M-209 — Volume 7 — The Mathematics of Pins and Lugs — Period, Key Space and a Worked Encipherment

7.1 About This Volume

Volume 3 reduced the M-209 to one formula. Six guide arms read six pins; the drum counts the bars that carry a lug in front of an active arm; and the print wheel turns that count k into a cipher letter by

C = (25 − P + k) mod 26, with letters numbered A = 0 to Z = 25.

This volume works out what follows from that formula. It answers four questions. How long before the machine repeats itself? How many different keys does it have, and how many of them are really different? Why did the War Department’s key-list rules — runs of no more than six alike, 40 to 60 per cent of pins effective, lug numbers that can make every count from 1 to 27 — take the form they did? And what does a real encipherment look like, letter by letter?

All the numbers come from the unit’s simulator, 03-outputs/tools/m209_sim.py, which is checked against the 26-letter check printed in the 1944 manual and against key lists and messages from a working machine (see the file’s --selftest). The worked examples use the manual’s own training key list, transcribed in Volume 4, so they can be repeated on any correctly set M-209 or on the replica of Volumes 8 and 9.

7.2 The Machine as a Function

It helps to separate what changes from letter to letter from what stays fixed for a day.

The internal key — the pins and the lugs — is fixed for the life of a key list. The external key — the six letters at the bench mark when a message starts — is chosen afresh for each message. As the machine runs, the external key advances: every wheel moves on one pin per letter.

At letter number i of a message, wheel j (of length nⱼ) has its pin number (sⱼ + oⱼ + i) mod nⱼ in play, where sⱼ is its starting letter and oⱼ its fixed offset from the window (15, 14, 13, 12, 11, 10 for wheels 1–6; Volume 3). Call that pin’s state xⱼ(i), 1 for effective and 0 for ineffective. The drum then produces

k(i) = the number of bars with at least one lug in a lane j where xⱼ(i) = 1,

and the letter is enciphered with that k. So the machine is a function in two layers: the pins turn the letter position into a pattern of six bits, and the lugs turn the pattern into a count. Each layer has its own mathematics.

7.3 The Period: 101,405,850 Letters

The six wheels have 26, 25, 23, 21, 19 and 17 positions. Factorised:

Table 1 — The six wheels have 26, 25, 23, 21, 19 and 17 positions. Factorised

Wheel	Length	Factors
1	26	2 × 13
2	25	5 × 5
3	23	23
4	21	3 × 7
5	19	19
6	17	17

No prime appears twice, so the lengths are pairwise coprime: no two share a factor. The pattern of pins in play on all six wheels together therefore returns to its starting state only after a number of letters divisible by every length, and the smallest such number is their product:

26 × 25 × 23 × 21 × 19 × 17 = 101,405,850.

At two to four seconds per letter, an operator working without a break would take between six and twelve years to go round once. No message comes close. The simulator checks the coprimality and the product in its self-test.

7.3.1 What the period does not say

A long period is necessary but tells much less than it seems. The count k at letter i is built from six short loops, and each loop shows through. Wheel 2’s contribution to the count repeats every 25 letters, wheel 5’s every 19, whatever the other wheels are doing. The simulator makes this visible. Over 5,000 letters of the training key list from the manual’s sample wheel setting QAHNKE, the correlation between the count at one letter and the count 25 letters later is +0.44, and at 19 letters later +0.29 — while at lags that match no wheel (16, 18, 34 letters) it is within ±0.07 of zero. Wheels 2 and 5 are the two that the training key’s lugs make heavy (12 and 10 bars), so they are the two that stand out.

That is the lever every attack on the M-209 uses. Once an analyst knows the counts — from a depth, a crib or a captured plain text — he can write them out in rows of 25 or 19 and look down the columns, as the German analyst Alfred Pokorny described in 1945 (TICOM I-175, p. 7). The period protects against nothing that works one wheel at a time. Volume 10 does exactly that.

7.4 Sixty-Four Patterns, Twenty-Eight Counts

The second layer is the drum. Whatever the wheels do, the guide arms present one of only 2⁶ = 64 patterns, and the lug setting maps each pattern to a count between 0 and 27. All 27 bars, both lugs on each, matter only through this table of 64 numbers.

