M-209 — Volume 5 — Breaking the Hagelin — German, Italian and Allied Attacks

5.1 About This Volume

The M-209 was never meant to be unbreakable. It was meant to be good enough: good enough that an enemy who intercepted a battalion’s message would not be able to read it before the information in it went stale. This volume answers how good it actually was from the records of the people who attacked it.

There were three sets of attackers. The Germans attacked the M-209 directly, from early 1943 to the end of the war, and the surviving reports of their Army signal intelligence agency describe exactly how they did it. The British attacked a Hagelin machine from the other side: the Italian Navy’s C-38m, a close cousin of the M-209, whose messages about supply convoys to North Africa were read at Bletchley Park from 1941. And after the war the Americans and British together went back over the German files to decide how much damage had been done, at a moment in 1950 when the M-209 was again carrying American traffic in combat, in Korea.

The story ends in the 1970s at Bell Telephone Laboratories, where Robert Morris, Dennis Ritchie and James Reeds — two of them better known for the Unix operating system — worked out a ciphertext-only attack on the M-209 and then, after a conversation with a visitor from the National Security Agency, chose not to publish it.

The mechanism itself is explained in Volume 3 and its mathematics in Volume 7; this volume refers to them rather than repeating them. A full break, run on the series’ simulator, is demonstrated step by step in Volume 10.

5.2 Where the Weakness Lies

Every attack in this volume exploits the same few properties of the Hagelin pin-and-lug design, so they are worth setting out first.

The cipher is a slide, not a scramble. At each letter, the M-209 adds a number (the “key” or “displacement”, set by how many lug bars the pins have pushed into play) to a reversed alphabet and reads off the result. The substitution at any one position is therefore one of only 26 possible slides of a backward alphabet against a forward one, and every one of them is reciprocal: the same setting that turns A into M also turns M into A. A German instructor’s lecture, captured after the war, put the consequence plainly: “at each position in the message only one definite substitution out of a choice of 26 different ones is possible. These 26 different substitutions come about because a normal alphabet and a reverse standard alphabet have been slid against each other. (Compare the sliderule!)” (TICOM DF-120, translated 1948).

Two messages on the same key cancel each other. If two messages are enciphered from the same starting position of the same internal setting, they share the same key at every position. Subtracting one ciphertext from the other removes the key entirely and leaves only a relation between the two plaintexts. Guess a word in one message and the matching letters of the other fall out at once. Cryptanalysts call such a pair a depth, and the M-209’s whole security procedure — a fresh, randomly chosen wheel starting position for every message, announced in a disguised indicator — existed to prevent depths. When an operator re-used a starting position, or chose a lazy one, the procedure failed.

The key stream has structure. The six pinwheels have 26, 25, 23, 21, 19 and 17 positions, so the pattern of active pins on each wheel repeats every 17 to 26 letters, even though the combined period of all six is over 100 million letters (Volume 7 works through the arithmetic). The key at each letter is a count of lug bars engaged, which is not evenly spread across the alphabet. Both facts give a statistical handle on long stretches of text, and a little known plaintext goes a long way: once the key at a few dozen positions is known, the short wheel periods let an analyst fit pin patterns to it and then work out the lugs.

Internal settings lasted a day; external settings were supposed to last one message. The pins and lugs (the “internal setting”) came from a key list and normally changed daily across a whole key net. The wheel starting positions (the “external setting”) were meant to change with every message. An attacker who recovered one day’s internal setting could read every message on that net for that day, provided they could also work out the true wheel letters — a distinction the German analysts called the difference between a relative and an absolute setting, and which turned out to be the slowest step of all.

