SIGABA — Volume 12 — Running SIGABA — Setting a Key, a Worked Message, and an Attack Demo

12.1 About This Volume

This is the last volume of the series and the one in which the machine is used. It runs a SIGABA through a day’s work exactly as the Navy’s 1944 manual, CSP 1100(C), tells an operator to: setting up from the key list, proving the setup with the 26-30 letter check, enciphering a message by the joint Army-Navy method, deciphering it at the other end, and doing the same by the Navy’s own general method with its numeral keys. It then shows what goes wrong when an operator or a machine errs, and closes with a small attack that shows, in nine seconds of computing, both how strong the machine was and where its strength really lay.

Every letter comes from the unit’s simulator, 03-outputs/tools/sigaba_sim.py, and every one of them can be reproduced on the replica of Volumes 10 and 11; the commands are given so that the two can be compared. The procedures themselves are described historically in Volume 5; this volume runs them.

12.2 The Day’s Key

A SIGABA key list gave each day’s key setting on a printed form (par. 303; par. 317 for the joint form). The demonstration key list of this unit follows the joint form:

Table 1 — A SIGABA key list gave each day's key setting on a printed form (par. 303; par. 317 for the joint form). The demonstration key list of this unit follows the joint form

Line	Setting	Meaning
Cip/Alp	0 - 1R - 2 - 3 - 4R	code wheels for the Alphabet Maze, left to right; R = reversed
Con/Stp	5 - 6 - 7R - 8 - 9	code wheels for the Stepping Maze, left to right
SEC	18-26-33-43-51, check RNDPS	index setting for SECRET messages, and its 26-30 letter check
CON	15-24-31-47-52, check ZJRBA	index setting for CONFIDENTIAL messages, and its check
Initial Alignment	WFHAD	used only by the joint method
External indicators	SEC: VELUM; CON: GABRO	invented for this example

The code wheels are the simulated set every published simulator uses, and the index wheels are the Pampanito machine’s (Volumes 3 and 4). The SECRET index setting is the one CSP 1100(C) uses for its stepping check (par. 519).

12.3 Setting Up

Following CSP 1100(C) paras 305-308:

1. Code-wheel arrangement. Lift out the cipher unit, pull the spindles, and drop in wheels 0, 1, 2, 3 and 4 at the back, with 1 and 4 upside down; then 5, 6, 7, 8 and 9 in the middle row, with 7 upside down. Refit the spindles and the unit.
2. Index setting. For a SECRET message, turn the index wheels to 18, 26, 33, 43 and 51: wheel 10 to 8, wheel 20 to 6, and so on. “BE SURE THE INDEX WHEELS ARE IN EXACT ALIGNMENT” (par. 306(b)).
3. Zeroize. Controller at R, zeroizer at Zeroize, hold RPT and BLANK until every code wheel stops at O.
4. 26-30 letter check. Zeroizer at Operate, controller at E, counter to zero. Step 25 times with BLANK, then encipher A five times. On the demonstration key the machine prints RNDPS, matching the key list. Enciphering thirty A’s instead, as the Army’s later instructions had it (Volume 5), prints

USUJO BFQPE AMPAS UJKRY OZQZP RNDPS

with the same last group, because BLANK steps the wheels exactly as a letter does. (sigaba_sim.py --check, or --encrypt with thirty A’s after --align OOOOO.)

The check is now known to be right. It proved three things at once: that the wheels are the right ones in the right places, that the index wheels are set as the key list says, and that the machine is working (par. 308(a)).

12.4 A Message by the Joint Army-Navy Method

The joint method was the Army’s, used for all joint Army-Navy traffic (par. 316). Both mazes of code wheels are aligned by hand to the same five letters, and the message’s own five letters are sent only in enciphered form. The steps of par. 319, with the demonstration key and the message ARRIVE PEARL ZERO NINE HUNDRED:

(c) Heading. Controller to P. Type the heading and date-time group, NR 3 031410Z, and the external indicator for a SECRET message on this channel, VELUM.

(d) Initial alignment. Controller to E. Turn all ten code wheels by hand to the Initial Alignment from the key list, W F H A D: both the Alphabet Maze and the Stepping Maze read WFHAD.

