M-209 — Volume 10 — Using the M-209 — A Field Message, Sent and Broken

10.1 About This Volume

The last volume of the series puts the machine to work and then takes the work apart. It follows one day’s traffic on one key list from the code clerk’s bench to the enemy’s intercept desk.

The first half is operation. Three short messages are enciphered in the procedure the Army taught in 1943–44: the key list set and checked, a fresh six-letter wheel setting chosen for each message, a system-indicator letter enciphered twelve times to hide the real starting position, the text enciphered with Z for every space, the last group padded with X’s in pencil, the indicator groups written at both ends.

The second half is the break. One of the three messages goes out with the same indicator as another. That single slip — the one the manual warned against in so many words — is enough. Following the method the German Army analyst Alfred Pokorny described to Allied interrogators in 1945, the two messages are read from each other, the day’s pins and lugs are rebuilt from them, the true wheel positions are recovered from the indicator, and the third message is read on the recovered key.

Every cipher letter, count and recovered pin in this volume comes from the unit’s two programs: the simulator 03-outputs/tools/m209_sim.py, checked against the 1944 manual’s 26-letter check and against messages from a real machine, and the attack 03-outputs/tools/m209_attack.py, which runs the whole break in a few seconds on an ordinary computer. Both are short, dependency-free Python, and every result below can be reproduced by running them.

10.2 The Day’s Key

The traffic uses the unit’s demonstration key list, given the two-letter indicator QX. It was made by the rules of the 1944 manual’s Appendix I (Volume 7): pins from a shuffled pack of 78 R and 78 L cards with no run longer than six, lug numbers 1, 2, 3, 5, 10 and 12 in random order with the six overlaps spread over six different pairs, and every count from 1 to 27 reachable. Its settings are in Volume 9 (acceptance test T5) and are printed by python3 m209_sim.py --demo-key.

The clerk sets the pins and lugs, zeroizes the counter, turns the wheels to AAAAAA and enciphers 26 A’s. The tape must read GQOQY OVXKE UQMMP UGADD RTZMX V — the key list’s 26-letter check. It does. The machine is ready for the day.

10.3 Sending a Message

The procedure below is the one reconstructed by Mark Blair from the War Department training film T.F. 11-1400 and the M-209 manuals (nf6x.net, chapter 4) and implemented in Brian Neal’s m209 package, against which the unit’s simulator is tested. It matches the procedure that the German analyst Pokorny described from intercepted traffic (TICOM I-175, pp. 2–3). The 1944 manual’s own sample method sends the six wheel letters in the clear and notes that “in some systems this indicator will be enciphered before transmission to provide additional security” (TM 11-380, par. 9b); this is such a system.

The first message, A, reads:

TO CO SECOND BN X ENEMY ARMOR ESTIMATED TWELVE TANKS MOVING SOUTH ON ROAD FROM HILL THREE FOUR SEVEN X REQUEST ARTILLERY ON GRID FOUR SIX TWO EIGHT X REPORT AT ONE EIGHT HUNDRED

1. External indicator. The clerk turns the six wheels individually to letters of his own choice, “which line up on the white bench mark. These letters should not spell a word, nor should the same letter be found twice in one key wheel alignment” (TM 11-380, par. 10b(4)). He chooses QMRAEC and notes it.
2. System indicator. He picks one letter, K.
3. Internal indicator. With the wheels at QMRAEC and the counter zeroized, he enciphers K twelve times. The tape reads NFGQLDZHLWKA.
4. Internal setting. He sets the wheels from the tape, left to right, taking the first letter that each wheel actually carries: N on wheel 1, F on wheel 2, G on wheel 3, Q on wheel 4, L on wheel 5, D on wheel 6. All six fit, so the remaining letters are not needed. The wheels now read NFGQLD. This is the true starting position, and it is never written down or sent.
5. Encipher. Counter to zero, knob at C, and the 177 letters of the message, with Z for each space, are dialled one by one.
6. Pad and frame. The last group is short; X’s are added in pencil, never enciphered (par. 10c(7)). The clerk writes the system indicator twice, the external indicator and the key-list indicator as two groups at the front — KKQMR AECQX — and repeats them at the end.

