Historical Document · 1945
TICOM I-175: Report by Alfred Pokorn of OKH/Chi on the M.209 (1945)
A German Army cryptanalyst's own account, written for TICOM, of how the M-209 was solved from depths and cribs.
Historical Document · 1945
A German Army cryptanalyst's own account, written for TICOM, of how the M-209 was solved from depths and cribs.
, ..... C~f REPORT BY ALFRED POKO~. OF OKH/CHI. ON Me 209 Attached is a report on the M.209 written at our request in English by .ALFRED roKORN of oKH/chi. There·port was written a.t mNNA during Noveinber, 1945, and was reoeived from G.S. I. (S); B. 'i\A~ through M.. I.8. TICOM 14th Deoember ~ 1945 No. o£ Pages: 12 Distribution: U.S. Br~tish D.D.3 H. C':G. ( . D.D. (M. W.) D.D.(A.S.) C.C.R. Cdr. Tan~ Ma,j or j,:brgan TICOM S.A.C. (3) Cdr. Baoon Lt. Cdr. Manson Ma.jor cowan Capt. collins TioQn Files (4) Op-20-G (4) (via Lt. Cdr. Mmaon) G-2 (via Lt. Col. Hilles) A. S. A. (4) (via. capt. collins) Director, S. I. D. USPET col. Kunkel, ~~tF.E ,- -2- TlooM/I-175 The COnvertor M 209. A ciph6~g ~ ne.... iphoring machine of the type ''Haegelin'', manut'aotured in SWEDEN. Worked by hand 01" by eleotricity. Essential parts: 6 wheels, with 17, 19,21,2,3,25 and 26 pins, all of them corresponding to letters of the alphabet showing on the wheels. The pins can be set to be active or inactive. 1 drum with 27 bars, bearing 1 or 2 lugs eaoh. These can be set toteaotive or inactive. I f at least 1 lug is active, the bar can be made to protrude sideways from the drum. The lugs are set in rows corresponding to the wheels and SO as to be touched by the acti....e pins j when the drum is turned. 1 printing wheel, with 2 sets of the letters of the alphabet, arranged in alphabetic but opposite order, one for clear writing, the other for cipher writing: Clear: ABC D E F G H I J K L M N 0 P Q R STU V W X y Z C~h: ZYXWVUTSRQPONMLKJIHGFEDCBA When~~iphering, the clear letter wanted is -~~d first. Then the wheels are turned by, one p:l.n position eaoh, and the drum is turned once round. This mkes the aotive pine work on the lugs set before them - if there are any - and so pull sideways a number of bars. At the same time,t~e~e bar worl on teeth fixed to the printing wheel, tcming that wheel round by so many letters as there are bars protruding from the drum. This turn can oover from 0 to 25 letter-spacas on the printing wheel. 26 bars protrudir.l8 equal 0 bar, 27 bars equal 1 bar in effect. Then only the cipher letter is printed. When ~e~£heri~E, the cipher letter is printed first and the movements as above result in a turn of the printing wheel that will print the corresponding clear letter. The converter supplies a ~tibstituticn-cipher, with alphabets changillg fr'om :A-et1i~!' tv lei;te~, .':i.':'jorc:ing to thl'i turns of the printing wheel between olear and cipher. There are but 26 8ub.1titution alphabets, but the order of their following one another depends on the setting of the pins and lugs, and that can be varied praotically without limits. With a given setting of pins and lugs, the order of substitution alphabets will be repeated after 17 x 19 x 21 x 23 x 25 x 26 ::: about 10.5 million; letters printed. The Ciphering SYstem The U.S.A. used the converter for messages of minor importance between units of various signal nets. For every net, key lists were issued, giving the setting of pins and lugs - internal indicator - for one month, or for periods fixed as "D-~", "D-dllY -+ 1 "', "D-day + 2" etc. The setting changed from Clay to day. . WAll I'I.A The system was used in AFRICA, SICILY and ITALY, as in 1i'RANCE and on the western front. TOP SECRET -3- TICowiI-172 Messages were sent in 5-letter groups. The first and the last two groups of wery mag. - external indioa.:tor - were identioal. Of these, the first two letters, always identical, were the key for changing the wheels from the initial position to starting position. The next 6 letters were the initial position of the wheels. The last two letters indicated the signal net and the key list \\Sed for the