Lorenz and Colossus — Volume 3 — The Lorenz SZ40/42 — Twelve Wheels, Chi, Psi and Mu

3.1 About This Volume

Volume 2 explained the principle behind Tunny: a teleprinter turns each character into five on-off impulses, and a cipher attachment adds a second stream of impulses — the key — to them, one character at a time, so that the same addition, done again with the same key, takes the cipher away. This volume opens the box that made the key.

The Lorenz SZ40/42 generated its key with twelve pin wheels. Five of them, the chi wheels, moved on one place for every character. Five more, the psi wheels, moved together, but only when two motor wheels allowed it. The SZ42 models added a further rule, which Bletchley called a limitation, that let the history of the message interfere with the motor. Everything that Bletchley Park did against Tunny — Tiltman’s depth in Volume 4, Tutte’s reconstruction in Volume 5, the Testery’s hand methods in Volume 6, and the statistics that Colossus ran in Volumes 7–9 — was aimed at one or another part of this mechanism. So it is worth knowing it exactly.

The volume describes the machine as the Germans built it and as Bletchley understood it, and then works twenty letters through it by hand, using real wheel patterns from the Berlin–Rome link of 14 April 1944. The worked example is not computed by hand here: it comes from the simulator written for this series, 03-outputs/tools/lorenz_sim.py, which reproduces that same twenty-letter example from a 1961 NSA paper exactly and deciphers three real SZ42 messages from 2007 (see “Checking the Description” below). The same simulator drives the replica designed in Volumes 12 and 13.

3.2 An Attachment, Not a Teleprinter

The German name says what the machine was: Schlüsselzusatz, “cipher attachment”, shortened to SZ (Wikipedia, “Lorenz cipher”, citing Copeland 2006). It was made by C. Lorenz AG of Berlin and did no typing or printing of its own. It sat in the line between an ordinary teleprinter and the radio transmitter or landline, and enciphered whatever passed through it. The English translation of its own provisional description, captured after the war, puts it in one sentence:

This device is for enciphering and deciphering telegraphic messages sent and received by teleprinters using the five element alphabet. Each station requires: 1 teleprinter (mechanical type), 1 cipher attachment 42.

— Cipher Attachment 42 for the Teleprinter [SZ42], Volume I, Provisional Descriptions (English translation of Schlüsselzusatz 42, Heft I, TICOM document T663; copy at CryptoCellar)

The operator at the sending end typed plain text, or ran a pre-punched tape, into the teleprinter; the SZ added key to each character and sent the result out. At the receiving end a second SZ, set up identically, added the same key and passed plain text to its own teleprinter. The manual gives the line speed as 50 baud, “7.14 symbols per second”, and explains that the key — the Mischtext, the “mixing text” — was produced “at the same speed and with the same timing sequence” as the incoming characters. The unit drew 220 V AC at 50 Hz (any mains supply from 90 to 240 V could be adapted through a separate regulator), made about 70 V DC for its own relays, and fed the telegraph circuit to the teleprinter at about 100 V DC with a maximum of 125 mA (Provisional Descriptions, sections I and III). It stood on a metal base 19 × 15.5 inches (48 × 39 cm) and was 17 inches (43 cm) high (Wikipedia).

3.2.1 The models

The German cryptographers Erich Hüttenhain and Walter Fricke, interrogated after the war, described the line of development to their captors. The first machine, the “SZ40 (old type)”, had ten wheels with fixed cams and was judged insecure. The definitive SZ40 had twelve wheels with movable cams (Wikipedia, citing Hüttenhain and Fricke 1945). An experimental link using SZ40s opened in June 1941 — the traffic that Volume 4’s depth came from. The SZ42A came into routine use in February 1943 and the SZ42B in June 1944 (Copeland, Colossus, 2006, pp. 38–39, as cited by Wikipedia). Both SZ42 models added the limitations described below. A further model, the SZ42C, is described in some later sources and appears in at least one modern simulator, but no evidence was found that it carried traffic; it is left out here.

Production was small. The National Museum of Computing estimates that about 200 Lorenz cipher machines existed during the war (TNMOC, 7 April 2016). Survivors are displayed at Bletchley Park, at TNMOC (the Lillehammer machine in the hero photograph), at the National Cryptologic Museum in Maryland, at the Heinz Nixdorf MuseumsForum in Paderborn and at the Deutsches Museum in Munich (Wikipedia). Bletchley’s codebreakers never saw one until the war was over. Everything they knew about it, they deduced from its output — the subject of Volumes 4 and 5.

