Reference / Paper · 1961

The "Tunny" Machine and Its Solution

Tiltman's account of the 30 August 1941 depth and the reconstruction of the Lorenz SZ40/42, with a worked example on real April 1944 wheel patterns. NSA DOCID 3838610.

Author: John H. Tiltman
Year: 1961
Type: Reference / Paper
Credit: John H. Tiltman; copy from www.cryptocellar.org

← Back to the Reference Library

DOCID: 3838610 TOP SECRET ElI~IAR The "Tunny" Machine and Its Solution BY BRIGADIER JOHN H. TILTMAN This article is substantially the same as a lecture given to the CryptoMathematical Institute in October 1960. For that occasion an earlier lecture was completely rewritten so as to place extra emphasis on the lessons to be learnt now from the original diagnostic research which lead to the solution of the "Tunny" machine in 1941 and 1942. I tried to frame both the earlier and the later lectures in such a form that the steps of the solution could be followed by intelligent persons without cryptanalytic background, given concentrated attention. I am not of course suggesting that the solution can be completely absorbed and memorized without further study. The aspect of exploitation, i.e., wheel-breaking and message-setting, is not treated here. I hope to persuade someone to write a sequel to this article covering the work of the Tunny sections at Bletchley Park (the war-station of GCHQ) between 1942 and 1945, stressing particularly the original .statistical scoring methods devised by Dr. Turing and the early development of electronic machinery. The cipher machine under discussion is the SZ 40, i.e., "Schluesselzusatzgeraet 1940," developed by the Germans for transmitting over the air messages converted to teleprinter form according to the international ("Baudot") teleprinter code. A photograph of the machine is shown as Fig. 15. This is not the SZ 40 but a later model, SZ 42B. It was one of the two in Marshal Kesselring's communication train, discovered at Salzburg during the course of the TICOM operations immediately after the surrender of Germany and brought back to Bletchley Park by Mr. Arthur Levenson of NSA and Major Ralph Tester of GCHQ. We gave the name "Tunny" to the machine early in 1942. Long messages were commonly perforated in advance on five-impulse paper tape instead of manual keyboard operation. During the experimental period in 1941, messages were transmitted mostly by Hellschreiber picture transmission. A photograph of the first page of an early intercept of 14 August 1941 is shown as Fig. 1. For Hellschreiber transmission the six extra symbols 3, 4, 8, 9, + and I were added to the 26 alphabetic symbols of the international code to make up the 32 possible different symbols of five-impulse code. The international code as modified for Hellschreiber is given as Fig. 2. When the cipher mechanism was not in operation, the symbols 3, 4, and I were never used, as at the receiving station the message 1 TOP SECRET BU04AR Jeclassified and Approved for Release by NSA In 12-12-2007 pursuantto E.O. 12958, MDR -=ase # 52172 D O~ i5~rr !e'~ 8'~7tfmY" MACHINE was recorded on continuous sticky tape, / having no meaning anyway and 3 and 4 representing carriage-return and line-feed respectively. When the cipher mechanism was in