A useful way to describe a lug setting is the way the manual’s Appendix I does (Volume 4): by the number of bars each wheel engages. In the 1944 training key list those numbers are, for wheels 1 to 6,

2, 12, 1, 5, 10 and 3 — a total of 33.

There are only 27 bars, so 33 − 27 = 6 bars must carry two effective lugs. These are the overlaps: in the training key, bars set 3-6, 1-6, 1-5, 4-5 and twice 2-5. An overlap matters because a bar is kicked once even when both of its lugs face active arms. If wheels 2 and 5 are both active, the count is not 12 + 10 = 22 but 22 − 2 = 20, because the two 2-5 bars were counted twice.

In general, with nⱼ the bars engaged by wheel j and oᵢⱼ the bars shared by wheels i and j, the count for a set S of active wheels is

k(S) = Σ nⱼ over j in S − Σ oᵢⱼ over pairs i, j both in S.

(Because each bar has only two lugs, no bar is shared by three wheels and no higher terms appear.) The simulator’s coverage() function evaluates this for all 63 non-empty sets. For the training key the 64 patterns land on the 28 possible counts like this:

Two facts in that figure explain the Army’s rules.

Every count is reachable. The manual’s crucial rule for lug numbers was that “a single number, or the sum of any two, three, four, five, or all six of the numbers, yields all the values from 1 to 27, inclusive”, counting overlaps once (Appendix I, quoted in Volume 4). On the training key it holds: the missing-count list is empty. A careless setting fails badly. If the six wheels engage 4, 4, 4, 5, 5 and 5 bars with no overlaps, the reachable counts miss 1, 2, 3, 6, 7, 11, 16, 20, 21, 24, 25 and 26 — twelve of the 26 possible shifts never occur, and the machine is effectively enciphering with only half its alphabets. If one wheel takes 22 bars and the others one each, counts 6 to 21 are all missing. An extreme case makes the point: setting all 27 bars on wheel 1 alone gives only two counts, 0 and 27, and the simulator shows the cipher alternating between two reversed alphabets as wheel 1’s pins go by. (The manual’s own example set of numbers, 1, 2, 3, 5, 10, 12, is the training key’s set in another order.)

The counts are uneven. Even with every count reachable, some are reached by many patterns and some by one. Since each pin is effective about half the time, each of the 64 patterns turns up about equally often over a long message, and the count distribution inherits the unevenness. On 52,000 letters of the training key from QAHNKE, the simulator finds the shifts below. A perfectly flat key would give each shift 3.8 per cent; the training key gives shift 1 (counts 1 and 27 together) 8.2 per cent and shift 2 only 1.3 per cent.

The unevenness cannot be removed. With only 64 patterns spread over 28 counts, an exactly even spread is impossible; the most a key-list writer can do is avoid making it worse. That is the sense of the manual’s preference for “several small overlaps … in preference to one large overlap”: overlaps pull counts down when two heavy wheels are active together, filling in the middle of the range instead of piling patterns onto the large counts.

7.4.1 The pin rules

The pin rules attack a different problem. Appendix I tells the key-list writer to draw 78 R cards and 78 L cards from a shuffled pack, one per pin, and to rearrange any run of “more than six consecutive effective or noneffective pins on any wheel”, which keeps every wheel between about 40 and 60 per cent effective (Volume 4). In the training key list the six wheels have 12, 12, 13, 11, 10 and 8 effective pins (46, 48, 57, 52, 53 and 47 per cent) and no run longer than four.

The reason is the same short loop. If wheel 2 had a run of nine effective pins, its twelve bars would be in play for nine letters in a row every 25 letters, and the counts in those nine columns would sit high together — exactly the structure an analyst looks for. A wheel with almost all pins effective, or almost none, contributes almost a constant, which wastes its lugs and makes the remaining wheels easier to isolate.

The simulator’s tm_key() function makes key lists by these rules — pins from a shuffled pack of 78 R and 78 L with long runs broken, lug numbers 1, 2, 3, 5, 10, 12 in random order with the six overlaps spread across different pairs, rejected and redrawn until every count from 1 to 27 is reachable. The unit’s demonstration key list, used in Volumes 9 and 10 under the indicator QX, is tm_key(seed=1944).