(e) Choose the message alignment. Five letters at random, never O or Z, never a pattern: K M T B R. The manual’s caution is in capitals: “THE MESSAGE CODE WHEEL ALIGNMENT FOR EACH MESSAGE ENCIPHERED BY A PARTICULAR KEY SETTING MUST BE DIFFERENT.”

(f) Encipher it. Type KMTBR at E. The machine prints GAUNW: the internal indicator. The simulator’s log of those five cycles:

Table 2 — (f) Encipher it. Type KMTBR at E. The machine prints GAUNW: the internal indicator. The simulator's log of those five cycles

Count	Key	Prints	Cipher wheels stepped
1	K	G	2 4 5
2	M	A	1 3 4 5
3	T	U	1 3
4	B	N	2 3 4
5	R	W	1 3 4

(g) Message alignment. Turn all ten code wheels by hand to K M T B R. (h) Reset the counter.

(i) Encipher the text. Type the message with its spaces. The machine enciphers each space as Z and the Z of ZERO as X (Volume 3), and prints thirty letters in six groups:

YQAHT ZGDUM EFVWF HCFHN KLNSG LMCGO

The first letters, from the log (sigaba_sim.py --align KMTBR --log "ARRIVE PEARL ZERO NINE HUNDRED"):

Table 3 — The first letters, from the log (sigabasim.py --align KMTBR --log "ARRIVE PEARL ZERO NINE HUNDRED")

Count	Key	Machine enciphers	Prints	Cipher wheels stepped
1	A	A	Y	1 2 4 5
2	R	R	Q	1 3 4 5
3	R	R	A	1 2 4 5
4	I	I	H	1 2 3
5	V	V	T	3 4 5
6	E	E	Z	1 3
7	space	Z	G	3 4
8	P	P	D	1 2 4

The two R’s of ARRIVE encipher to Q and A, and the cipher Z in the sixth place stands for E: nothing of the plain text’s shape survives. Volume 4 traces the first letter of this message, A to Y, wire by wire.

(j) Fill the last group. The counter reads 30, a multiple of five, so no X’s are needed; otherwise the operator would switch to P and type X’s to fill the group.

(k) Check the indicator. Align both mazes to WFHAD again and encipher KMTBR. It must print GAUNW again.

(l) Close. At P, type the internal indicator GAUNW and the external indicator VELUM. Tear off the tape.

Before it went out, the message had to be check-deciphered, “preferably by another coding officer, and if possible, on a second machine using a different set of Code Wheels”: “THE CHECK-DECIPHERMENT IS MANDATORY” (par. 314).

12.5 Deciphering It

The receiving operator sees VELUM, knows from it the channel and that the message is SECRET, and follows par. 321:

1. Arrange the wheels from the key list and set the index wheels to the SECRET setting, 18-26-33-43-51. Make the 26-30 check: RNDPS.
2. Controller to D. Align both mazes by hand to the Initial Alignment, WFHAD, and type the internal indicator GAUNW. The machine prints KMTBR. That strip of tape is cut off and burned: “These five letters must be destroyed after use and must not appear on the delivery copy of the message” (par. 321(e)).
3. Align both mazes by hand to KMTBR, reset the counter, and type the cipher text, ignoring the gaps between groups. The machine prints

ARRIVE PEARL XERO NINE HUNDRED

with the word spaces restored and ZERO spelt XERO, as the manual promised it would be (par. 212).

(sigaba_sim.py --align KMTBR --decrypt "YQAHT ZGDUM EFVWF HCFHN KLNSG LMCGO"; and --initial WFHAD --message-align KMTBR --encrypt "..." does the sending side in one command.)