internal setting. When cipherir;g, the pins and lugs had to be Bet a.ccording to key list and date - internal setting ., the wheels were turned to any chance position ~ external setting - and the letters then showing on the wr.eels were used for the 3rd to 8th letter of the external indicator of the message to be sent. Then any letter of the alphabet was printed several times, this clear letter being used as the first 2 letters of the external indicatOr. The first lettera of the cipher text produced by this printing, were then tUl'lled on on the wheels. .As only one of the wheels bears all the letters of the alphabet, usually more than 6 letters had to be printed to provide letters suitable for all the wheels. Arter that, the ciphering could begin. Words were spaced by printing clear HZ". When deciphering, the pins and lugs had to be Bet as above. The wheels were turned to the initial position given by the 3rd to 8th letter of the external indicator. The letter 1 st and 2nd of the indicator was printed several times. The wheels were turned to the letters resulting of this printing and the deciphering of the message could begin. cipher letters corresponding to clear liZ" left the word·to-word apaca:s in the ck ar text~ The Breaking of the Cipher The Cipher can be broken in four cases only: 1. When there are two different messages available, ciphered by one signal net, on the same day, and with an identical starting posit10n of all wheels - same external indicator - so that intern~l and external settings are identical. This roo)· be subsequent messages of one station, or a messaga and the answer thereon, the operator of the 2nd message or the answer turning back the converter to the starting position of the 1st message and negleoting to change the external setting, for the 2nd message or the answer. 2. When there are two identical messages available, ciphered by one signal net I on the same day, and with an identical starting position of 4 or 5 wheels only, but with the same external indicator, so that internal settings are identical and external settings differ. slightlY. This results by an error in the setting of the wheels to starting position, the typing of tho single letter producing e.g. RSQTRFJ' and the operator turning the . wheels to RSORFJ, in the 1st message. The 2nd message J.S ... correot repetition of the 1st, with identical mernal indicator. TOP SE:RET 3. When there are two identical messages available, oiphered by one signal net, on the samo day, and with an identical initial position of tho wheels, but with a starting position deplac~d by one or two letters 10r piI'.s) equally on 0.11 wheels. This results by printing another single letter, than the two first letters of the exterr1al indicator, for changing the initial wheel position to tbe starting, position, in the 1st message. The 2nd message is a correct repetition of the 1st, with identioal external indicat:>r. If the oorrect single letter a.:.ffers from that used for ciphering message I, by one letter of the alphabet (e.g. M and N), the starting position of both messages will also differ by one letter - or pin position on all wheels. same for two ( and IOON) let t era, s a long as no Ie t ters are printed, that could not be turned on on the respeotive wheel. 4. When an original key-list is captured. Identioal internal and'external settings. For the following the oipher texts of the two messages be supposed as: Z C L NH • • • • • N H I 0 0 ..,.. Message I: Message II; Both first letters were printed with the identical oonverter settings and with the same turn of the printing wheel frOm clear to cipher, Thus; assuming certain clear letters for the 1st oipher letter in Massage I, it can be told what the first clear letter in Message II must be. The apparatus for this is a working model of the printing wheel, two tapes with alphabets written in opposite direction: • • • • • MNOPQRSTUVWXYZ { r YX WV U T S R Q PO. • • • • • • If tnmes~age I clear A stands for cipher Z, the tapes arranged so that A and