The message as sent — every group computed by the simulator:

KKQMR AECQX XMJJG QYMEZ MWNNM WYHVE GBNBP YSCAD UXCEN ONRMV NZVTC COZIY NHQMX QBEEJ CHXRL UQYRJ LMHWK UDYNH OTENU LRWQN SCDAL HWQLM AAHZB JCTHR BXNGR OGHTT ASBCG YNNNS LUZSF SCQYY NCMIJ NRZPA QGBLB XWNQU LEJLL NTICF TOMBU SQXXX KKQMR AECQX

The receiving clerk reverses the procedure: wheels to the external indicator QMRAEC, K enciphered twelve times, wheels set from the result to NFGQLD, knob at D, and the cipher groups dialled in. The machine prints the message with spaces for Z’s. The three pencilled X’s at the end decipher to three meaningless letters, which he ignores.

10.3.1 When a letter does not fit

Message C, sent later the same day, shows the one awkward step. Its clerk chooses system indicator P and external indicator HTDKBN; twelve P’s from HTDKBN print LCXJKVVLCBWX. Wheels 1 to 5 take L, C, X, J and K. Wheel 6 carries only A to Q, so the next letter, V, cannot be set on it; nor can the V after it. Both are crossed out, and wheel 6 takes the following L. The internal setting is LCXJKL. Pokorny noted the same thing from the German side: “As only one of the wheels bears all the letters of the alphabet, usually more than 6 letters had to be printed to provide letters suitable for all the wheels” (TICOM I-175, p. 3).

Message C:

TO CO THIRD BN X WITHDRAW TO RIDGE LINE BY ZERO SIX HUNDRED X BRIDGE AT MILL WILL BE BLOWN AT ZERO SEVEN HUNDRED

goes out as

PPHTD KBNQX GNWPW ALOHQ FQWZY TWSFT XSAZQ MGRRN ITIIB MDEFS PNLQN IZCUJ OBFBN JPVIL URYIN YBHSV RBLHO SYVIV KVBUA QPCSX AZENU URJDF VGKBO ZSBWS RMXXX PPHTD KBNQX

10.4 The Slip

Between A and C, a second clerk on the same net sends message B:

TO CO FIRST BN X RELIEVE COMPANY K ON HILL THREE FOUR SEVEN AT DARK X AMMUNITION AND RATIONS FOR TWO DAYS FOLLOW BY TRUCK X ACKNOWLEDGE

He has the same key list, and — through haste, or because he copied the indicator from the last tape on the pad — he uses the same system and external indicators as A, KKQMR AECQX. The manual had said it plainly: “different letters must be selected for every message” (par. 10b). The same indicator on the same key list gives the same internal setting, NFGQLD, and so the same drum count on every letter. Messages A and B are in depth.

This is the first and commonest of the four conditions under which, according to Pokorny, the M-209 could be broken: “two different messages … ciphered by one signal net, on the same day, and with an identical starting position of all wheels — same external indicator” (TICOM I-175, p. 3). An intercept operator sees it at once, because the indicator groups are sent in the clear and are identical.

10.5 The Break

10.5.1 Step 1: subtract

At every letter both machines had the same count k, so (Volume 7)

C_A − C_B = P_B − P_A (mod 26).

Subtracting B’s cipher text from A’s, letter by letter, removes the key completely. The result begins

A A A A A A N E P E G W C M M Y C S A Y E S X F Z L C Y Y B …

Six A’s — a difference of zero — because both messages open with the same six letters, TOZCOZ. A stereotyped address at the head of a message is a gift in a depth: it shows where the two texts agree.

10.5.2 Step 2: drag a probable word

Pokorny’s method for the next step was a paper one: the cipher letters of the two messages written on strips against a model of the print wheel, and “mots probables” — numbers, short words, common endings — tried along message A to see whether message B showed sense opposite them. “If for any part of Message I the correct clear text can be guessed, the corresponding part of Message II shows clear text also” (TICOM I-175, p. 5). He added that “a break of 60 to 100 clear letters is sufficient for further work.”

The attack script does the dragging mechanically and ranks the places by how English the other message looks. A short word is ambiguous. Dragging ZENEMYZ (Z for the spaces) through A, the six best-scoring places show B reading ZENEZCO, ODICEZZ, TZRNENU, ZENEMLD, ITRTUCE and RELIEVE — and only the last is right, at letter 18. A human analyst would pick it out; a frequency score ranks it sixth.