operation, all 32 symbols were used about equally. For purposes of this presentation, a cross or the letter X represents a perforation in the tape or an operative position, and a dot an unperforated or inoperative position. The effect of the cipher mechanism is to apply a very long series of random impulses to the impulses of the plaintext letters in teleprinter form. After each position on the tape or each time a key is depressed, there is a movement of some of the wheels of the machine and to each successive plaintext letter a new set of five impulses is applied. The rules of application are as follows: The result of applying cross to cross or dot to dot is a dot, cross to dot or dot to cross is a cross. For example, the letter P in the code is .xx.x; the five impulses due to the cipher mechanism at the point reached are " .xx (i.e., the letter 0). The resultant five impulses from applying ... xx (i.e., the letter 0) to .xx.x (Le., the letter P) are .xxx. (i.e., the letter C). It will at once be realized that the three letters P, 0 and C form a "triple" within which P + 0 =C, P + C = 0, C + 0 = P, in other words mod. 2 addition. Figure 3 gives a chart of "triples." There are twelve wheels on each of which a prearranged pattern of crosses and dots can be set up. The wheels are not interchangeable and each has its own cycle of points, the twelve cycles being prime to one another. The cycles are as follows reading from the left-hand side of the machine: 43, 47, 51, 53, 59, 37, 61, 41, 31, 29, 26, 23. The first five wheels form a bank called by us Psi wheels; the sixth and seventh form the motor mechanism, called by us Mu wheels; the last five form a bank called by us Chi wheels. The patterns of cross and dot on the Psi and Chi wheels were 'EO changed monthly in 1941, daily in the later years of the war. The 1.4. (b) patterns of the two Mu wheels were always changed daily. For EO each transmission a "starting setting" for each of the twelve wheels 1. 4 .,( c) was prearranged. This setting was not indicated during the EO " transmission except in the period prior to March 1942. Figure 4 1. 4. "d) gives as an example the patterns of the twelve wheels in use for the "Bream" link (i.e., between Rome and Berlin) on 14 April 1944. (In 1944 SZ 42B was in use. This carried a security attachment not present in SZ 40). In Fig. 5 an example is shown of the effect of encipherment using the wheel patterns of Fig. 4. An arbitrary point (shown in square brackets) is assumed to have been reached in the movement of each wheel. "FOP SECRET BIl~AR 2 J. H. TILTMAN TOP SECRET Blt~AR I will now describe the steps of the original solution, which was accomplished without any continuity or collateral information, or any previous experience of five-unit cipher to guide us. We were fortunate in obtaining Hellschreiber intercepts (of which Fig. 1 gives an example) of early transmissions which passed between Vienna and Athens shortly after the invasion of Russia in the summer of 1941. The transmissions were frequently of very great length-I remember one of about 16,000 consecutive symbols of cipher. Each transmission began with a set of twelve personal names (Anton, Bertha, etc.), clearly a twelve-letter indicator. The symbol 9 