12.6 The Navy Method

The Navy’s general method of 1944 does not hand-align anything. The operator zeroizes and sets the Stepping Maze with the numeral keys, and the Alphabet Maze follows wherever the stepping takes it (paras 309-313; Volume 4 explains the mechanism). For a message on the same key:

1. Make the 26-30 check, then zeroize again.
2. Choose five letters at random for the code wheel alignment, say H Q D L A.
3. Controller to R, zeroizer at Operate. Press key 1 until Stepping-Maze wheel 1 reads H, key 2 until wheel 2 reads Q, and so on, in that order and without overshooting: “If any Code Wheel is stepped past the correct letter … the entire process must be re-commenced from the zeroize position” (par. 309(c)(2)). On the demonstration key this takes 63 presses. Wheel 3 is reversed, so it counts up from O to D the long way round.
4. Look at the Alphabet Maze. It reads YEZAX, a position nobody chose. If it still read OOOOO, the stepping circuits would be dead and the machine must not be used (par. 309(c)(4)).
5. At P, type the heading, the external indicator VELUM and the internal indicator HQDLA, in the clear. Reset the counter.
6. At E, type CONVOY SAILS AT DAWN. The machine prints

RMTTT UZUQK TRVCU VRDIX

7. At P, type HQDLA and VELUM.

The receiver zeroizes, steps the Stepping Maze to HQDLA with the numeral keys, which leaves the Alphabet Maze at YEZAX exactly as it left the sender’s, and deciphers. (sigaba_sim.py --navy-align HQDLA --encrypt "CONVOY SAILS AT DAWN".)

The two methods make an instructive contrast. The Navy method sent the Stepping Maze’s setting in the clear and relied on the wheel set and the day’s key to hide the Alphabet Maze’s. The joint method enciphered the alignment, at the price of a key-list entry, the Initial Alignment, that every message of the day shared. In both, the secrecy of the wheels and the key list was everything; Volume 8 explains why that was enough.

12.7 When Things Go Wrong

The manual devotes paragraphs to garbles, and the simulator shows why each kind matters differently. All of these use the joint-method message above.

A wrong cipher letter. If the tenth cipher letter is received as A instead of M, the decipherment reads ARRIVE PEURL XERO NINE HUNDRED: one wrong letter, nothing else. The stepping of the SIGABA does not depend on the text at all, so a corrupted letter corrupts only itself. A clerk can usually see what the word should be.

A lost letter. If the tenth letter is dropped in transmission, the decipherment reads ARRIVE PERLVRRIVAELCDKDMIQXWX: the A of PEARL is gone, and from the gap on every letter is deciphered at the wrong step; the R and L that follow are right only by chance, and the spaces vanish. An extra letter does the same: ARRIVE PE, then GMMBKAAUXX SCFYHDFPJCR. The cure is to find the gap, which the garbled text after it shows to within a letter, and decipher again from there with the machine stepped once with BLANK, or once less.

A wrong index setting. Deciphered with the CONFIDENTIAL setting instead of the SECRET one, the message reads ANQCAYBMBIFDUPCGQRYMUVQLFBHORW: no spaces at all, because the cipher Z’s no longer fall on plain spaces. The first letter, A, is right, because the first letter is enciphered before any stepping and the Alphabet Maze is the same; everything after is wrong.

An index wheel set half-way. No stepping current reaches any magnet; the Alphabet Maze never moves; and the machine becomes a single substitution alphabet. The same message comes out as

YXXEL ZCMZY XGCVZ XTCBE BZCRJ BNXZN

in which both R’s are X, both A’s are Y and every E is Z: a cryptogram for a newspaper puzzle page. This is the failure CSP 1100(C) feared most, and why its 26-30 check, which would have printed five alike letters (UUUUU on this key), was mandatory, and why an operator was forbidden ever to accept it (par. 308(d); Volume 5).

12.8 An Attack in Nine Seconds

Volume 8 described the modern attacks on the SIGABA. This one, sigaba_attack.py --demo, is small enough to run in seconds on a desktop computer, and it shows the same idea they use.

The situation. The attacker has captured a machine with its ten code wheels and the day’s key-list page, which gives the arrangement and the index setting but not the Message Code Wheel Alignment of a particular joint-method message. The attacker has its cipher text and a crib: the message is known to begin ENEMY CONVOY. The unknown is one five-letter alignment, applied to both mazes: 26^5 = 11,881,376 possibilities.

