Lorenz and Colossus — Volume 4 — The Depth of 30 August 1941 — Tiltman's Break

4.1 About This Volume

Every machine cipher of the Second World War was eventually broken through a human mistake, and the Lorenz machine was no exception. Its mistake has a date, 30 August 1941, and a name, HQIBPEXEZMUG — the twelve-letter indicator that a German operator on the experimental radio link to Athens used twice for the same long message. The British codebreaker who exploited it was John Tiltman, the most experienced cryptanalyst at Bletchley Park, and what he extracted from it was not a message but something far more valuable: a continuous stretch of 3,976 characters of the key that the machine had generated.

This volume tells how the new signals were first heard and intercepted, what the British could learn about them before anyone read a word, how a depth works in principle, and how Tiltman read this one. It draws throughout on Tiltman’s own account, a lecture he gave in 1960 and wrote up for the American National Security Agency, released in 2007 (Tiltman, “The ‘Tunny’ Machine and Its Solution”), and on Bill Tutte’s 1998 recollection (Tutte, “FISH and I”). Some passages of Tiltman’s text were still withheld when it was declassified; where the record is incomplete, or where the sources disagree, this volume says so.

4.2 Strange Signals

The first British encounter with German radio teleprinter traffic came in the second half of 1940. The interception service then responsible for unusual signals was a small unit run for the Foreign Office by the Metropolitan Police, which had been listening to clandestine and foreign transmissions since before the war and had moved to Denmark Hill in south London. Its technical head, Harold Kenworthy, became the leading British expert on the new non-Morse transmissions. Two stations were heard sending enciphered teleprinter signals in 1940, and in June 1941 a new link appeared that would become the first Tunny link (Copeland 2010; The National Archives, HW 50/79, Kenworthy’s history of Knockholt).

Bletchley called the first of these non-Morse links NoMo1. The sources disagree on its route. Tiltman, writing from memory in 1960, placed it between Vienna and Athens, “shortly after the invasion of Russia in the summer of 1941”; later histories give it as a German Army link between Berlin and Athens, with Salonika also involved (Tiltman 1961; Wikipedia, “Fish (cryptography)”). Either way, it carried Army traffic to and from the forces in Greece, which the Germans had occupied that spring, and it was experimental: the Germans were trying out a new cipher on a working link.

As the volume of this traffic grew, the intercept effort moved to a purpose-built station at Knockholt in Kent, on a hilltop south-east of London, under Kenworthy. By the last year of the war the General Report on Tunny records 30 receiving sets there, 26 of them covering priority links (General Report on Tunny, 1945, §33B). Each intercepted transmission was recorded on an undulator — a pen that traced the signal as a wavy ink line on a moving paper strip — and, where reception was good, punched automatically onto five-hole tape. Where it was poor, “slip-readers” worked through the undulator trace by eye, character by character, to produce a corrected tape. The accuracy of this work was remarkable; Tutte later praised the interceptors for producing copies “with few garbled letters and every letter, garbled or not, in its proper place” (Tutte 1998). That last point — every letter in its proper place — mattered enormously, because the methods that followed depended on counting positions exactly.

4.3 What Could Be Learned Without Reading a Word

4.3.1 Hellschreiber, and a broken punch

In the experimental period, Tiltman recalled, the link’s messages were sent mostly by Hellschreiber, the German facsimile-like system that printed each character as a little picture on a strip of gummed paper. For this, six extra symbols — written at Bletchley as 3, 4, 8, 9, + and / — were added to the 26 letters to make up the 32 five-unit combinations. The British receiving stations could print the Hellschreiber signal just as the Germans did, and Tiltman’s article reproduced the first page of an intercept of 14 August 1941.

The first task was to work out which of the 32 printed symbols stood for which five-unit combination. Tiltman found it easy, thanks to a German equipment fault. In a series of unenciphered messages of 22 July 1941, the crosses of the first impulse had not been punched, so every character that should have had a cross in impulse 1 came out as the character without it — “Heinrich”, for example, came through as H/INRICH, and “Theodor” as TH/030R. By noting which letters were corrupted into which, Tiltman could map the symbols onto the teleprinter code (Tiltman 1961).