Z correspond, llhow ".thd;1; :~. and,}! ccrrospt'5ncl, and.that in,no::lSage II clear M stands for cipher N. AssUlIdng all the alphabet in turn, that would show as the 1st olear letters: M~ssage. I: Message IIa AB~DE'GHIJK~MNOPQRSTUVWXYZ MNOPQR~TUVWXYZABCDEFGHIJKL TOP SECRET -5- TICOM/I-175 If cipher C is dlear A, then cipher H is clear v. If L is A, then I is D. If N is A, then b is Z. If H is A, then 0 is T. That would show the first five clear latters to be: " "n AJ3CD~FGHI.rKLMNO. • • MNOPQRSTUVWXYZA • • • VWXYZABCDEFGHIJ. • • DEFGHIJKLMNOPQR ZABCDEFGHIJKLMN • • • TUVWXYZABCDEFG • • • t · ... •• If for any part of Message I the correct clear text can be guessed, the corresponding part of Me~sage II shows clear text also, though the text is different from that in Message I. AsEl\ning. in the example above, the first word in Message I to be 1I0NE" tba first word in Message II muht ba "Am" so "ONE" . at this plaoe is wrong. . , , It is neoessary to tty hmots probablea " Until the correot word is found. For that, the table as above is cut in vertical stripes, and words are set with the 1fl ttera ot Message I in ascending order, so that the corresponding text of Message II may be read horizontally. Example for a break: The 5th to 9th letter in Mossage I spell "-ONE-" in Message II: "SIX.-o", possibly "S:rx-oNE-". The break is extended to both sides, either by continuing work with the vertical stripes, or by using the model of the printing wheel only. A break of 60 to {OO clear letters is sufficient tor further work. Examples for "mots probables": Nwbers, signs (dash,paren,cma.,etc); short words (at, in,to,eto), endings- (-ing,ation,eto.). With all the above, one can read the criginal two messages only, as far as broken. Before deciphering or reproducing the ciphering of these messages on tht! converter, the internal setting of the latter has to be found. -6- TOP SECRET TIC01!V'I-175 Idmiltioal. internal and slightly di.:t'f'erent external settings. The cipher texts of the two messages are partly identical, partly different. Were they differ, there ia 'at l~st one pin positiolDl wrong. From the apace from correct letter' (Message II) to wrong letter (Message I) it is possible to deduce the action of the wheel that was in the wrong starting position. Details are l)nknown'to me. Messages with three or more wheels set in a wrong starting position cannot be brokerh Depla.ced starting pos~tion. , If the starting poSitions of the wheels for two messages ciphered otherwise underid~n.tioal conditiona, are displaced by one (letter or pin) 3qoo.lly on every wheel, the sequel of turns of the printing wheel is inpoth messages identical, but diepla.ced by one (letter-space). BY wr:l. ting th~ messages displaced by one letter, the cipher letters resulting from the same turns ot the printing wheel are above one another: E. g. Message I M,essage. II : WG Q B P. • • • • • • F SIP P J • • • • • • • SUl.::>poaing W(Message I) is .A, then S (Message II) is E, as the, model ot the printing wheel shows. S is 2nd letter of the text, so cipher G (Message I) must be clear E too. If G is E, then I is C. That is the }rd letter of the text, so Q (Message I) must be C too. If this is so, P is D, and B as 4th letter is the Same. It B is D, then the P underneath is P, etc. So if the initial W is clear A, the clear text of the messages should read: AECDP which is wrong. By asstmling all letters of the alphabet in turn, for the first cipher letter, however, the correct clear text must be found: AECDPV ••• B F D E Q W• • • CGEFRX ••• DHF GS Y • • • E I GHT Z • • • The messages begin both "EIGHT" and this can be extended easily, by the same method.. If two messages are displaced by two or more positions, they must be written down displaced accordingly, and then worked on as messages with identical internal and external indioa.tors. Finding The Relative Internal Setting. This consists in setting, on every Wheel, t,he pins in the oorrect sequel of active or inaotive positio:ns, but without beginning the sequel at the correct spot of the oiroumferenoe at the wheel. E.g. TOP SECRET -7- ,TICOM/I-175 Letters on the wheel: ABC D E F G H I J K • • • Absolute correot sequence:+ + .. + - __ + _ + + ••.