was used as a separator in this preamble and a group of five 9's separated the clear preamble from the cipher text. At quite an early stage I had little difficulty in correlating the 26 letters of the alphabet and the six extra signs 3, 4, 8, 9, + and / with the 32 different sets of five-unit impulses. It was made easy for me by study of a series of messages of 22 July 1941 in which the crosses of the first impulse stream had not perforated, so that for example Heinrich was transmitted as H/INRICH and Theodor as TH/030R. Among thll early intercepts were a number of cases of two or more messages having the same twelve-letter indicator. Usually the two messages involved were consecutive but there were several cases in which the indicators were recognizable words, names or phrases, such as Gratzeppelin and Kaeferboecks, proving that the operator had the responsibility for selection of his message indicators. Kaeferboecks, I imagine, was some kind of a bug which was giving the sending operator trouble or a rude nickname for one of his colleagues-it appeared four times. J On 30 August 1941, two very long messages were intercepted from Vie l1Ilato Athens with the same indicator HQIBPEXEZMUG. One had 3976 syrnbolsof consecutive ci her text and the other was about 500 symbols longer: .h-.,...,.-;-....."..--..----;--""i'""'::-;:-::-::--:-:-=::::-7F7k:r---"1 research section at Bletchley Park pushed the recovery of the which we built up during the process. L..,I,..n....,.,th...,i,...s-c-a-se-,...,I.---w-as---:d;:o:'!i:-n:-g~t'Lh:-e~work myself and I suddenl reached the point at which it became obvious that the In the course of the next ten days or so I succeeded in carrying recovery to the end of the shorter of the two messages, thereby recovering 3976 consecutive symbols of key. In this key there were, of course, a number of positions where the key was am3 TOP SECRET BIt~AR EO 1. 4. b EO 1. 4. c EO 1. 4. d J. H. TILTMAN TOP SECREf f)1I<lAR 5 TOP SECRET BI~IAR biguous, though not generally for more than three consecutive, symbols. You will, I am sure, understand that when working fin mod. 2 there is usually no way of telling which plain text belo:s to which cipher transmission and thusl _Iare, produced. In this case, however, tIie amblgwtychsappeared w en r reached tlJe end of the shorter message. The plain text proved to be a report for tlJe personal information of tlJe German militar attache! in Athens on the situation on the In both plaintext versions, there were many places where the sending oper-, ator had struck a wrong key or made some other mistake neces-! sitating long stretches of corrections and repetitions. I I took no part in the reconstruction of the machine from the long stretch of key which I had recovered. It was studied in its five individual impulse streams by the members of my Research Section and most of the work of reconstruction was done by Dr. Morgan and Mr. Tutte. However, no obvious periodicity was at first observed and no projp"ess was made for about four months. I TOP SEC~Ef f)U~AR 4 jj~~ ~1t~~a''6'W(),'' MACHINE EO 1.4. 101 EO 1.4. cl EO 1. 4. dl J. H. TILTMAN lOP 5EeRET Bn~AR 7 TOP 5EeREf OIl<lAR I TOP SEeRET BI~V.R 6 J. H. TILTMAN TOP SECR~T ~1~llto,R (Illustrations begin on (ollowing page.) 1. 