4.3.2 The twelve names

Each transmission began with a preamble in clear, and the preamble contained a sequence of twelve German first names from the phonetic alphabet — Anton, Bertha, Caesar, Dora and so on — standing for twelve letters. Tiltman took it to be “clearly a twelve-letter indicator”: the sending operator telling the receiver where to set twelve somethings. A group of five 9s separated the clear preamble from the cipher text.

The indicator gave away more than its makers intended. The British noticed that, across many messages, eleven of the twelve positions used 25 different letters and the twelfth only 23 (Tutte 1998). That suggested twelve wheels, eleven of them with at least 25 positions and one with exactly 23. And the operators, it turned out, chose the indicators themselves. Tiltman found several messages whose indicators were recognisable words: GRATZEPPELIN, and KAEFERBOECKS, which appeared four times — “some kind of a bug which was giving the sending operator trouble or a rude nickname for one of his colleagues”, Tiltman guessed.

Most important of all, the indicators showed when two messages had been sent with the machine set the same way. Among the early intercepts, Tiltman wrote, “were a number of cases of two or more messages having the same twelve-letter indicator.” Same indicator, same wheel settings, same key. Bletchley had, in its own word, depths.

4.4 What a Depth Is

A depth is two messages enciphered on the same key. For any additive cipher, including the Lorenz machine, it is a disaster for the sender, because adding the two cipher texts together cancels the key and leaves the sum of the two plain texts.

Tutte explained how the separation works with an example in ordinary letters, numbered 1 to 26 and added modulo 26. Suppose two messages, C1 and C2, have been sent on the same key, so that the codebreaker knows their difference. He tries a likely word, perhaps LONDON, at successive positions in the first, and at each position works out what the second message would have to say at the same place:

… until one finds a position in which those six letters are plausible as plain text. Perhaps they are then IMPENE. Guessing that this continues as “IMPENETRABILITY” he writes [the next letters] … Soon he is announcing C1 as beginning “London thou art the flour of cities all” and C2 “Impenetrability, thats what I say”.

— W. T. Tutte, “FISH and I” (1998)

With teleprinter characters the arithmetic is modulo 2 rather than modulo 26, and the codebreaker works with Z1 + Z2 — the sum of the two cipher texts, which equals P1 + P2 — but the method is identical. A guessed word in one text (a crib) is added to Z1 + Z2 at a trial position; if what comes out reads as German, the guess is probably right, and both texts can be extended a few letters at a time, each new word in one suggesting the next in the other. When enough plain text is known, adding it to its own cipher text gives the key: K = Z + P.

The method needs nothing at all from the machine. It does not matter how complicated the key generator is, how many wheels it has or how they move. A depth gives the plain text and the key directly. That is why a depth was the first and most precious thing a Tunny codebreaker looked for, and why every later German procedure change aimed to stop depths being sent or recognised.

Tutte recalled that the early depths had already shown “enough success to identify Tunny as an additive cipher using the mod 2 addition” (Tutte 1998). What none of them had given was enough key to say anything about the machine that produced it. Short depths give short stretches of key, and a few hundred characters of key from a twelve-wheel machine are indistinguishable from random noise.

A small simulation shows what a depth looks like on paper. Two plain texts that begin identically — SPRUCHNUMMER9EINS9AN9… and the abbreviated SPRUCHNR9EINS9AN9DEN9 (9 is the Bletchley sign for a space) — are enciphered on the same SZ40 settings. The wheel patterns are invented for the purpose (03-outputs/tools/slot_examples.py, using the unit’s simulator lorenz_sim.py); this is not the 1941 traffic.

Table 1 — What a Depth Is

	Bletchley letters
Z1	CKVAESXZY8Z8VZIF+XZ9F
Z2	CKVAESXMF4PB8HAFGTW9F
Z1 + Z2	///////FOXUIESS/EF4//

The first seven characters of the two cipher texts are identical, because the plain texts are identical there and the key is the same; their sum is seven /, the null character, all dots. From the eighth character on, the sum is no longer key at all: it is P1 + P2, the sum of two plain texts that have slipped out of step by four letters (MER9… against 9EIN…). The simulator confirms that Z1 + Z2 equals P1 + P2 character for character. That sum is what a codebreaker drags cribs along.