• Relative correot sequence: (displaced by two): - + + + - + _ - - + _ ••• There is but one way of setting the lugs on the drum bars. This, and the setting of the pins, makes the internal setting of the convertero The clear text of a broken message and the oipher text of the ~e, are written one under the other, to show over how many letter-spaces the printing wheel turned before printing every cipher letter. As Z ~nd A are, on the printing wheel, side by side, clear Ii. would result in oipher Z by the space 0, in cipher A by the spaoe1, in oipher 13 by the space 2, etc. Clear 13 would reauJ.t in oypher Y by the space 0, in oypher Z by the spaoe 1, in cypher .... by the spaoe 2, etc. E. g. clear: Cipher: REZYOUR EVFDCPS Spaoes: 23 o 5 17 10 2 10 This gives a sequel of spaces in the length of the brolcan message. The sequel is. written in six tables, with 17,19, 21' ,23,25 and 26 numbers respectively, written in one line. Every table indicates the wheel corresponding to the breadth of the case. E.g. Wheel 171 23 25 20 8 20 11 15 7 12 25 0 5 2 25 5 25 3 17 21 9 6 5 2 17 10 10 21 0 6 2 8 3 22 0 25 9 8 9 20 4 4 The spaces showing in one column (one under the other) have been produced with the wheel being in a certain position, identical for all the spaces in that col'llln. From the spaces in a column being large or small, it can be said whether the pin in that position of the wheel must have been active or inaotive. Active' pins have contributed to make the spaoe large. small spaces in one column show that the whe~l must have been inaotive in that positiollo The sequel of pin pceitions for the wheel above would be: + - - - + - - + - + - + - ? + - By oomparing the different wheels, sequels of pin positions, though inoomplet~, can be made up for most of the wheels. UY oontinued comparing and correcting the sequels, they can be made complete. By comparing them with the turns made by the printing wheel to produce wery cipher letter, moreover, the working of the drum bars, and the positions of the lugs on them, can be deduce<i. - JOP SIDRET -8- TICOMLI-17.2 The result is the oomp].eta~ though reative, internal setting of the OOXlvorter. Before decj~hering of other messages with the converter is possible, though these messages be ciphered with the same internal settings, the absolute internal setting has to be fbund. The Absolute Internal setting As has been said before, the position of the actire and inactive pins on every wheel, relative to the letters on the Wheel, must be found. The seCluel of the pin positions of eTery wheel is mown, and so are the positions of the drum bar lugs. The sequel of spaoes covered by the turns of the printing wheel, from the beginning of the message text, is known. It is found by comparing the clear and the cipher text of the message and using the model of the printing wheel. E.g. Clear: Cipherc Spaoes: R E Z E M' A 22 17 0 Y P 0 0 U R Z M S G • T sse B W • 14 3 14 10 18 15 20 } • .. • • • • Every space is the result fr~ 1 tb 5 possible oombinations of aotive or inaoti:ve pin positions on the 6 wheels. When the sequel of spaces is :Long enough, certain hequals of pin positiorEI can be na de out. E. g;. (~) Wheel I: + + - + - t + -+ eto, « II: +.~ + + + + + etc~ - eto. + + " III: - - + + II etc. Dr: - + + + + + II Ii: - + + + + etc. + - - + + + + etc. " VIi + + The vertical columns of this table correspond to the 1st, 2nd, 3rd, etc. letter of the message toxt. The column. (0) as oorresponding to the firat, indioates the pin positions at the letters on every wheel, that move, ,phen the message text begins to be printed. These are the letters rei erred to as starting position of the wheels. The idea about the absolute internal setting, is to begin the arrangement or aeCluel of pin positions (column '9) at ~uoh. letters of the wheels, that when the wheels are