A longer word settles things. Most messages on a net share place names and grid references, and ZTHREEZFOURZSEVENZ — “hill three four seven” — is a good guess for any message that mentions the hill. Dragged through A, it gives at letter 84 the best score by a wide margin:

Table 1 — A longer word settles things. Most messages on a net share place names and grid references, and ZTHREEZFOURZSEVENZ — "hill three four seven" — is a good guess for any message that mentions the hill. Dragged through A, it gives at letter 84 the best score by a wide margin

A cipher	NULRWQNSCDALHWQLMA
B cipher	JOBIHMYKYYMWIBSTLA
guess in A	ZTHREEZFOURZSEVENZ
so B reads	DZRATIONSZFORZTWOZ

”…D RATIONS FOR TWO …” is unmistakable. The same phrase dragged through B gives A reading ELVEZTANKSZMOVINGZ — ”…ELVE TANKS MOVING…” — at letter 43, second on the score list. From there the analyst extends both texts outward a letter at a time, each guess in one message checked by the sense it makes in the other, until B runs out at 135 letters.

10.5.3 Step 3: the counts and the relative setting

With both plain texts known for 135 letters, every letter gives its drum count. From C = 25 − P + k, the count is k = (C + P − 25) mod 26; Pokorny called these “the spaces the printing wheel turned” (TICOM I-175, p. 7). The first 26 from message A are

17, 1, 9, 12, 21, 16, 17, 17, 7, 14, 0, 0, 13, 15, 0, 22, 22, 7, 0, 18, 11, 14, 12, 1, 16, 16 …

and message B gives exactly the same sequence, which confirms both reconstructions. (A 0 or 1 might really be 26 or 27; the fitting allows for it.)

Pokorny’s next instruction is the heart of every M-209 attack. “The sequel is written in six tables, with 17, 19, 21, 23, 25 and 26 numbers respectively, written in one line … The spaces showing in one column … have been produced with the wheel being in a certain position … From the spaces in a column being large or small, it can be said whether the pin in that position of the wheel must have been active or inactive” (p. 7). The figure below does it for wheel 3, which on this key list engages twelve bars.

On a heavy wheel the columns work well: the means alone get 19 of wheel 3’s 23 pins right. On a light wheel they are nearly useless, because one or two bars make little difference against the noise of the other five wheels. Pokorny’s remedy was “continued comparing and correcting”: guess the lugs from the pins, correct the pins from the lugs, and repeat until every count fits.

The attack script does that correcting by simulated annealing. Starting from the column guesses, it flips pins and moves bars between the 22 possible bar types, keeping changes that make the predicted counts closer to the observed ones and occasionally accepting worse ones to escape dead ends. On the 135 counts of the depth it reaches a fit with no errors on its first attempt, in about 0.6 seconds. The fitted drum is

1-2, 2-5, 3-0 ×10, 3-5, 3-6, 0-4, 0-5 ×7, 0-6 ×3, 4-5, 4-6

— exactly the key list’s, though the attacker does not yet know that — and six pin patterns, written as + and −. Pokorny’s word for the result is exact: it is the complete, “though relative, internal setting”. Each pattern is right, but it starts at an unknown point on its wheel. The attacker knows that the 23 pins of wheel 3 go + + − − + + − + − + − + … but not which of them is pin A.

10.5.4 Step 4: the absolute setting

To read any other message, the patterns must be tied to the wheel letters. Pokorny describes the German method: start each pattern at the letter that makes the indicator come out right. From the external indicator QMRAEC, the twelve enciphered K’s must print, letter by letter, the very letters at which the six patterns start (TICOM I-175, pp. 8–9); the table of trial placements was varied until it satisfied every condition at once. German analysts found this the slowest step: the figures collected at a 1950 Allied conference put it at twelve hours to three days, about a day on average (Volume 5).

There are 101,405,850 ways to place six patterns on six wheels. The script does not try them all. It splits the six wheels into two groups of three, lists the possibilities for each group separately, and matches the two lists through a table — a meet-in-the-middle search — once for each guess at which of the twelve printed letters fed which wheel, most likely first. On message A’s indicator it finds two placements that reproduce the indicator, VPOCNC and NFGQLD, with its first guess. One indicator does not always decide; the script tries each candidate on message C, which a wrong key turns into gibberish. VPOCNC fails. NFGQLD reads. The whole step takes about three seconds.

The recovered key list is then complete: every one of the 131 pins and all 27 bars agree with the real key list QX, and its 26-letter check is the real one, GQOQY OVXKE UQMMP UGADD RTZMX V.