4. Ib ED 1.4. Ie EO 1.4. Ie! TOP SECRET el~IAR 8 9 lOP SEEREl ell~l'<R D ~!~! Dltg@ 3@61JnOY" MACHINE J. H. TILTMAN WIT RED FORM. 5.\319. li.t.N'y.llm. Ship or Stati"n, Set IvA l.~__._.' .._.-. ETni~dte"d' Opr., Tot' rom (/ ~ Operator's R 1_---'--'fL-_-1-_ __'m_aI_ks_,_' j . Q. S, A._ .... I-F-",G;",,;~T"-~e...Jnc-y"'&...lol.:sy"st"'em'-,-I ~ l'rJo LOWER CASE UPPER CASE A - X X B ? X C : ,--.. D 'c1J.~ E X X X X X X 3 F G X X X X X X H I B J X X X X X X K ( L M N ) 0 9 P ~ X Q 1 X X X R S T 4 X 5 U 7 X W 2 X X I X X Y 6 X X Z REPEAT X X X X X X X X X X X X X X X X X X X X X V LINE FEED CAR, RETURN \",\ X X X X X X X X X X X X X X X X X LOWER CASE X X SPACE X X X X UPPER CASE NO MEANING X X X X Fig. 2.-International TIP Code Fig. 1. l"GP SECRET BINAR 10 11 IOf SECRET I)Il-iAR HELLS ABC D E F G H I J K L M N 0 P Q R STU V W X Y Z 3 4 8 9 + / A B C D E F G H I J K L M N o p Q R S T / G F R 4 C B Q S 3 N Z 8 K + Y H D I W 9 X T V P L J EMU o A G I Q T 0 H A F 8 L P J S Y E K C WM D V U R 9 N 3 Z + I X 4 B F Q I U K A H G 3 S E M L 4 P o B 9 J V D T X W+ 8 I N Z R Y C R T U / 3 9 IV X K 4 I + Y S Z 8 V A N B C Q G H M o E J P F L D 4 0 K 3 I N + Y U R C WX F B Q P J 9 Z I 8 L M H T D A V S G E C H A 9 N I Q B J I 4 8 Z E Y + G U 3 X R WV T 0 M S K L D P F BAH W + Q I C M Z Y 3 I P 4 N F T 8 R X 9 D U K J LOS V E G Q F G X Y B C / L 8 + I 3 0 N 4 A V Z 9 WR U D E S M P J T K H S 8 3 K U J M L / F D H G R V T Z NAP E 0 Y + W Q C 9 B 4 X I 3 L S 4 R I Z 8 F I 9 B Q U W X M E C + N Y 0 P V GAD H K T J N PEl C 4 Y + D 9 / X W A Q B 0 S R 8 3 Z M L G V U F T J H K Z J M + W8 3 I H B X / C V R 9 S 0 Q 4 Y N E K U A G T F P D L 8 SLY X Z I 3 G Q wei T 9 R J P B N + 4 KED F H V A 0 U M K Y 4 S F E P 0 R U A V T I H G + I D MJ L 8 Z B X 9 C W3 Q N + E P Z 8 Y 4 N V W Q R 9 H / C K L X 3 8 I J S F o T GUM A 0 Y K 0 8 Q + N 4 T X B 9 R G C / E M IV I Z 3 S J A U V H D L F P H C B V P G F A Z M o S J + K E I X L U T D 9 R 4 t 8 Y 3 WN Q D W 9 A J U T V N E SOP I L M X / K G F H B Q 8 + 4 3 Y C Z R I M J N 9 3 8 Z A C R Q BOX W L K I Y 4 + POT H F U G E V S W D V B Z X R 9 P + 8 4 N M 3 lUG Y I Q C A F S E 0 L K H J T Y 9 V Del R X WEN 3 Y + J 8 Z T F 4 Q / B H G L P K S 0 A M U X U T Q 8 W9 ROY Z N 4 L I 3 D H + C B I F A J K P MEG S V T R X G L V D U Y 0 M E K 8 J S 9 B P A H F / C I 4 + Z N Q 3 IV V 9 WH M T U D + P L K E Z S J R Q 0 F G A C / 3 N Y 8 4 B I X P N + M H o K E W V G U D B F A 4 8 T S L J 13/ 9 X Q R Z C Y Z 3 4 8 9 L 3 8 0 T MJ S Q G V A F X D U I + H E P K 4 N 9 I B WC Y R Z J Z lED S L MeA UGH 9 T V 8 4 F 0 K P + Y X B IRQ N IV 3 E + N J A K 0 P 9 D F T V C G H Y 3 U L S M Z 8 Q WR / X I B 4 M I Z P V L S J B H T F A WU o 3 Y G K o E N 4 R C Q X I + 9 8 U X R F S o V T 4 K J P 0 3 M L weE H A G Q B Z Y N 1+/ 8 9 + o 4 Y L G P E K X T H 0 U Q A F N Z V J MS 3 I C R WB 9 8 / + ABC D E F G H I J K L M N 0 P Q R S T U V W X Y Z 3 489 + I U V IV X I Fig. 3.-ehart of "Triples" TOP SECRET DI~~AR 12 DOCID 3838610 50 MU MU 37 x . x 7 8 cm 9 CHI CHI CHI CHI 1 2 6 ~ 40 x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x 3 x x x x x x x x x x x x 4 x . x x x x x x x x x x x x x x x x x x x x x x 5 x x x x x x x x x x x x x x x x x x x x 3 4 5 ~ 30 20 10 PSI PSI PSI PSI PSI 1 2 10 11 12 1 2 61 x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x 60 x x x x x x x x x x x x x X x ~ 3 4 5 x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x :I: >oj H t'" >oj s::: :> z Fig. 4.