4.5 August 1941

On 30 August 1941 two very long messages were intercepted on the experimental link, both with the indicator HQIBPEXEZMUG. Tiltman’s account gives their lengths: “One had 3976 symbols of consecutive cipher text and the other was about 500 symbols longer” (Tiltman 1961).

What had happened can be reconstructed from the later accounts. The sending operator had transmitted a long message, punched on tape or typed — the sources differ on the detail — and the receiving operator had not got it; the first transmission had been corrupted, probably by atmospheric noise (Copeland 2010). The receiver asked, in German and in clear, for it to be sent again. Both operators then did what was strictly forbidden: they reset their machines to the same indicator, and the sender keyed the message a second time on the same settings (Sale, “The Lorenz cipher and how Bletchley Park broke it”).

If the second sending had been an exact copy of the first, the two cipher texts would have been identical, and identical cipher texts carry no information at all: their sum is all dots. What made the depth so valuable was that the operator, retyping a long message by hand and perhaps tiring of it, did not repeat it exactly. The first message began with the usual stereotyped opening SPRUCHNUMMER (“message number”); the second abbreviated it to SPRUCHNR. From that point the two texts ran out of step, and as the operator went on abbreviating words, dropping spaces and making different typing errors, they drifted further apart. Tutte described the result as “two attempts at the same message, one having more word-spacing and other punctuation than the other” (Tutte 1998).

A depth between two different messages has to be read by guessing words that might plausibly appear in each. A depth between two slightly different versions of the same message is a gift: once a stretch of one text is known, the same words are known to appear in the other a few positions further on, so each discovery feeds the next. Tiltman found that the first message began with SPRUCHNUMMER and the second used the abbreviation NR for NUMMER; working forward from there, word by word, he carried the reading through both texts.

4.5.1 Ten days

Tiltman was a master of exactly this kind of work, and he did it himself:

In the course of the next ten days or so I succeeded in carrying recovery to the end of the shorter of the two messages, thereby recovering 3976 consecutive symbols of key.

— John Tiltman, “The ‘Tunny’ Machine and Its Solution” (c. 1961)

It was not perfectly clean. Tiltman noted that in modulo-2 working there is often no way to tell which plain text belongs to which cipher text, and that the recovered key was ambiguous in places, “though not generally for more than three consecutive symbols”; the ambiguity disappeared once he reached the end of the shorter message. The German operators had made the work harder too: “In both plaintext versions, there were many places where the sending operator had struck a wrong key or made some other mistake necessitating long stretches of corrections and repetitions.”

The message itself, Tiltman recorded, was “a report for the personal information of the German military attaché in Athens”; the subject is withheld in the declassified text. Its content was of little consequence. What mattered was the key: nearly four thousand consecutive characters of the output of an unknown machine, every one of them known.

4.6 Who Tiltman Was

John Hessell Tiltman (1894–1982) was by 1941 the senior cryptanalyst of the Government Code and Cypher School. Born in London on 25 May 1894, he was commissioned into the King’s Own Scottish Borderers in the First World War, won the Military Cross and was wounded in France in 1917. After the war he served with the British mission to the White Russians, learned Russian, and in 1920 joined the GC&CS, which posted him to Simla in India to work on Soviet diplomatic ciphers. Back in England from 1929, he became the department’s leading codebreaker across many languages and systems; at Bletchley he founded and ran the Military Section, was responsible for the first British success against the Japanese naval code JN-25, and became Chief Cryptographer in 1943 (GCHQ, “John Tiltman”).

Tiltman’s colleagues regarded him as the finest hand cryptanalyst of his generation, equally at home with Japanese code books, Russian one-time pads and German machine ciphers. He was promoted brigadier in 1944, worked after the war as GCHQ’s senior liaison officer in Washington, helped broker the intelligence-sharing agreements between Britain and the United States, and after retiring from GCHQ in 1964 worked for the NSA until he was 80. He died in Hawaii on 10 August 1982.