The unit’s simulator shows the effect. On the 1944 manual’s training key list, with the wheels set to QAHNKE for both messages, two lines of a field report encipher as follows (letters A = 0 … Z = 25, Z for each word space):

Table 1 — The unit's simulator shows the effect. On the 1944 manual's training key list, with the wheels set to QAHNKE for both messages, two lines of a field report encipher as follows (letters A = 0 … Z = 25, Z for each word space)

Plain 1	ENEMYZTANKSZATZBRIDGE
Plain 2	SENDZAMMUNITIONZNOWZX
Cipher 1	PAIOVLDBFVUYATUQZHGBS
Cipher 2	BJZXUKKPYSEESYGSDBNIZ
Cipher 1 − Cipher 2	ORJRBBTMHDQUIVOYWGTTT
Plain 2 − Plain 1	ORJRBBTMHDQUIVOYWGTTT

The last two rows are identical: subtracting the cipher texts gives exactly the difference of the plain texts. Enciphering the same pair on a completely different key list (the unit’s demonstration key “QX”, from MSVCAJ) gives different cipher texts but the same difference, letter for letter — the key has cancelled out.

5.3 The Germans and “AM-1”

German cryptanalysts knew the M-209 as AM-1 — “American machine 1” — and also as “BC-38”, recognising it as Boris Hagelin’s commercial C-38 design.

German code-breaking in the Second World War was split across about a dozen separate agencies, run by different military and civilian authorities with little exchange between them (Ekhall and Schmeh, HistoCrypt 2023). The main attack on the M-209 belonged to the Army’s signal intelligence service, the Inspectorate 7/VI (In 7/VI, part of the Army High Command’s signal intelligence organisation, OKH/GdNA), with its forward intercept and evaluation units in the field. The armed forces’ central cipher bureau, OKW/Chi, the Luftwaffe’s service and the Navy’s service also worked on Hagelin traffic.

5.3.1 The first depth, January 1943

The best single source is a lecture by an analyst of In 7/VI’s “Section 2a”, which handled the linguistic side of the work. The report was found buried in a camp at Glasenbach, near Salzburg in Austria, and reached the Allied Target Intelligence Committee (TICOM) in May 1947; the US Army Security Agency translated it in 1948 as TICOM document DF-120, Report on the Solution of Messages in Depth of the American Cipher Device M-209 (TICOM DF-120).

According to the lecture, the Americans first used the machine “in December 1942 in the African theater of war”. The first messages in depth appeared in January 1943, and since they happened to be “exceptionally long messages of 682 letters, the entry into the entire system succeeded with them. The two messages were linguistically solved and the first internal machine setting found analytically.” When the M-209 replaced the M-94 strip cipher across the US Army in the spring of 1943, the Germans “could read this new traffic currently as long as messages in depth appeared”. Messages were read from North Africa, Sicily and Italy, and from the invasion army training in England, where practice messages were “read currently and gave valuable hints to Evaluation, so that, by the beginning of the invasion, a rather clear picture of the strength and composition of the invasion army had been built up.”

The lecturer was frank about why it worked at all:

According to regulations, the indicator group and, with it, the external setting of the 6 key wheels, is supposed to be changed from message to message, but fortunately this is not always done, for, otherwise, no messages in depth would appear at all.

— In 7/VI lecture, translated as TICOM DF-120 (1948)

5.3.2 From a depth to the day’s key

The German method had three stages, and the agency divided them between sections.

The first was reading the depth. Two ciphertexts on the same key were written one above the other. The analyst then guessed a likely word in one message — a stereotyped opening, a unit designation, a place name — and used a sliding strip of reversed alphabet, the “slide” of the lecture, to see what letters it forced in the other message. A good guess produced readable English in the second message; a bad one produced nonsense, and the analyst slid on. DF-120 describes this “purely linguistic solution” in detail, including a statistical method for scoring candidate letter-pairs with English trigram counts.

The second was recovering the internal setting. With both plaintexts known, the key value at every position followed directly. From that key stream, the analysts in “Section 1b” worked back to the pin pattern on each wheel and the lug arrangement in the cage — the day’s internal setting. This was possible because of the short wheel periods: each wheel’s contribution repeats every 17 to 26 letters, so a long enough stretch of key has to be consistent with one repeating pattern per wheel. A German naval analyst interrogated in June 1945 said he had recovered pins and lugs from as few as 38 letters of key, and that 100 “would nearly always succeed” (TICOM I-6).