-Wheel-Patterns for "Bream" Link (Berlin and Rome) 14th April 1944 ~ ~BEf oll!NL3'S:6Th0rY" MACHINE J. H. TILTMAN TOP SECRET Blt~~R Example of effect of cipher mechanism. 20 letters of plain text (not the beginning) of n mel!l&lge of 4/14/44. 9 8 9 U N D 9 8 9 E I N G ESE T Z T E (A) Wheel·patterns of 4/14/44 are given in Figure 4. An arbitrary point. (shown in square brackets below) is supposed to have been reached on each ofthe 12 wheels. 1. Mowr mechanism. Mu 61 moves one lltep for every letter enciphered Mu a7 moves one step after x in Mu 61 Mu 37 remains still after in Mu 61 Mu 61 [261 x X . . x x x x X x 1 2 3 3 3 4 5 6 7 7 8 91010111212131415 Mu :-:17 [ 7J x X X . X X X . X (B) . 1 2 3 4 5 6 7 8 9 1011121314 15 x x X x x , x x x x x X . x . BM".Basic (C) 1 2 3 3 3 4 5 6 7 7 8 9 10 10 1112 12 13 14 15 Motor (B) BM II. Psi patterns Psi 1 [ 5J x x Psi 2 [31\ x x x Psi 3 [12\ Psi 4 150] x. x x x x. x x. X x . x x x X X x, x Psi 5 [371 X x. x X X X . • X Psi I\'IJ/X/DHPJVTF4X All five PBi wheels move one step after x in BM All five P8i wheels remain still after. in EM The Psi patterna owing to retardation by dots of BM become extended BM x x x x x x X x x. x x X X . X Extended Psi W I J / X ! ! D HPJ J J V T T F 4 4 X (C) (D) III. Chi patterns Chi 1 [15J x x . x x x.)C x Chi 2 [ 21 x . . x X x X X Chi 3 [6J x x x x x x x x x Chi 4 [18] x . . x x x x . x x . x . x x Chi 5 [10] . x x x x x X x . x Chi 49MA4KBGGEHM8E4XIJFH 1. 4. bi EO 1.4. EO 1. 4. di Fig. 6. (E) All :five Chi wheeI.e Btep regularly-their movement is not interrupted by BM IV. The total Key (K) is obtained by applying Chi to enended Psi Extended Psi I\' I J / X / / D HPJ J J V T T F 4 4 X (D) Chi K 4 9 M A 4 K B G G E H M 8 E 4 X I J F H Z 4 Q A 8 K 8 WC Q 8 Q H 8 L F J D K D (E) (F) V. K is now applied La P to give Z, final cipher version K P Z Z4QA8KBWCQ8QH8LFJDKD 989UND989EINGESETZTE YXW9WIXNRP8+CVQN+083 (F) ... (A) VI. Special ruleB for the beginning of a transmission. All 12 wheelil move one step between first and second letters. Between the second and third leiters the bank of Psi wheels moves if the sign of Mu 37 is x and remains still if the sign of Mu 37 is. , i. e., the sign of Mu. 61 has no influence at this point. TOP SECRET BII~AR Fig. 5. Fig. 7. 14 15 TOP SEeREf BIt~AR DOCID: 3838610 Tor SECRET Da~AR THE "TUNNY" MACHINE EO 1.4. (b) EO 1.4. (c) EO 1.4. (d) Fig. 9. Fig. 8. TOP SECRET OIt~AR 16 DOCID: 3838610 :-~ ~ ]I: ... I".l ~ ~ .... .... t"' ~ ? s= > z /// EO 1.4. (b) EO 1.4. (c) EO 1.4. (d) _- ..- .-- J. H. TILTMAN TOI' 5EeRET f}1t~~R 1. 4. b) EO 1.4. c) EO 1.4. d) Fig. 11. TOP SECRET f}lt~~R 18 Fig. 12. 19 TOP SECRET QI~I;A(R ~OCID: 3838610 >-3 ::z:: t:r:l ~ 0 ~ c:: ~ z Z 1-1 ~ ~ s:: > ....::z:: (') zt:r:l EO 1.4. (b) EO 1.4. (c) EO 1.4. (d) --- ----- DOCID: 3838610 J. H. TILTMAN TOP SECRET DI~~AR EO 1.4. (b) EO 1.4. (c) EO 1.4. (d) 21 - - - - - - TOP SECRET DIt~AR DEcrD 3838670 "'i . ~ .... ~ I 003 t-.:l t-.:l e:r /l) >-:i .-3 trl :J:: e :l r:: '<.. e ~ ><: ~ /'l e:::: 1> :tl c.... cP'l ~ ~ N ~ t-3 Z Z ~ > 0 :J:: ..... 'Z trl