His own view of his part in the Tunny break was modest and exact. He had recovered the key; he had not recovered the machine:

I took no part in the reconstruction of the machine from the long stretch of key which I had recovered. It was studied in its five individual impulse streams by the members of my Research Section and most of the work of reconstruction was done by Dr. Morgan and Mr. Tutte. However, no obvious periodicity was at first observed and no progress was made for about four months.

— Tiltman (c. 1961)

4.7 Why One Mistake Was Enough

It is worth pausing on how much the depth gave, and how little.

It gave the key, in quantity, with no other information mixed in. Every later step in the solution — Tutte’s discovery of the 41-character cycle, the Research Section’s reconstruction of the twelve wheels, the first recovery of actual cam patterns — was done by studying that key. Without it there was nothing to study: the cipher text alone looked random, and short depths gave too little.

It did not give the machine. Nobody at Bletchley knew how many wheels there were (beyond the hint of twelve in the indicator), how they moved, how their outputs were combined, or how long each one was. The key was the output of a mechanism, and the mechanism had to be inferred from the output alone. That inference, which took about four months and is told in Volume 5, is the part of the story that made Tutte’s reputation.

And it was the product of procedure, not of design. The Lorenz machine was not defective; it did what it was built to do. What failed was the discipline that should have stopped an operator from ever using the same settings twice. Tutte’s verdict, given half a century later, was that two German errors together had been fatal: “the poor Ψ-patterns and second the sending of a long depth of two. Either error without the other the Germans would I think have got away with. But the two together gave away the structure of the machine” (Tutte 1998). The first error — psi-wheel patterns with too many long runs of the same sign — is explained in Volume 5.

4.8 What the Germans Did Next

The Germans did, in time, learn the lesson, though not from any knowledge that their traffic was being read. The twelve-letter indicators of the early links made depths easy to spot and leaked information about the wheels. Tutte recalled that “eventually the Germans, noticing that the indicators were giving away information that need not be given away, abolished 12-letter indicators. Instead they gave a simple number. Presumably the operator looked up the number in a book and found his twelve letters against it” (Tutte 1998). From October 1942, operators took their settings from a printed list — Bletchley called the system QEP, after the prefix of the number sent in the preamble — with each line of the book meant to be used once (Copeland 2010). Depths could still occur when an operator reused a line, and they could still be recognised by matching QEP numbers, but they became rare and unpredictable. Volume 6 follows the codebreakers through that change.

By then it hardly mattered. The key of 30 August 1941 had already given up the machine.

4.9 The One-Paragraph Version

German enciphered radio-teleprinter traffic was first heard in Britain in 1940 and intercepted systematically from June 1941, on an experimental Army link to Athens that the police intercept service under Harold Kenworthy, and later the station at Knockholt, recorded on undulator tape. Before any message was read, Tiltman worked out the character code from a broken German punch, inferred twelve wheels from the twelve-name indicators, and found depths — messages sent with the same indicator. On 30 August 1941 an operator asked to repeat a long message sent it again on the same setting, HQIBPEXEZMUG, with abbreviations and spacing changes that put the two texts out of step; Tiltman spent about ten days reading both and so recovered 3,976 consecutive characters of key. He did not reconstruct the machine; that took the Research Section, and above all Bill Tutte, another four months. The Germans tightened their indicator procedures in October 1942, but the single long depth had already been enough.

---

Next — Volume 5: Bill Tutte — Deducing a Machine from Its Output. Three months after Tiltman’s break the key was still a mystery. A young chemist from Newmarket, handed a copy and told to see what he could do with it, wrote its first impulse out in rows of 575 by hand, noticed a diagonal, and arrived at 41 — the length of the first chi wheel. How the rest of the machine followed in two months, how Tutte invented the statistical method that would set its wheels without a depth, and why the man who did it spent the rest of his life almost unknown.