3.3 Adding Key to Text

The arithmetic is the teleprinter arithmetic of Volume 2. Each character is five impulses. Bletchley wrote an impulse that carries current (a “mark”, a hole in the tape) as a cross, x, and one that does not (a “space”, no hole) as a dot, •. The machine combines two characters impulse by impulse with the rule that like signs give a dot and unlike signs give a cross: modulo-2 addition, or in modern terms exclusive-or. Written as letters, the plain text P, key K and cipher Z satisfy

Z = P + K and therefore P = Z + K,

because adding the same key twice cancels it. One operation enciphers and deciphers, which is why the two ends of a link could use identical machines.

Bletchley wrote every one of the 32 possible characters as a single symbol: the 26 letters for the letter codes, and six figures for the rest. J. H. Tiltman, whose break is the subject of Volume 4, listed the six extra signs as 3, 4, 8, 9, + and /, and noted that “3 and 4 [represent] carriage-return and line-feed respectively” (J. H. Tiltman, “The ‘Tunny’ Machine and Its Solution”, written 1961, NSA DOCID 3838670, declassified 2007; copy at CryptoCellar).

Table 1 — Adding Key to Text

Sign	Impulses 1–5	Meaning on the teleprinter
/	• • • • •	nothing (null)
9	• • x • •	space
3	• • • x •	carriage return
4	• x • • •	line feed
+ (also written 5)	x x • x x	shift to figures
8 (also written −)	x x x x x	shift to letters

One property of the addition matters later. Where the key happens to be /, all dots, the plain text passes through unchanged. In the twenty-letter example later in this volume that happens twice running under the SZ42A rule, and the cipher text there spells SE, the plain text’s own letters.

3.4 Twelve Wheels

The key came from twelve pin wheels — the German manual calls them Nockenräder, cam wheels — mounted side by side in a removable cipher unit at the front of the machine. Each had a different number of cam positions round its rim. Tiltman gives them from the left: 43, 47, 51, 53, 59, 37, 61, 41, 31, 29, 26, 23 — “The first five wheels form a bank called by us Psi wheels; the sixth and seventh form the motor mechanism, called by us Mu wheels; the last five form a bank called by us Chi wheels” (Tiltman 1961). The Germans called the chi wheels Spaltencäsar and the psi wheels Springcäsar — the “jumping Caesar” — and the motor pair Vorgelege; the Greek names were Bill Tutte’s (Wikipedia, citing Hüttenhain and Fricke). The German drawings of 1943 shorten the psi wheels to Spri-Räder.

The twelve cam counts add up to 501, and no two of them share a factor. That is deliberate: the combined pattern of wheels whose lengths share no factor repeats only after the product of their lengths, so the twelve together could be started in

43 × 47 × 51 × 53 × 59 × 37 × 61 × 41 × 31 × 29 × 26 × 23 = 16,033,955,073,056,318,658

different ways — about 1.6 × 10¹⁹ (Wikipedia, “Cryptanalysis of the Lorenz cipher”; product checked by the simulator).

One detail of numbering needs a warning. The German manual numbers the wheels 1 to 12 and gives them as “wheels 8 (41), 9 (31), 10 (29), 11 (26), and 12 (23)” for the chi wheels and “wheels 1 (59), 2 (53), 3 (51), 4 (47), and 5 (43)” for the psi wheels (Provisional Descriptions, II.D) — the psi wheels in the opposite order to Bletchley’s. This series follows Bletchley throughout: ψ1 is the 43-cam wheel, χ1 the 41, and the subscript is the impulse each wheel works on.

3.4.1 Cams and how they are set

Each cam position held a small lug that could be pushed to one side or the other. The manual describes them as “mounted movably” and set “by hand or with the lug stylus in one of two limit positions in which they are held by a stop”, with “a number band” beside the lugs showing the position numbers (Provisional Descriptions, II.D). A raised (active) lug produced a cross; a lowered (inactive) one produced a dot. A spring-loaded contact lever read the lug at the reading position of each wheel and opened or closed a contact.

Setting a machine therefore had two parts, done at different intervals. The pattern — which of a wheel’s lugs were raised — was set with the stylus, lug by lug, from a key list. The start position — the number on each wheel’s band showing at the reading position at the beginning of a message — was set by turning each wheel with its finger wheel until the right number appeared in its window. In practice about half the lugs on each wheel were raised, because long runs of like signs were known to be a weakness (General Report on Tunny, §11C, as summarised by Wikipedia).

3.5 The Chi Wheels

The five chi wheels — 41, 31, 29, 26 and 23 cams — are the simple half of the machine. Each works on one impulse of the character: χ1 on impulse 1, χ2 on impulse 2, and so on. After every character, all five move on one place. The manual says so plainly: they “are always moved forward one step with the transmission of each letter” (Provisional Descriptions, II.D).

