equivalent to the holes and no holes in the five levels of the tape and use this assembly of five additional rotors 8 instead of the tapes. Well, I thought this was a pretty powerful thing and I just was so enthusiastic about it because it looked like I was getting out of this impossible task, I went to tell Friedman about it.18 Armed with enthusiastic conviction, Rowlett approached his boss about scrapping the whole key tape transmitter concept and moving on to something more cryptographically sound. After permitting Rowlett only briefly to present his discovery, Friedman would hear no more. He categorically refused to believe it possible to create a machine capable of generating its own random stepping.19 Friedman, who was every bit as hard-headed as his nemeses over at the Patent Office, remained wedded to using replaceable paper key tape. After all, his salient argument for pursuing a patent for his key tape transmitter—which caused the cipher rotors to advance irregularly—was that any machine that determined its own stepping would be in violation of Kerckhoffs’ second principle and, therefore, vul- Rowlett’s Epiphany nerable to cryptanalysis. To what degree the loss of a potential patent clouded the respectable Friedman’s thinking is not known. Frank Rowlett, besides being intellectually brilliant, was a tenacious man and not the sort to abandon a cause in which he genuinely believed. Time and again, he requested of his employer the opportunity to fully explain his concept. Each attempt made Friedman all the more formal—to the point of being brusque—and their strained working relationship slowly approached a breaking point. Years later, Rowlett recounted, Frank Rowlett, besides being intellectually brilliant, was a tenacious man and not the sort to abandon a cause in which he genuinely believed. This went on for, oh, I guess six, eight, ten months, I confronted Friedman … Friedman was still reluctant and finally out of a real fit of desperation I said, either Mr. Friedman I don’t know what I’m talking about or I know what I’m talking about and you don’t understand me … I think we’ve got to clear this up because I’m going to have to quit that job. I just can’t meet your requirements.20 Then being on something of a roll, Rowlett went on to inform the unsmiling Friedman that he would have to go above Friedman’s head to the Army’s chief signal officer if Friedman did not give his proposal a fair hearing. This of course was a risky gamble for a family man in the depths of the Great Depression. Friedman was now faced with an ultimatum and had to weigh the respective merits of retaining a capable and loyal assistant or losing face to his subordinate. Reluctantly, he offered Rowlett an opportunity to fully lay out his concept.21 Frank Rowlett 9 Iacta Alea Est.* R owlett knew this would be his sole opportunity to sell his stepping maze concept and came to the meeting well prepared. One after the next he responded to Friedman’s sometimes insightful, sometimes petty questions with rock-solid, unambiguous answers. At the end of the tension-filled session, Friedman was forced to pause and reconsider some of his own cherished cryptographic perceptions. Not only did Rowlett’s invention run counter to Friedman’s previously published opinions against the incorporation of keying logic into a cipher machine, but it made Friedman’s beloved pet project, the M-134, obsolete. Following Rowlett’s presentation, there was a long and pregnant silence, after which Rowlett was coolly dismissed from the room. Ominously, Rowlett heard nothing from his boss for the rest of the day. As the afternoon slowly wore on, Rowlett mentally cleaned out his desk and began to consider his prospects for future employment.22 Years later Rowlett recalled the incident: “Well, next morning he [Friedman] came in, eyes shining, just all excited and he says, we’re going to do this.” He called it a “beautiful idea … and he went up to see the Chief Signal Officer with stars in his eyes to try to sell this new idea.” 23 A night of due reflection had forced Friedman to recognize that Rowlett’s * The die is cast. 10 concept marked a gigantic step in cryptography, and his prudent acquiescence to Rowlett changed the course of history. Surprisingly, once Friedman fully accepted that he had been wrong, his attitude toward his junior changed entirely, almost. Rowlett went on to recollect, . . . I had never before found him so friendly and so agreeable to work with. He still retained his “boss-employee” attitude, but I could see that as he reached a more comprehensive grasp of the principles I had discovered, he was accepting me as a professional cryptanalyst rather than as a student. Before the day was out, Friedman told Rowlett, “I want you to start immediately on drafting patent specifications, and I will work directly with you in developing these new principles into their most advantageous form.” The odious work of key tape generation was put on hold for the time being.24 Patents come. Patents go. Patents come again. By summer’s end in 1935 Friedman and Rowlett had refined the details for a wholly new cipher machine, the M-134-C, which synthesized the principles of Rowlett’s stepping maze and Friedman’s earlier M-134s. They also managed to complete a draft patent (shown opposite) for what was to Iacta Alea Est. become SIGABA. (Army