The third stage was the hardest: turning this relative setting into an absolute one. A pin pattern worked out from key alone says which pins are active in which order, but not which printed letter on the wheel rim corresponds to which pin. Without that, the analyst could read the two messages in hand but could not use the indicators of the day’s other messages, which named their starting positions by those rim letters. Alfred Pokorn of the Army High Command’s cipher department described the procedure: candidate alignments were tried “working with the various pin sequences and the indicators of the messages involved”, searching for a consistent fit (Ekhall and Schmeh 2023, summarising TICOM Doc. 2785). A separate captured paper, TICOM DF-105, is titled Determination of the Absolute Setting of the AM-1 (M-209) by Using Two Messages with Different Indicators.

5.3.3 The Weber machine

Almost everything the Germans did against the M-209 was done by hand. One exception is known, and it attacked precisely the slow third stage.

In 2004 the journalist and cryptologic historian Klaus Schmeh published the recollections of Reinold Weber (1920–2021), who had served in a German Army intercept and evaluation unit — he remembered it as “FNASt 5”, most likely NAASt 5 — first at Louveciennes outside Paris and then in Germany (as summarised in Ekhall and Schmeh 2023). In April 1944, Weber said, he had the idea of a machine to speed up the search for the absolute setting. After the Allied landings the unit moved to a former cigar factory at Krofdorf, north of Frankfurt, where a precision-engineering firm had silver steel, brass and machine tools; Weber and a colleague, working three days a week, built rollers with 26 slots each, punched sheet-metal templates representing a relative setting, and a relay circuit wired to a panel of 26 × 16 flashlight-bulb sockets. By the end of August 1944 it worked. Weber said it found an absolute setting in about seven hours, against about a week for three people by hand. When the unit retreated to Salzburg in early 1945 the machine went too, but with no intercept equipment to feed it, it was ordered destroyed; Weber broke it up himself with a pickaxe, hatchet, hammer and saw.

For eighteen years Weber’s account was the only evidence. Then, in 2022, Magnus Ekhall found in the TICOM files a translated document, DF-114, German Cryptanalytic Device for Solution of M-209 Traffic, declassified in 2010 and found “buried not far from Salzburg”. It describes a “skip box” of 120 spring-loaded switches pressed by lugs on five rotating cylinders, a rotary distributor, and six relay test circuits, one per M-209 wheel, wired as binary trees: when current passed all six, a lamp lit to show a possible solution. The device worked on up to five messages in depth and drew up to 448 watts (Ekhall and Schmeh 2023). The principle — step through candidate positions electrically and stop when a chain of test circuits all conduct — is the same as that of the British Turing–Welchman Bombe against Enigma. Ekhall and Schmeh judge the DF-114 device and Weber’s machine probably to be the same thing, while noting differences (four rollers against five cylinders) and the general unreliability of recollections and interrogations made long after the event. Exactly how it worked is still not known.

5.4 How Much Did the Germans Read?

After the war the question became contentious. In 1950 a British liaison officer, T. R. W. Burton Miller, remarked to William F. Friedman — the US Army’s senior cryptologist, by then technical consultant to the director of the Armed Forces Security Agency — that the Germans had obtained a “vast amount of intelligence” from M-209 traffic. Friedman questioned it, and on 12 October 1950 convened a meeting at the Naval Security Station in Washington to settle the matter. Present were Miller and Kenneth Perrin for the British; Abraham Sinkov, Frank Austin and R. W. Pettengill of the Armed Forces Security Agency; and Captain Mary C. Lane as recorder. The minutes, Special Conference on M-209 Security, were declassified by NSA in 2014 (NSA, Friedman Collection).

The question was not academic. Miller pointed out that the M-209 “was being used for communications by the U.S. Army in Korea”, where British troops were now fighting alongside American ones; the British used Typex and could use the joint Combined Cipher Machine at brigade level, but the M-209 was “the only system available to U.S. forces at the equivalent U.S. level”, so it might have to serve as a combined system.