So the chi contribution to the key is completely regular. The first impulse of the chi stream repeats exactly every 41 characters, the second every 31, and so on; the whole five-impulse chi stream repeats after 41 × 31 × 29 × 26 × 23 = 22,041,682 characters. That regularity is what Tutte found first in 1942 (Volume 5), and what Colossus exploited: with the chi patterns known, there are only 41 possible starts for χ1 and 31 for χ2, and so only 1,271 ways to line χ1 and χ2 up against a message.

3.6 The Psi Wheels and the Extended Psi

The five psi wheels — 43, 47, 51, 53 and 59 cams — also work one impulse each, and the key for each character is the chi character plus the psi character:

K = χ + ψ′.

The prime on ψ′ is the important part. The psi wheels do not move with every character. All five move on together, or all five stand still, according to the motor. When they stand still, the same psi character is added to character after character. Bletchley called the sequence of psi characters actually added — repeats and all — the extended psi, ψ′ (General Report on Tunny, §11B(e), as cited by Wikipedia). Tiltman’s worked example puts it in one line: “The Psi patterns owing to retardation by dots of BM become extended” (Tiltman 1961, Fig. 5).

The designers presumably meant the irregular movement to make the psi stream harder to predict than the chi. It did the opposite. Because the psis stood still together, the difference between one psi character and the next was very often all dots, and that tilted every statistic towards a dot. Tutte’s 1+2 method (Volumes 5 and 9) rests on exactly this: it treats the stuttering psi as a weak but useful signal rather than as noise.

3.7 The Motor: μ61 and μ37

The two wheels in the middle of the bank, the motor or mu wheels, decide whether the psis move. They work in series:

• μ61 (61 cams) moves on one place after every character, like the chi wheels.
• μ37 (37 cams) moves on one place only after a character at which μ61 showed a cross. Tiltman: “Mu 37 moves one step after x in Mu 61; Mu 37 remains still after . in Mu 61.”
• The cam showing on μ37 is the basic motor, BM. On the SZ40, the psi wheels move on after a character at which BM is a cross, and stand still after a dot: “All five Psi wheels move one step after x in BM. All five Psi wheels remain still after . in BM” (Tiltman 1961, Fig. 5).

The German manual describes the same mechanism in terms of levers. The 61 wheel’s contact lever moves a push bar that releases or blocks the 37 wheel, “i.e. the 37 wheel is held back or released”; the 37 wheel in turn sets the blocking-lever shaft, which holds back or frees the psi wheels (Provisional Descriptions, II.D, describing drawing N 46153).

The result is that the psi wheels move on some characters and not on others, in a pattern that itself depends on two wheels of different lengths. In the twenty-letter example below, the psis stand still after 6 of the 20 letters under the SZ40 rule; over a long message on the same wheels with the SZ42A limitation added, they stood still on about 22 per cent of letters (simulator, 4,000 letters).

3.7.1 A rule for the beginning

Tiltman adds a detail for the start of a message: “All 12 wheels move one step between first and second letters. Between the second and third letters the bank of Psi wheels moves if the sign of Mu 37 is x and remains still if the sign of Mu 37 is ., i. e., the sign of Mu 61 has no influence at this point” (Tiltman 1961, Fig. 5, VI). The German manual describes a magnet that, when the operating switch is turned off, gives the wheel set “two revolutions … with simultaneous activation of the unblocking levers” (Provisional Descriptions, II.D), which may be the mechanism behind it. The simulator includes Tiltman’s start rule as an option but has no published message beginning to test it against, so it is not used in the examples here.

3.8 Limitations: The SZ42’s Answer

From February 1943 the SZ42A changed the motor rule, and in June 1944 the SZ42B changed it again. Bletchley called the changes limitations, and the General Report on Tunny lists four kinds, all involving “some aspect of the previous positions of the machine’s wheels”, two of them depending on the plain text and so acting as an autoclave (General Report, §11B(g), as cited by Wikipedia). The Germans called them Störfunktionen, “disturber functions”.

In the simplest form the limitation is a single sign, L, taken from earlier in the message, and the psis move according to the total motor, TM, rather than the basic motor:

• SZ42A, “χ2 one back”. L is the sign that χ2 showed at the previous character.
• SZ42B, “χ2 + ψ1 one back”. L is that sign added to the sign ψ1 showed at the previous character.
• “P5 two back”. On top of either, L can also have added to it the fifth impulse of the plain text two characters earlier — the plain-text-dependent, autoclave form.