cryptographic equipment of that period was given code names beginning with SIG [for signals] followed by randomly chosen letters.) Unfortunately for the cryptographers, the nadir of the Depression had been reached, and the Army’s budget for cryptographic research and development had been entirely depleted by Friedman’s M-134 device. Thus, any fielding of SIGABA was out of the question. Still, the Army did have a small sum which could be allocated for retrofitting Friedman’s existing M-134s. This they used to construct a number of “add-on” devices to be used with the existing M-134s.25 The so-called SIGGOO (M-229) component replaced Friedman’s “key tape transmitter” with a less robust version of Rowlett’s stepping maze. The SIGGOO assembly consisted of a three-rotor setup in which five of the keyboard inputs were live, as if someone had pressed five keys at the same time on an ENIGMA. These outputs were “gathered up” into five groups as though all the letters from “A” to “E” were wired together. In that way the five signals on the input side would be randomized through the rotors and come out the far side, ensuring power in one of five lines. The SIGGOO rotors, therefore, could be controlled with a day code, or key, eliminating the need William Friedman and Frank Rowlett’s draft patent of for paper tape keying material. Because August 1935 for what was to become SIGABA of cost constraints, though, not all of the model M-134s could be retrofitted with Goldberg device. It was, nonetheless, the strongest SIGGOOs, and large numbers of them continued to device in the shadowy world of cryptology and easirely on Friedman’s original paper tape transmitters.26 ly surpassed anything the British or the Axis Powers had at their command. Since one cannot know what The M-134 Converter modification with its five he doesn’t know, neither Friedman nor Rowlett at rotor cipher wheels, the three rotor wheel SIGGOO the time truly appreciated just how advanced their add-on, and a 26-wire plugboard was hardly elegant new cipher machine really was. in appearance and resembled a comic-strip Rube 11 Enter the Navy A s the torrid summer in 1935 lost its grip on pre-air conditioned Washington, DC, it was apparent to no one that the sister services were on a cryptographic collision course. While Friedman and Rowlett occupied themselves with fine tuning a patent request for SIGABA, the Navy’s OP-20-G organization was considering the acquisition of new cipher machines. The Navy cryptographers for several years had relied on Hebern machines to meet their communication security needs, but by the mid1930s they began to doubt the machines’ integrity and balked at a contract to procure more of them. Quietly, Lieutenant Joseph N. Wenger, acting chief of the Navy’s cryptologic organization, OP-20-G, and his colleagues began looking farther afield for something more secure.27 Early in October Wenger made the fateful decision to seek out Friedman’s advice and walked over the little-used pedestrian bridge that linked the Navy and Munitions buildings on the Mall in Washington. Clearly, the Navy was in dire straits if it admitted to needing any advice from the Army. As Frank Rowlett remembered it, “in one of the rare periods of consultation between [the] navy organization and the army organization I think it was Joe [Wenger]… [who] told Friedman that the navy would been [sic] real disappointed with the [existing] contract.”28 Lieutenant Wenger went on to tell Friedman that the new machine Hebern was trying to sell the Navy 12 “had been unsatisfactory [as well and] they now had a lot of development money but didn’t have any ideas to invest the money in and for goodness sakes did the Army have something … any good ideas at all.”29 Friedman, who was initially taken aback by this admission, sat up in his chair and brightly suggested that he might indeed have something to share. But first he would have to gain permission from his senior leadership. Later that month on the 21st, Lieutenant Wenger and a colleague, John W. McClaran, met with Friedman and Rowlett at the Munitions Building. There, the Army proudly shared its plans for SIGABA with the Navy. Lieutenant Wenger, who among his colleagues was hardly known for animated expression, remained true to form and demonstrated little indication that he was impressed. Ten days later, on Halloween, another OP-20-G complement composed of Wenger, McClaran, and John Harper ambled across the bridge for another meeting with Friedman. Again, Friedman explained Rowlett’s plan for the stepping maze and how it could control cipher rotor movements.30 The following day a still larger contingent of naval officers assembled in Friedman’s office for a briefing on the SIGABA concept. Throughout this last presentation, Friedman’s guests exhibited an uneasy institutional politeness and left with Wenger’s same general lack of enthusiasm. Enter the Navy Wenger told Friedman that “they now had a lot of development money but didn’t have any ideas to invest the money in and for goodness sakes did the Army have something … any good ideas at all.” Lieutenant Joseph N. Wenger, acting chief of the Navy’s cryptologic organization OP-20-G (pictured later in his career) Rowlett, after several anxious months, had received no feedback from OP-20-G and began to pester Friedman for word about the Navy’s plans for