7.5 How Big Is the Key?

Counting naively, there are three parts.

• Pins. Each of 131 pins is left or right: 2¹³¹ ≈ 2.7 × 10³⁹ settings, or 131 bits.
• Lugs. Only the multiset of bars matters, because the drum’s effect does not depend on which bar is which. Each bar is one of 22 kinds — no effective lug, one lug on one of 6 wheels, or two lugs on one of the 15 pairs — and 27 bars drawn from 22 kinds with repetition can be chosen in C(48, 27) ≈ 2.2 × 10¹³ ways, about 44 bits.
• Wheel start. 101,405,850 starting positions, about 27 bits — and sent in the indicator, so not secret against anyone who can read the procedure (Volume 10).

About 175 bits of internal key, then, and a figure like that is sometimes quoted as if it made the M-209 strong. It does not, for three reasons.

Many keys are the same key. The drum’s whole effect is the table of 64 counts, and very different bar lists give the same table. Moving an overlap from one pair of light wheels to another can leave most counts unchanged; a key with one wheel engaging no bars at all makes that wheel’s 17 to 26 pins irrelevant. The number of distinct, useful drum settings is far smaller than 2⁴⁴.

The rules shrink it further. A key list made by Appendix I has 40–60 per cent effective pins with no long runs, and lug numbers from a printed table of approved sets. That removes the weakest keys, which is the point, but it also removes most of the key space.

The pieces can be attacked separately. This is the decisive one. An attack does not have to search 175 bits at once. Given the counts, each wheel’s pins can be estimated from its own columns, which is 17 to 26 bits at a time; given the pins, the drum is a small search. Known-plaintext attacks need only tens of letters: Robert Morris’s hand method of 1978 needed about 75, and the hill-climbing attack of George Lasry, Nils Kopal and Arno Wacker about 50 (Lasry, Kopal and Wacker, Cryptologia 40(1), 2016). The unit’s own attack script recovers a demonstration key exactly from 75 letters of known text in under a second, and from 60 letters gets all but one pin (Volume 10). Ciphertext-only attacks need far more: Reeds, Ritchie and Morris’s 1978 method needed 2,000 to 2,500 letters, and Lasry and colleagues’ 2018 method about 500 (Volume 5).

The honest summary is the manual’s own: systems using the converter “can be solved, especially if a large volume of traffic is enciphered without changing the arrangement of the keying elements” (TM 11-380, par. 7c). The size of the key bought time, not security.

7.6 A Worked Encipherment

The 1944 manual teaches encipherment with the message REINFORCEMENTS URGENTLY NEEDED (par. 10c) and illustrates the message indicator with the wheel setting QAHNKE (par. 9c). It never prints the resulting cipher text. With the manual’s training key list set, the wheels at QAHNKE, the counter zeroized and the knob at C, the operator enciphers R, E, I, N, F, O, R, C, E, M, E, N, T, S, then Z for the space, U, R, G, E, N, T, L, Y, Z, N, E, E, D, E, D: thirty letters.

m209_sim.py traces each one. For every letter it shows the six letters in the windows, the six pins in play (the window letters moved on by 15, 14, 13, 12, 11 and 10), which of those pins are effective in the training key, the count k, and the result:

Table 2 — m209sim.py traces each one. For every letter it shows the six letters in the windows, the six pins in play (the window letters moved on by 15, 14, 13, 12, 11 and 10), which of those pins are effective in the training key, the count k, and the result

#	Window	Pins in play	Effective on wheels	k	Plain	Cipher
1	QAHNKE	FOUECO	2, 3, 4, 6	20	R	C
2	RBIOLF	GPVFDP	4, 5	14	E	J
3	SCJPMG	HQXGEQ	1, 3, 5, 6	13	I	E
4	TDKQNH	IRAHFA	all six	27	N	N
5	UELROI	JSBIGB	2, 3, 4, 6	20	F	O
6	VFMSPJ	KTCJHC	1, 5	11	O	W
7	WGNTQK	LUDKID	2, 5, 6	23	R	F
8	XHOURL	MVELJE	1	2	C	Z
9	YIPASM	NXFMKF	1, 2, 4	19	E	O
10	ZJQBAN	OYGNLG	3, 4	6	M	T
11	AKRCBO	PZHOMH	3, 5, 6	13	E	I
12	BLSDCP	QAIPNI	2, 4, 5	24	N	K

Three rows repay a closer look.