Perrin had gathered the evidence from the TICOM interrogations, and it varied widely from witness to witness:

Table 2 — Perrin had gathered the evidence from the TICOM interrogations, and it varied widely from witness to witness

Source (as reported in 1950)	Claim
Most German sources	6–10 % of US Army M-209 traffic read
Rudolf Hentze, Army cryptanalyst	30 % read (Perrin thought him “possibly an unreliable source”)
Lt Schubert, German Army	traffic read “for about 20 days a month” — probably occasional keys, not most traffic
Voegele, senior Luftwaffe cryptanalyst	6–8 days a month on the Western Front; 1–2 days in the Mediterranean
US Navy M-209 traffic	”almost no” traffic read — little volume and strict cipher discipline
Frank Austin (AFSA), overall US estimate	about 10 % including physical compromise; 6 % by pure cryptanalysis
Perrin’s own figure	about 10 % by cryptanalysis alone

A navy prisoner interrogated in 1945 confirmed the naval picture: US Navy Hagelin traffic “offered few depths, and they read only two or three days altogether” (TICOM I-6).

The timings varied as much. TICOM sources agreed that reading a depth and recovering a relative setting took two or three hours each. Estimates for the absolute setting ranged from 12 hours (Hentze) and 22 hours (Voegele) to one or two days (Barthel) and 72 hours (Schultze, Navy); Perrin suggested 24 hours “if one were lucky”, for a total of about 28 hours after the messages reached the solving section. Friedman thought a delay of two or three weeks between interception and absolute setting “would not be improbable”. The traffic itself, the Germans admitted, often reached the central unit days after interception — seven or eight, according to Voegele.

One American remark cuts the other way. Austin told the meeting that US monitoring of the M-209 traffic of an American armored division in England before D-Day had read 29 days’ traffic a month by cryptanalysis: the division’s operators were making depths almost every day. Corrective measures were taken before the invasion, but heavy losses among signal personnel afterwards meant untrained men became cipher clerks, “with a consequent decline in cipher discipline”. On the other hand, Austin noted, as many as 75 different M-209 key lists were in use at once — every division, corps, military police battalion and Army Air Forces unit had its own — so even a good day against one net was a small share of the whole.

The meeting agreed that two factors had held the Germans back: the lack of “any cryptanalytic mechanical device” — Pettengill added that the Germans “had apparently developed a mechanical method of solution, but the principles of this method were obscure, and there was no conclusive evidence that it had actually been employed” — and the delay in getting intercepts to Berlin. Because of that delay the tactical value of the reading was “negligible”, but there was “an appreciable amount of strategic intelligence”: the effect of the V-1 flying bomb, new airfields, Allied order of battle. Asked about the British equivalent, the Stencil Subtractor Frame, Perrin said it had never been read by the Germans except for one month when its book was captured.

Miller withdrew the word “vast”. The agreed statement read:

Disregarding information obtained from the use of captured M-209 key lists, it is generally agreed that a considerable amount of American M-209 traffic was broken by the Germans during World War II, from which little tactical intelligence was deduced, but from which an appreciable amount of strategic intelligence was obtained. It is further agreed that, due to the inefficiency of the German intercept organization, the lack of modern cryptanalytic machinery, and the failure of the Germans at high levels to appreciate the value of speedy intercept, forwarding, and processing of traffic, the German success did not represent the maximum potential exploitation.

— Special Conference on M-209 Security, 12 October 1950

That last clause is the real verdict. The M-209 had been protected less by its mechanism than by the shortcomings of the people attacking it.

The same meeting heard of one more German effort: a “theoretical solution of the M-209, given a text of 3000–5000 letters”, without depths — which, the meeting agreed, had been “of no practical value”. The navy prisoner of 1945 described the same thing: a method “independent of depths, based on the word separators” (the M-209 enciphered the space between words as the letter Z) that “worked on one trial day with 30,000 letters, and failed on another” (TICOM I-6). A general attack on ciphertext alone would have to wait three decades.

5.5 The Other Side: Bletchley Park and the C-38m

While the Germans worked on the American Hagelin, the British were reading an Italian one.

The Italian Navy, the Regia Marina, adopted a version of Hagelin’s C-38 — the C-38m — for its traffic in 1941, and used it in particular to route the convoys carrying supplies from Italy to the Axis armies in North Africa. At Bletchley Park the Italian naval section in Hut 4, a small team recruited by the Cambridge historian J. R. M. Butler, took it on; one of its members, Bernard Willson, achieved the first decryption of a Hagelin message in June 1941 (Wikipedia, citing Wilkinson in Hinsley and Stripp, Codebreakers, 1993). The methods have not been published in detail.