Step 1: meet in the middle on the first letter. The first letter is enciphered before any wheel moves, so it passes straight through the five Alphabet-Maze wheels at the alignment. Instead of trying all 11.9 million alignments, the program pushes the known plain letter E forward through wheels 1 and 2 at all 676 combinations of their positions, pulls the known cipher letter backward through wheels 5 and 4 at all 676 of theirs into a lookup table, and joins the two through wheel 3’s 26 positions. That lists exactly the alignments that encipher the first letter correctly: 456,287 of them, in a fraction of a second.

Step 2: run the survivors through the whole machine. Each survivor is set up as a full machine, Stepping and Index Mazes included, and run against the rest of the crib. About one in 26 survives each letter:

Table 4 — Step 2: run the survivors through the whole machine. Each survivor is set up as a full machine, Stepping and Index Mazes included, and run against the rest of the crib. About one in 26 survives each letter

Crib letters used	Alignments left
0	11,881,376
1	456,287
2	17,412
3	641
4	36
5	3
6	1

After six letters one alignment is left, NJHUJ, which is the one used, and the intercept deciphers to ENEMY CONVOY SIGHTED OFF SAMAR AT DAWN STOP COURSE NORTH. The whole run took 8.7 seconds of pure Python.

What it shows. The first step is a meet-in-the-middle on the cipher wheels alone, the same idea as Lasry’s attack on the full machine (Volume 8), shrunk to one letter: splitting a problem where the machine’s structure allows it turns a product of possibilities into a sum. The second step shows how quickly a correct crib kills wrong keys: each letter divides the candidates by about 26.

What it does not show. The attack works only because the key list has given away almost everything. Take away the wheel arrangement and index setting, and the unknowns become the 2^95.6 of Volume 8, of which this demonstration searched about 2^23.5. Take away the wirings, as the war took them away from every Axis cryptanalyst, and there is no method at all. The SIGABA’s real defence was never just its fifteen wheels; it was fifteen wheels, a key list and a set of wirings that never left American and British hands. The demonstration needs all three, and the enemy never had any of them.

12.9 Running the Replica: A Checklist

For each day:

1. Wheels into the basket from the key list; index wheels to the classification’s setting.
2. Zeroize; 26-30 check; it must match the key list, and must never be five alike letters.
3. For each message: a new random alignment with no O or Z; heading and external indicator at P; joint method or Navy method as the channel requires; text at E; fill the last group; indicators at the end; check-decipher before sending.
4. For each received message: index setting from the external indicator; 26-30 check; alignment from the internal indicator; decipher at D; destroy the alignment strip.
5. At the end of the day, zeroize, lift out the cipher unit and lock it away separately from the machine and the key list, as Volume 6 describes.

The replica’s USB log can be compared with the simulator at any time; a disagreement is always a fault in the replica, a wheel or a setting, and Volume 11’s fault table says where to look.

12.10 The End of the Series

The SIGABA story ends here, at a desk, with a machine that types a message nobody else can read. It began in Volume 1 with the same claim made about the real thing: the American Big Machine that German codebreakers studied and set aside “as unprofitable”, the one major cipher machine of the Second World War that no enemy is known to have read. The volumes between have shown how Friedman and Rowlett’s stepping maze and Safford’s engineering made that possible, how ten thousand machines were built, keyed, guarded and finally destroyed, and why, more than eighty years after the first was delivered, it takes a modern computer, a crib and the wheel wirings to do what the Axis never could.

Sources

• US Navy, ECM Operating Instructions, CSP 1100(C), 16 May 1944, paras 303-321, 327-330: maritime.org/doc/crypto/ecm.
• Richard Pekelney, “Electronic Cipher Machine (ECM) Mark II”, keying procedures: maritime.org/tech/ecm2.htm.
• George Lasry, “A Practical Meet-in-the-Middle Attack on SIGABA”, HistoCrypt 2019: ep.liu.se/ecp/158/005 (Library copy).
• The unit’s tools: 03-outputs/tools/sigaba_sim.py and sigaba_attack.py.

---

Back to Volume 1: The Machine That Was Never Broken. Start again from the beginning: what the SIGABA was, who made it, and why fifteen wheels in three banks kept the highest secrets of the Second World War.