• Letter 1. Wheels 2, 3, 4 and 6 are active, as in the 26-letter check of Volume 3, and again 20 bars are kicked. R is letter 17; 25 − 17 + 20 = 28, and 28 mod 26 = 2, which is C.
• Letter 4. All six wheels are active, so every bar with any effective lug is kicked — all 27. A count of 27 acts as a shift of 1: 25 − 13 + 27 = 39, mod 26 = 13, which is N. N enciphers to N. Unlike the Enigma, which can never encipher a letter to itself, the M-209 does so whenever the count makes 25 − P + k ≡ P, and nothing in the machine prevents it.
• Letter 8. Only wheel 1 is active, and wheel 1 engages only two bars (1-5 and 1-6), so k = 2. A wheel with few lugs makes small, rare contributions; its pins are the hardest to recover in an attack, and also the least important to get right.

Rows 1 and 5 show the same count, 20, from the same four wheels; rows 3 and 11 give 13 from different patterns. The plain E at letters 2, 9 and 11 comes out J, O and I. The whole message, as it would come off the tape in groups:

CJENO WFZOT IKHUU XZJFU DPBDB UWZJV

Thirty letters make exactly six groups, so no X’s are needed; had the last group been short, the operator would have added X’s in pencil, not enciphered them (par. 10c(7)). Deciphering — the same wheels set to QAHNKE, the knob at D, the cipher letters dialled one by one — gives REINFORCEMENTS URGENTLY NEEDED, with the two Z’s printed as spaces. That pair of tapes is acceptance test T3 and T4 for the replica in Volume 9.

7.6.1 Doing it at home

The trace is reproducible with the simulator’s command line. With the training key saved as JSON (the lugs and pins are in the simulator, as TM_KEY, and in Volume 4):

python3 m209_sim.py --key tm.json --start QAHNKE --trace "REINFORCEMENTS URGENTLY NEEDED"
python3 m209_sim.py --key tm.json --start QAHNKE --encrypt "REINFORCEMENTS URGENTLY NEEDED"
python3 m209_sim.py --key tm.json --start QAHNKE --decrypt "CJENO WFZOT IKHUU XZJFU DPBDB UWZJV"

7.7 The Algebra of a Depth

One more piece of arithmetic underlies Volumes 5 and 10. Suppose two messages are enciphered on the same key from the same starting position — a depth. At every letter the two machines are at the same count k, so

C₁ = 25 − P₁ + k and C₂ = 25 − P₂ + k (mod 26),

and subtracting,

C₁ − C₂ = P₂ − P₁ (mod 26).

The count, and with it every pin and lug, has vanished. What remains is a relation between the two plain texts alone, and any guessed word in one message turns directly into letters of the other. Volume 5 shows the same calculation for a pair of field messages; Volume 10 uses it to break a day’s traffic. The same algebra also explains why the manual forbade enciphering the X’s that pad the last group: an operator who habitually ended messages with enciphered XXXX handed the enemy four letters of known plain text, and with them four counts.

7.8 What the Numbers Mean

The mathematics of the M-209 splits cleanly in two. The wheel layer is a combination of six short, independent loops whose product is enormous but whose parts are each small enough to attack one at a time. The drum layer is a fixed table of 64 counts, chosen by the key-list writer, which can be good or bad but can never be flat. The War Department’s rules for key lists are an accurate response to both: they keep each loop irregular and each table complete. What no rule could do was hide the loops. Any stretch of known counts — and every depth, every crib and every stereotyped message supplied one — lets the analyst write the counts in rows of 17 to 26 and start reading pins.

---

Next — Volume 8: Building an M-209 — Design and Printing. What open designs exist, why there is no printable M-209 to download, and a design for one: key wheels that grip steel pins, a drum of 27 bars with dowel lugs, a typewheel driven by kicked bars, and the materials, fasteners and printer settings to make it.