turned to initl.al poaitiona - external indicator - and the single letter of the alphabet is printed, the 1st printing of this letter will give as cipher the letter, where 02111 wheel I the seCluel of pin positions b,egina; the 2nd printing of the single will give as cipher the letter, where on wheel II the sequel of pin positions begins, eto. E.g. External indioator: FFCOH BDEQR. The wheels are turned to the positions Wheel tl " ",I ,,, I: II: III: IV: V: VIa C 0 H B D E TOP WRET TICOM/I-175 and the letter F is printed repeatedly, with results as follows: 1st printing: 2nd printing: 3rd printing: 4th printing: 5th printing: 6th printing: Clear F~~ by 1st space of the printing wheel, gives cipher 9 (Wheel I) Clear F, by 2nd space, gives oipher 0 (wheel II) Clear F, by 3rd space, gives cipher ~" (woeel III) Clear F, by 4th space, gives oipher wheel IV) Clear F, by 5th spacie, gives cipher wheel V) Clear F, by 6th space, gives cipher w"leel VI). ~ The six spaces or turns of the printing wheel can be drawn as a table, e.g. Spaces: 1 2 3 Wheel + + " Wheel II: + + Wheel III: + Wheel IV: + + + Wheel V: + + Wheel VI: 6 ... -4 +5 .... - - .... + + - ... - ... + - - + + + If the table is right, the columns (vertical) must be possible cOOlbinations of pin positiona, but also the lines must be possible s3quela of pin positions on the respeotive wheels, and the letters resulting by the printing of clear F and the, space in question must be suoh as exist on the respective wheel. This must be tried and varied so long as to get a table responding to this conditiona. When the table is found, the cipher letters resulting by the printing of "F':&'FE'E'F , .. " and the spaces shown in the table, g:i.ve the starting position of the wheels, At these, the sequels of pin positions have to begin on page t1'). (9 If the absolute internal setting cannot be found t~lis way - as often it cannot - a third message with the same internal setting (of the same day and signal net) has to be broken firat, Breaking A Third Measage, The relative internal settings of this message are known by having broken two massages of the same day and signal net, and fixed their relative internal settings. This message, however, cannot be deciphered on the converter (as no message other than tho two broken messages can) before tho absolute inte::""l18.l settings are found out. The relative internal setting being give., it can be said, for every turn of the printing wheel, which of the 6 wheels took by means of pins an aotive, or an inaotive, part at it. So a list of turns, or spaoes, is made up. E.g. S ee, 0 Whe I" 1/41eel I I Wheel III Wheel IV • Wheel V Wheel VI - .3 1 2 -,+ +++- + - + + + + + .. + ... +'''' +- + .. I" ... - eta. ata. TOP SECRET -10- TIgQW'I-175 There are, for every letter printed, 2 C 64 possible arrangements of + or - pin positions on the 6 wheels. So several of the 25 possible spaces produced by the printing wheel, can be produced by more than one arrangement. = The ~Jquel of + and .. pin poaitiona on every wheel is also kno.m. A "mot probable" is now tried at the beginning of thtl message. The spaoes that must have been lIB.de, if the supposition is corredt, are derived from the given cipher, and the possible olear, text. A table with the possible spaces ana pin positions is drawn acoordingly. E.g. Cipher text: Olear text: J ~oes= .9 eel " " " " " I II Z .... E E M G Z 6 - - ... V + VI E H rv TIl Q I G H T 2 21 2,} 12 1 + + ... + + + + + + + + + + + + +, - ... -- -- - - - .. + - When more than one pin position arrangement is possible for a spaoe, so m9.I1,Y tables have to b~ drawn, as are possible. Then the horuontal lines are compared with the sequels of pin positioI'.3 for fSV'ery wheel. If they are possible, i. e~ if they are sections of these 6eque~~, the table is oorreot, and the supposed word rea.l~ stands in this part of the olear text. The a equels of pin positions are then completed sidewaYS (or t6 both sides) through the whole of the message. From the vertical oolumns the spaces are derived. The oypher letters and the spaoes belonging to them give the olear letters. The message can be read throughout. If the horizontal lines in the table are not part of the sequels of pin positions on the wheels, the table is wrong and the supposed word is not there. Then the "mot probable" has to be tried in the same way right through the message.