The German manual’s description of the SZ42B form is worth quoting at length, because it shows which way the limitation acts. The “local disturber function” compares the lugs of “wheel 1 (the Psi wheel for the first impulse)” and “wheel 9 (Chi wheel for the second impulse)” in a mixing relay, which works a switching magnet, KM; through it “the compulsory control of the Spri [psi] wheels as determined by the lug setting of the motor wheels is interfered with in that a blocking command, which happens to be present at any given moment, can be cancelled”. The “plain text function” adds “the fifth impulse (whether + or −)” of the plain text into the circuit controlling the magnet, and can be switched in or out with a switch marked KT under a cover on the side of the machine (Provisional Descriptions, II.D).

So the limitation never stops the psis; it can only release them when the motor would have held them. In the simulator’s terms, TM is a cross whenever BM is a cross, and is also forced to a cross when L is a dot:

TM = BM, or a cross when L is a dot.

That form is not a guess. It is the rule in Joachim Schüth’s software for the 2007 Cipher Event (schlaupelz.de), and with it the simulator reads three real SZ42A messages; with the plain SZ40 rule, the same keys produce gibberish. The SZ42B and P5 forms follow the same pattern from the descriptions above but have not been checked against a published message.

The limitation made the psi movement depend on the message’s own history, which made the motor much harder to reconstruct, and the autoclave form made it depend on the plain text. But it also made the psis move more often, which weakened the very statistic — psis standing still — that Bletchley’s methods used. The Newmanry adapted its runs to each limitation as it appeared (Volumes 9 and 10).

3.9 Twenty Letters, Worked

Tiltman’s 1961 paper ends with a worked example that is the best short description of the machine anywhere. It takes the real wheel patterns of the Bream link between Berlin and Rome for 14 April 1944, starts the twelve wheels at “an arbitrary point”, and enciphers twenty letters of a real message of that day, 989UND989EINGESETZTE — “space, letters, space, UND, space, letters, space, EINGESETZTE” — by the basic SZ40 rule, ignoring the SZ42B limitation that the link was then using. The simulator reproduces every row of it exactly. The start positions were μ61 at 26, μ37 at 7; ψ1–ψ5 at 5, 31, 12, 50, 37; χ1–χ5 at 15, 2, 6, 18, 10.

Under the SZ40 rule the machine produces, letter by letter:

Table 2 — Under the SZ40 rule the machine produces, letter by letter

Row	Letters 1–20
Plain P	989UND989EINGESETZTE
μ61	xx••xxxx•xxx•xx•xxxx
BM (μ37)	xxxxx•xxxx••xx•xx•x•
Chi	49MA4KBGGEHM8E4XIJFH
Extended psi	WIJ/X//DHPJJJVTTF44X
Key K = χ + ψ′	Z4QA8KBWCQ8QH8LFJDKD
Cipher Z = P + K	YXW9WIXNRPB+CVQN+O83

Reading down any column shows the machine at work. At letter 3, μ61 shows a dot, so μ37 does not move and BM at letter 4 is the same cam as at letter 3. At letter 6 BM is a dot, so the psis stand still and ψ′ repeats: / / at letters 6 and 7. At letters 11 and 12 BM is dot twice running, so the psi letter J is added three times. Through all of it the chi letters change at every step.

Under the SZ42A rule, on the same wheels from the same start, the first ten letters are identical — the limitation never needs to act, because at each of the motor’s dots χ2 one back happened to be a cross. At letter 11 it does act: BM is a dot, but χ2 one letter back is a dot too, so the total motor is a cross and the psis move on. From there the two machines part company:

Table 3 — Under the SZ42A rule, on the same wheels from the same start, the first ten letters are identical — the limitation never needs to act, because at each of the motor's dots χ2 one back happened to be a cross. At letter 11 it does act: BM is a dot, but χ2 one letter back is a dot too, so the total motor is a cross and the psis move on. From there the two machines part company

Row	Letters 1–20
L = χ2 one back	xx••xxx•xx•••x•x•xx•
TM	xxxxx•xxxxxxxxxxx•xx
Extended psi	WIJ/X//DHPJVTF4XQCCS
Cipher Z	YXW9WIXNRPBCYFSEEHWT

Under the limitation the psis stood still only twice in twenty letters instead of six times. At letters 15 and 16 the key came out as / — chi and psi equal — and the plain text SE went out as SE unchanged.

3.10 Setting Up: Patterns, Start Positions and Indicators

A message needed two things agreed between the two ends of a link: the twelve wheel patterns, and the twelve start positions.