SIGABA. Friedman finally tired of these queries and confessed that Wenger had reported that “there were certain … operational difficulties and that they just weren’t sure the idea would work.” To this, Rowlett mused, “well, I thought the doggone thing would work and maybe they weren’t as smart as they thought they were.” 31 Rowlett had reason to be irri- tated. He knew it was a good idea, a very good idea, and became all the more convinced not only that it would work but that it offered secure communications beyond anything thought possible at the time. With SIGABA’s future on indefinite hold, Friedman and his colleagues returned to solving Japanese ciphers and producing paper key tapes for those M-134s not fitted with SIGGOOs (since the standard M-134s and those with SIGGOOs were not compatable, they were used on separate networks). 13 A Disagreeable but Rewarding Surprise F our years later, in 1939, with one war spreading across Europe, another was looming on the Pacific horizon. In anticipation of the latter conflict, Rowlett and Navy Lieutenant Commander Wesley (Ham) A. Wright were working on the Japanese PURPLE analog cipher machine (used to decrypt the Japanese diplomatic cipher designated as PURPLE) when a shocking revelation came to light. Rowlett recounted this incident in his memoirs: … we were speculating about what type of cryptographic mechanism the Japanese might have used to produce such an unconventional substitution system. “Maybe they’re using something like what we’re planning to use in our new Navy cipher machine”, Wright remarked. “Let me explain it to you, and you can give me your opinion of it”. He then started to sketch out for me the cryptographic circuitry of for [sic] the new Navy cipher machine.32 Rowlett with an increasingly sickening realization recognized the new Navy cipher machine as his own invention. He was particularly stunned since back in 1935 he had learned through Friedman that the Navy had rejected the idea as being impractical. Without revealing that he had conceived of the cryptographic principles involved, Rowlett asked Wright whose idea the cipher 14 machine was. Wright responded that he believed it was Wenger.33 Frank Rowlett was no little upset by this news. Not only had he been excluded from SIGABA’s development, but he saw the credit for his invention going to another man. At best Ham Wright had been misinformed, and at worst Wenger was hoping to pass off the rotor maze as his own idea. In either case, Rowlett decided to get to the bottom of the matter as quickly as possible. As soon as Wright left, Rowlett hurried down the hall to tell Major William Reeder what had just occurred.34 Reeder, who, as Friedman’s superior, was the head of the Signal Intelligence Service, needed to be informed of this turn of events. That Reeder already seemed to be aware of the Navy’s work on SIGABA came as the second disagreeable surprise of the day. Just how long Reeder had been keeping this to himself is unclear. While he had not gone to Rowlett with the news, Reeder was perfectly straightforward about it when asked. In spite of this omission, Rowlett still considered Reeder to be a good supervisor and a friend. Several months later, Major Reeder, in trying to make amends, went to Rowlett with something that he wanted to hear. The Navy would soon be taking delivery of a working model of their new cipher machine and Rowlett was invited to help test it.35 A Disagreeable but Rewarding Surprise On 3 February 1940 the Army’s primary SIS cryptologists—Friedman, Rowlett, Sinkov, and Kullback—trooped over to the Navy Building to see the prototype of the Electric Cipher Machine Mark II (SIGABA). Following an informal demonstration of the device, during which Friedman and Rowlett could hardly contain their excitement, they were finally given the opportunity to put it through its paces. It was a case of love at first sight. Rowlett later said, “… it was the most beautiful thing to look at from where I stood and I couldn’t keep my hands off it and of course the Navy was delighted to find somebody as enthusiastic about it as I appeared to be.” 36 The Navy had exceeded any expectations Rowlett had entertained, and he wanted to explore every facet of the Navy’s engineering triumph. He and Friedman were all the more heartened by the Navy’s willing acknowledgment of the Army’s visionary role behind SIGABA. (The Army designated the combination of machines as the M-134-C, which was also applied to the later, more mature SIGABAs. For the purpose of this paper, the M-134-C machine will be referred to by its more popularly used Army short title, SIGABA, whenever possible.) 37 Rowlett, besides being taken with the purely mechanical aspects of the machine, was also quite interested in SIGABA’s wiring scheme. He later said, “I was very curious about the circuitry that they’d decided on in terms of the association of the contacts on the in-plates of the control maze with the stepping magnets of both mazes.” 38 He was also fascinated by the additional set of rotor wheels that the Navy had included. When he and Friedman shared the stepping maze concept with the Navy, the design incorporated a plugboard similar to that on the German ENIGMA machine. At first the Army cryptographers did not perceive “… the advantage of the extra set of rotors that the Navy had introduced … We [Friedman and Rowlett] preferred the plugboard. The Navy for some reason didn’t like plugboards but this was not a point … to quibble about.” 