- If one "mot probable" has been tried throughout without suooess, othElrs have to be tried, until the t<:..ble of + and - is oone.t. With a third broken message at hand, the method of finding ;li.& absolute internal setting of the day and signal net, is the same, as deseribed above. Work, however, is greatly reduced in length, by oombination of the conditions set to the table to be drawn, from the first two,. and the third, message. M,9.DY possible ~,~ea .oan be eliminated quiokly and. the overlooking of the correot table is not so easy, as when working on two messages only. With the absolute internal setting fO\41d, and used on the converter, all available messages of the day an d s igJlI11 net, can be deciphered. TOP SECRET TlCOM/I-175 Deoiphering With The Converter. Messages that had a good transmission and reception, i.e. -Where the cipher text at hand is correot. a~e deciph~red wilr.out di~ficUlty~ aa eJq)lained above (pageJl).. Frequ~t diffioulties q,re: 1) Ciphering ~istakes. 2) Transmission mistakes. Letters or groups of letters have been left out or inaertedj or both. To decipher such massages, letters or groups of lett~rs hava to be inserted or left out.. 3) 1<eoeptioh mistakes. The operator did not get the corr.aot Morse letters. Frequent mist3.kes are g. They have been dealt with above. e. B - D, E - I, G - M, H - I, S - H; U - V, Z - G. ce.pt~d. Key LiSts. During "tQ!ItPQ-rary U.S. retrao.-ts 1.n NORTH AFRICA and ITAIX, some times orighvil oonvEUrters and. koy-lie-to .,,~ro Call'tured.. Containing the original intern'll settings for one net and one mon'th 7 they served 'co deal.pher ali rresaages available ot thiS signal net and this period. One key-list used on n...:ray and a tew days atterwards, wascaptured atter the invasicn in FRANCE had begun. In wery case 1 the period covered by key-lists captured was over, when they came in Germa.n possession. So it was never possible to read current signalling with them, even it the keys were not altered, when the loss of the key-lists was asc~rtained, as was to be expeCted. Working Reaults. Messages were broken in a time ranging traln 2 hours to ManY of them were not bl'oken at all, nwing to the difti.culty ot guessing a wOl'd of the olear text, or to too many transmission, or reception, mistakes. 4 weeks. The finding of the relaM.v8 intarnaJ. settings -»colt about 1 dey. that of the absolute internal settings from 1 day to 1+ we.elcs. Ttle break1ng of a third message also often took 2 to 1+ weeks. With an absolute internal .setting found, from 2 to 50 messages of the same day and 8i~1 net weredeo1phered. From the t1S8eag~s oome in;, about 10 percent went deoiphered.. Wha t, 14e8sa&ee Were Ab~. The tOllowing gJ!'QUP8 ot messages ai:ld samples ot olear text oa.n be remembered.: Supplies: IAundr,y open at once nearol'08~a.d 832045. Seaure large envelope .f'rOm under Novak. jeep seat. Setid ten tonner tor ammo.. to ....... ~ TOP SECRET -12- Taotical: C.P. at 8}0716. Headache red advanoing N• E.. , no resistance. R&chicourt occupied at 1400 hours., 741f.018. TICOWI-~75 Air Support: ,BoIl'h line bridge 2734D6,thc~ railway to ••• You::- demand aocepted, Aspo. GRAZ bombed by instruments. Porsonals send pass tor sgt. White to go to PARIS to-morrow. TJt. Black is to report to this HQ to be promo'ied. Report 2 0" ltnoo." 290 em. Signalling: Traffio report, out 10 seoret, 20 oonfidential, 150 ordinary na ssagee, in 12 :aeoret, 16 OQz.U'iden'iial, 125 ordinar,r messages. '--. Names and numbers of tmits were given, but cannot be remembered, exoept such as HEADACHE, FOOTBALL, EGG-CUP eto. Names of officers cannot be remembered, exoept Major Longino, aspo, from the ]'RANCE front. '-,