The patterns were set from a key list and changed at intervals that shortened as the war went on. The motor patterns were changed daily. The chi patterns were at first changed monthly; the psi patterns quarterly until October 1942, then monthly; and from 1 August 1944 all twelve were changed every day (Copeland 2006, p. 48, as cited by Wikipedia; Tiltman 1961 gives “monthly in 1941, daily in the later years of the war”). Each link had four SZ machines, a sending and a receiving set at each end.

The start positions were meant to be different for every message, and the way the sender told the receiver which ones he had chosen — the indicator — was the machine’s weakest procedure. On the experimental link of 1941–42 the indicator was twelve German first names, Anton, Bertha and so on, sent in clear, whose initial letters gave the positions of the twelve wheels; Tiltman recalled that “each transmission began with a set of twelve personal names … clearly a twelve-letter indicator” (Tiltman 1961). The reading board in the hero photograph, labelled Ablesetafel 40 für das Fernschreib-Spruchschlüsselblatt (“reading board 40 for the teleprinter message-key sheet”), is a device of the same kind, for turning letters from a key sheet into twelve wheel positions. Two messages with the same twelve letters were in depth; two that differed in only one or two letters were in partial depth. From October 1942 the names were replaced by the letters QEP and a two-digit number, looked up in a book of settings issued to both ends; each number was to be used once (Wikipedia, citing Copeland 2006, pp. 44–47). Volumes 4 and 6 tell what each system gave away.

3.11 How Big Is the Key, and Where Is It Weak?

On paper the SZ42 is enormous. There are 2⁵⁰¹ ways to set the cams — a number with 151 digits — and 1.6 × 10¹⁹ ways to start the wheels for each pattern. No codebreaker could try them all, and none ever did.

Its weaknesses were structural, and every one of them appears in the twenty letters above:

• The chi stream is perfectly regular. Each impulse repeats with the period of one wheel, so the chi wheels can be attacked one or two at a time, never all twelve wheels at once.
• The psis move together, or not at all. When they stand still, the psi contribution to the difference between neighbouring characters is all dots, on all five impulses at once.
• The motor is slow. μ61 and μ37 change the psi movement only in runs, so the psis often stand still for two or three characters together.
• The key is the sum of two parts. Remove the chi, and what is left — the de-chi — is plain text plus a psi stream full of repeats, which a trained eye can read (Volume 6).

Tutte’s first insight was the first of these (Volume 5); his statistical method combined the first two (Volumes 5 and 9); the Testery’s hand methods lived on the fourth (Volume 6). The limitations of 1943 and 1944 attacked the second and third, by making the psis move more often and less predictably. They came too late. By then the British had Colossus.

3.12 Checking the Description

Every example in this series comes from the simulator, not from hand working, and the simulator is checked against published material. Running python3 03-outputs/tools/lorenz_sim.py --selftest checks:

1. Tiltman’s twenty letters. The basic motor, extended psi, chi, key and cipher rows of Tiltman’s Fig. 5, with the Bream patterns of his Fig. 4, must come out exactly — and do, once the chi2 misprint noted under the figure above is corrected. The check found that the scan’s cipher row reads YXW9WIXNRPB+CVQN+O83; the text layer of the PDF misreads it.
2. Three real SZ42A messages. In November 2007 The National Museum of Computing marked the completion of its Colossus rebuild with a Cipher Challenge: three messages enciphered on the Lorenz SZ42 were sent by radio from the Heinz Nixdorf MuseumsForum in Paderborn, and the amateur Joachim Schüth broke them first, with his own software, before the rebuilt Colossus (Wikipedia, “Colossus computer”). Schüth published his received cipher tapes, his recovered keys and his decipherments (schlaupelz.de). The simulator, given his keys and tapes, reproduces his three decipherments character for character — German text about computers and exhibitions at the Heinz Nixdorf MuseumsForum — and fails to read any of them if the limitation is switched off.

What it does not check: the SZ42B and P5 limitations, and Tiltman’s start-of-message rule, for which no published test message was found; and the 1941 SZ40 traffic, whose wheel patterns and settings have not been published with the key. Those parts of the simulator are labelled as unvalidated in its source.

---

Next — Volume 4: The Depth of 30 August 1941 — Tiltman’s Break. Two long messages sent with the same twelve-letter indicator, HQIBPEXEZMUG, the second retyped with abbreviations and small changes; how John Tiltman added the two cipher texts together, dragged words through the sum, and recovered both plain texts and nearly 4,000 characters of key — the stretch from which the whole machine would be reconstructed without anyone at Bletchley ever seeing one.