The result was among the most directly useful intelligence of the North African campaign. Hagelin decrypts gave the sailing times and routes of Axis supply convoys, which the Royal Navy and Royal Air Force could then intercept and sink, and Enigma decrypts showed the effect: between May and September 1941, Luftwaffe fuel stocks in North Africa fell by about 90 per cent (Hinsley, The Influence of ULTRA in the Second World War, as cited by Wikipedia). Historians have called the Hagelin break “hugely significant”, and Churchill is said to have visited Hut 4 to thank the team, which went on reading Italian Hagelin traffic until Italy left the war in 1943.

The British success fed straight back into the American question. In 1942, according to the Crypto Museum’s account, Bletchley Park warned the US Army that if the British could read Italian Hagelin traffic, the Axis would in time read American Hagelin traffic; Arlington Hall chose to go on with the M-209, judging that the effort required to break it made the risk acceptable for short-lived tactical messages (Crypto Museum, M-209). The German record above shows that both sides were right: the machine could be broken, and mostly it was broken too slowly to matter on the battlefield.

5.6 After the War: Machines Against Hagelin

The Americans had already drawn the lesson the 1950 meeting spelled out — that the Germans had failed for want of machinery. WARLOCK I (designated AFSAF-D79), built by Engineering Research Associates of St Paul, Minnesota, between 1947 and about 1951 at a cost of roughly US$500,000, was an electronic “message setter” tailored to the Hagelin C-38 family. It tried settings at high speed and scored the resulting text statistically for the “roughness” of real language, printing out the wheel settings when it found a hit. It was too large for the agency’s headquarters and stayed at the ERA factory, which became in effect a remote operations centre (Crypto Museum, WARLOCK, citing Wheatley 1953 and Burke 2002).

The reason for building it was not the M-209, which the United States knew how to set securely, but the many Hagelin C-type machines sold to other governments before and after the war. That interest — in what other countries were enciphering with Hagelin’s machines — runs through the whole post-war history of Hagelin’s company and is the subject of Volume 6.

5.7 Bell Labs, the M-209 and the NSA

The last chapter of the M-209’s cryptanalytic story was written in the 1970s, by amateurs in the strict sense: researchers at Bell Telephone Laboratories, working on their own time, on a machine any collector could buy.

Robert Morris (1932–2011), a Bell Labs mathematician and one of the early contributors to Unix, acquired an M-209 around 1970. In his account of the episode, Dennis Ritchie — co-creator of Unix and of the C language — recalled that “one of the crypt commands in early Unix (Sixth Edition, 1974)” was “based on an exact implementation of this machine”, and a variant served for a time as Unix’s password encryption (Ritchie, “Dabbling in the Cryptographic World — A Story”). (Some secondary accounts date the M-209-based routine to the Third Edition of 1973; Ritchie’s own recollection is the Sixth.) The later Seventh Edition crypt command used a different, rotor-style design, which Reeds and Peter Weinberger broke in a paper published in the Bell System Technical Journal in 1984.

Morris had already worked out by hand a way to recover the M-209’s internal settings from ciphertext with matching plaintext; it needed about 75 letters of corresponding text. He published it as “The Hagelin Cipher Machine (M-209): Reconstruction of the Internal Settings” in Cryptologia, vol. 2 no. 3, July 1978, pp. 267–289. Meanwhile James Reeds, working “sporadically but creatively” since his undergraduate years and writing mostly while at Harvard around 1971–73, had developed a quite different, statistical attack using ciphertext alone. Morris obtained Reeds’s manuscript through Louis Kruh, the collector and Cryptologia editor to whom both men had sent their work; around 1975 Ritchie wrote a program to carry Reeds’s method out. It produced readable solutions for about half of English texts longer than 2,000 letters and most of those longer than 2,500 (Ritchie).

For comparison, a simple search script written for this series (m209_attack.py, used in Volume 10) needs about as much: on ten random key lists made by the 1944 manual’s rules it recovered the full key from 75 letters of known plain text half the time and from 100 letters seven times in ten, in seconds.