39 With either the plugboard or the index rotors, SIGABA represented the pinnacle of cryptography, and both the Army and Navy were confident in its ability to resist all assaults.40 Those who attended the demonstration at the Navy Building had every reason to bask in the warmth of self-congratulation. It had been a long and unlikely path from Friedman’s and Rowlett’s collaboration to the Navy’s manifestation of their concept, and Rowlett couldn’t help but reflect with a little nostalgia on the old ways of doing business: “… before, you had to have a different set of codebooks and these became onerous, but with the new secure cipher machines, all the cipher clerk needed was a box of rotors and a little pamphlet that told him how to use the rotors, which made the concept … very practical.” 41 As elated as all of them were, none present could then conceive the extent to which their accomplishment would alter the future. 15 SIGABA Is Built F riedman and Rowlett’s idea behind SIGABA had been elegantly simple, but engineering it into practical reality proved to be a formidable undertaking for the Navy. From late 1936 until January 1941, Navy cryptographers and their prime contractor, the Teletype Corporation, developed a series of prototype machines, each building on the lessons gleaned from its predecessor. Early prototypes were prone to failure due to environmental conditions such as heat, humidity, and vibration, but as the SIGABA design matured, these problems and others were resolved. Successive models were smaller, lighter, faster, and more reliable. By the time the ECM Mark II (SIGABA) neared its birthing stage, the resulting device proved to be both electromechanically robust and cryptographically strong. Variant models could operate on 115-volt alternating electricity or 24-volt direct current/battery power to suit the respective needs of the sister services. Production-run SIGABAs achieved an impressive 60 words per minute capability. To allay any Army reservations about SIGABA’s reliability under austere conditions, Navy engineers offered emergency, manually cranked attachments. These saw almost no actual use in field operations. Another option was a forty-pound thermite bomb for SIGABAs destined to go into harm’s way. While the Navy steadfastly prohibited these emergency destruction devices aboard ships, 16 the Army mandated their inclusion for SIGABAs deployed outside of the continental United States.42 The quest to further enhance ECM/SIGABA would likely have continued for some time had not the Battle for France, then raging in Europe, convinced Navy officials that the time to field their new cipher machine had arrived.43 As the Navy prepared to let contracts for full-scale production of SIGABA, the cryptologists at OP-20-G and their counterparts in the War Department were fully confident that SIGABA/ECM II could deliver the degree of security they sought. This optimism was founded in the combination of six factors identified by Navy cryptographer Lieutenant Laurance Safford and paraphrased below: 1. SIGABA/ECM II included a sufficient number of cipher wheels in the maze to generate an astronomical number of “alphabets” and starting points. The five-wheel cipher maze of the ECM and Combined Cipher Machine (CCM) provided 11,881,376 alphabets for each arrangement of code wheels. (The ENIGMA, by contrast, offered only 17,576.) 44 [CCM was a specially modified, less sophisticated SIGABA that was interoperable with the British mainstay TYPEX machine.] 2. The SIGABA/ECM II included ten reversible cipher wheels in a set. This pro- SIGABA Is Built A sketch of the wheel control unit, the “control rotor bank,” separate from the cipher unit, called the “cipher rotor bank.” Note at bottom reads, “Wheel control unit and cipher wheel unit are identical in design and interchangeable. Wiring to be arranged as indicated.” It is similar to the diagrams Friedman showed the Navy during 1935. (Friedman Collection, NSA/CSS accession #47270, box 10, folder 5) 17 SIGABA / ECM II Cipher Machine SIGABA rotor maze. Note the five small ten-pin wheels that replaced the Army’s original plugboard. vided 9,667,680 possible wheel orders, making an adversary’s “trial and error” solutions impractical, if not impossible.45 (The CCM also offered ten reversible cipher wheels per set.) [There is a common misconception that SIGABA rotors could rotate either forward or backward. While the direction of travel for SIGABA rotors was forward only, all fifteen rotors could be flipped in either direction to maximize their cryptographic potential.] 3. The use of aperiodic stepping of cipher wheels, instead of regular or modifiedregular stepping motion, precluded all known analytical solutions and prevented “short-cut” solutions with captured cipher wheels.46 18 4. The stepping of the alphabet maze was controlled by an independent source—in this case by both the five index rotor set and the five control rotor set.47 5. The use of a multiplicity of stepping actions (5,855), dependent solely on the key, instead of only one in other cipher machines.48 6. The replication of code wheel sets—both “effective” and “reserve”—with prompt change of code wheels in case of known compromise, an