10.5.5 Step 5: the rest of the day

With the key list rebuilt, message C — which was not in depth with anything and was enciphered correctly — falls at once. Its indicator PPHTD KBNQX tells the receiver, friend or enemy, to set HTDKBN and encipher P twelve times; the recovered key gives LCXJKL, and the cipher groups read

TO CO THIRD BN X WITHDRAW TO RIDGE LINE BY ERO SIX HUNDRED X BRIDGE AT MILL WILL BE BLOWN AT ERO SEVEN HUNDRED

followed by three junk letters from the pencilled X’s. Every other message sent on key list QX that day, however carefully, can now be read the same way, and the next day’s key list is a new problem. One careless indicator has cost the whole net a day of security.

10.6 How Much Text Is Enough?

The demonstration had 135 letters of depth, more than enough. The script’s --crib option repeats the break with less:

• 75 letters. The relative setting fits on the first attempt in under a second, and the recovered key is exactly right.
• 60 letters. The fit takes about nine seconds and many restarts, and the result has one pin wrong: pin R on wheel 1, the wheel with a single bar. Message C then reads correctly except for two letters, XITHDRAW at letter 18 and FRO at letter 96 — 78 letters apart, three turns of the 26-pin wheel 1. That is the manual’s periodic garble (Volume 9), and the manual’s own method finds the pin: errors a multiple of 26 apart mean wheel 1, and counting 16 from the bench-mark letter at the bad position names the pin. (The faulty pin comes round at letters 44 and 70 too, but there wheel 2 is also active, and wheel 1’s only bar, an overlap shared with wheel 2, is kicked anyway.)
• 50 letters. The fitting finds a set of pins and lugs that reproduces all 50 counts — but it is the wrong one, and no placement of it reads message C. Too little text admits false solutions.

Measured over ten random key lists made by the manual’s rules, the script recovered the key exactly from 50 letters once, from 60 letters four times, from 75 letters five times and from 100 letters seven times, with a limit of 30 seconds per key. That agrees with what the people who attacked the M-209 for real reported. Pokorny wanted 60 to 100 letters; Robert Morris’s hand method of 1978 needed about 75; the hill-climbing attack of Lasry, Kopal and Wacker in 2016 about 50 (Volume 5). A simple script lands in the same range, which says more about the machine than about the script.

Without a depth or a crib the problem is much harder. The ciphertext-only attack of Reeds, Ritchie and Morris — “The Hagelin Cipher Machine (M-209): Cryptanalysis from Ciphertext Alone”, a 1978 Bell Labs memorandum withheld at the NSA’s request — needed 2,000 to 2,500 letters, and the best modern method about 500 (Volume 5). The unit’s script does not attempt it.

10.7 Running It

Everything in this volume comes from two commands in 03-outputs/tools/:

python3 m209_attack.py               # the whole scenario: traffic, depth, break, message C
python3 m209_attack.py --crib 60     # the same from 60 letters of broken text
python3 m209_attack.py --sweep       # success rate against crib length on random key lists

The first prints the three messages, the depth and the probable-word drags, the counts, the fitted setting with timings, the absolute setting with its candidates, and the deciphered message C. On an ordinary laptop it finishes in about four seconds.

10.8 What the Break Shows

Every step of the break used something the machine or its procedure gave away, and every one of them was known in 1944.

• The depth came from one operator’s carelessness, which the manual forbade in plain words. Nothing in the machine could stop it.
• The probable words came from the way military messages are written: a stereotyped address, numbers spelled out, place names shared across a net, and Z between every word.
• The relative setting came from the short wheel periods and the count structure of Volume 7: write the counts in rows of the wheel length and the pins show through.
• The absolute setting came from the indicator itself, which is sent in the clear and carries, after twelve encipherments, the starting position the patterns must fit.

What the M-209 bought was time. The German analysts, working by hand with paper strips, needed hours for the relative setting and about a day for the absolute one, and read their results a week or more after the traffic was sent (Volume 5). For a battalion’s orders, that was usually long enough. A script now does the same work in seconds, which is a measure of how much the arithmetic has changed — and of why the M-209’s successors, from the CX-52 of Volume 6 onward, were built to make every one of these steps harder.

---

Back to Volume 1: The M-209 — A Cipher Machine in a Lunchbox. The series began with what the machine was for. It ends with a replica on the bench, a simulator that agrees with the 1944 manual letter for letter, and a script that reads a careless clerk’s traffic in seconds — the whole story in ten volumes.