The three wrote it up as “The Hagelin Cipher Machine (M-209): Cryptanalysis from Ciphertext Alone”, a Bell Laboratories technical memorandum of July 1978, submitted to Cryptologia and, as a courtesy, sent to the NSA. Then came a lunch with a man Morris described as “a retired gentleman from Virginia”. By Ritchie’s account, the visitor said that there was no legal bar to publication; that some people at the agency thought publication inevitable and harmless while others feared trouble, because the method might apply to systems still used by certain governments; that the agency did not particularly care about the M-209 itself; and — by implication that the NSA’s own results were better — that a consulting contract might be possible. The authors agreed to postpone publication, and never published. Ritchie wrote later that he did not regret it. Morris went on to become chief scientist of the NSA’s National Computer Security Center, and when Ritchie asked him about the paper near his retirement, he said publication still would not be advised.

The paper did eventually escape. In December 2015 the NSA’s museum library supplied a copy, which was posted on Cryptome, the NSA having earlier declined to release it under the Freedom of Information Act on the grounds that it was a private paper (Cryptography mailing list, 23 December 2015).

The episode is a rare documented case of the US government quietly discouraging open work on an obsolete cipher machine because its principles still mattered elsewhere. Volume 6 shows where.

5.8 Computers Finish the Job

With cheap computing, the M-209 has become a standard test-bed for classical cryptanalysis. Wayne G. Barker’s Cryptanalysis of the Hagelin Cryptograph (Aegean Park Press, 1977) set out hand methods and practice problems for a public audience. In 2016 and 2018 George Lasry, Nils Kopal and Arno Wacker published computer attacks in Cryptologia based on hill-climbing — repeatedly making small changes to a candidate key and keeping those that make the decryption look more like language. Their known-plaintext attack recovers full key settings from as few as 50 letters (“Automated Known-Plaintext Cryptanalysis of Short Hagelin M-209 Messages”, Cryptologia 40:1, 2016); their ciphertext-only attack works on messages as short as 500 letters, against the 2,000–2,500 that Reeds, Ritchie and Morris needed (“Ciphertext-only cryptanalysis of short Hagelin M-209 ciphertexts”, Cryptologia 42:6, 2018). By 2017 Lasry had used them to solve all the M-209 challenges in Barker’s book and 39 of the 40 published by the French enthusiast Jean-François Bouchaudy (Schmeh, Klausis Krypto Kolumne, March 2017).

Volume 10 runs an attack of this kind on the series’ simulator.

5.9 What the Attacks Show

Taken together, the record gives a fair verdict on the M-209.

It did what it was designed to do. Against an enemy working by hand, with a slow chain from intercept to analyst, a well-run M-209 net protected tactical messages for far longer than they stayed useful. Most US Army traffic was never read, and what was read was read late.

It failed where people failed. Almost every German success began with a depth — two messages sent from the same starting position — and the 1950 meeting traced the worst lapses to untrained replacement clerks. The US Navy, with less traffic and stricter procedure, was almost unread.

Its limits were mathematical, and knowable. The reversed-alphabet slide, the short wheel periods and the uneven distribution of key values meant that any depth, or a few dozen letters of known text, gave away a whole day’s setting, and that enough ciphertext alone would eventually do the same. The Germans saw that in theory during the war; Reeds, Ritchie and Morris made it practical on a minicomputer in the 1970s; Lasry, Kopal and Wacker reduced it to a few hundred letters.

Machinery decided the outcome. The British had Bombes for Enigma; the Germans had, at most, one relay machine for the M-209, destroyed with a pickaxe. The post-war Americans built WARLOCK.

---

Next — Volume 6: After the War — Crypto AG, the CX-52 and Operation Rubicon. Boris Hagelin leaves Sweden for Switzerland and founds Crypto AG in Zug; the C-52 and CX-52 add irregular stepping to fix the weaknesses this volume described; William Friedman and Hagelin reach a “gentleman’s agreement” in the 1950s; and in 1970 the CIA and West Germany’s BND secretly buy the company, selling deliberately weakened machines to governments around the world for decades — the operation they called Thesaurus and later Rubicon.