Harold Thimbleby*

Gresham Professor ofGeometry

Gresham CollegeBarnard’s Inn Hall

HolbornLONDON, EC1N 2HH

* Address forcorrespondence:

UCLIC, UCL InteractionCentre, 26 Bedford Way,

LONDON, WC1.

Abstract

This article describes a simplifiedcryptographic machine, based closely on theWorld War II Enigma. This ‘reduced Enigma’exposes some of the design flaws of the originalEnigma in a new way. Had the Axis powersbuilt a reduced Enigma, the outcome of thewar might have been different.

A fully working reduced Enigma has beenused very successfully in numerous publiclectures, in school talks, and in universityseminars. Hands-on demonstrations of thereduced Enigma dramatically brings aliveideas about design, codes, permutations andgroups. As a working trapdoor function, thereduced Enigma also provides an unusuallyclear introduction to public key cryptography.This article provides background information,lecture suggestions, and details for building it.

Keywords: Education, Enigma, PublicUnderstanding of Cryptography, “reducedEnigma”

Introduction

Cryptography is a fascinating subject. Theparadoxical concept of “sharing secrets” has anatural appeal, and can be used as a motivationto discuss history, mathematics and computerscience, or to help motivate many conceptssuch as key distribution, public keycryptography and digital signatures. This paperdescribes a simple cryptographic machine,closely based on the World War II Enigma: themachine has been used very successfully inlectures, both to public and school audiences,and to researchers. Design details for asimplified Engima are given, as well as relevanthistorical and technical context, particularly ashighlighted through the simplified design. Thispaper, then, should be of equal interest to

readers interested in cryptography and tolecturers who wish to communicate the ideasclearly, particularly with hands-on participation.

Any good lecture provides ideas that atdifferent points draw the attention of differentmembers of the audience. The Enigma providesan endless source of historical interest,mathematical interest, human factors interest,and so on. It is highly suitable for mixedaudiences, typified by grandparents bringingalong enthusiastic grandchildren! Likewise, butdue to limitations of space rather than time,this paper, too, raises tantalising issues (e.g.,Where do some of the numbers come from?What about different versions of the Enigma?What did people, on both sides, learn as thewar progressed?) and numerous fascinatingpotential discursions (e.g., What did AlanTuring contribute? How do we do things bettertoday? What about public keys?) that willstimulate the reader — or an audience — intounlimited further activity and reflection.Elsewhere we have discussed how to introducethe underlying cryptographic concepts toaudiences of any age or skill, from schoolchildren to postgraduate specialists: see Bell etal., 2002.

However, the main point for the present that isconveyed, and that should be conveyed forciblyto all programmers and system developers, isthat complex systems — particularly onesinvolving any interaction or human element —are hard to design to be effective and reliableunder the pressures of real use, and one shouldfirst build simplified systems to fully understandthe principles. In an hour’s typical lecture, thereduced Enigma can illustrate dramaticweaknesses in the real Enigma.

Mechanical devices are ideal for lectures.Unlike computer programs, you can see howthey work, and using them allows participants

624

The reduced Enigma

Computers & Security Vol 22, No 7, pp624-642, 2003Copyright ©2003 Elsevier LtdPrinted in Great BritainAll rights reserved0167-4048/03

to attempt more interesting activities than canbe done purely manually. With cryptography, wehave the added advantage that for an excitingand important period of history, the real devicesin life-and-death use were mechanical too.Alfred Scherbius was one of many people in theearly twentieth century to patent the basic ideaof a mechanical or electromechanical codemachine based on rotors. There were manydesigns and developments, but the most widely-known of these devices was the Enigma. TheEnigma was used extensively by the Germansduring the Second World War.

Original WWII Enigmas are now valuableantiques, and rebuilding an accurate Enigma is acomplex job and one that anyway creates a codethat is hard to explain in lectures. Yet in prin-ciple, an Enigma is ideal for explaining impor-tant concepts, such as key distribution problems,since it is easy enough to change keys and, ofcourse, codes using any key work automatically.

What, then, is the simplest Enigma that can bemade?

What is the simplest Enigma?

Scherbius’s Enigma had a 26 button keyboard(with no space button) and 26 correspondinglight bulbs. Briefly, a plugboard and a set ofrotors mess up the wiring, so that as buttons arepressed one of the 26 light bulbs come on inturn, but not in any obvious order. Theplugboard settings and initial rotor settingsrepresent the key, and another Enigma with thesame settings (and internal construction) candecode the message. There were lots of versionsof Enigmas; for example the pre-war commercialones did not have a plugboard. During the war,the Enigma and the procedures for using wereunder continual development; although theGermans were aware of some of the weaknesseswe shall describe, no Enigma consolidated thebest features of the different versions into asingle machine. Rather than consider all thecomplications and variations, what is thesimplest Engima style machine that works?

The reduced Enigma

Harold Thimbleby

625

Figure 1. A German army Enigma in use. Here, pressing S lights up N. The three rotors are just visible under thecover at the top; the plug board is partly covered at the bottom.

Figure 2. Close up of the three rotors. A row of lamps and some of the internal wiring is visible, as well as theswitch connections. The rotors of this Army Enigma are set numerically, rather than by using letters. This wouldhelp ensure that settings were chosen randomly.

One might think that the simplest Enigmawould have two buttons, labelled in binary as 0and 1. Its two light bulbs would also be labelled0 and 1. When an operator types out a binarymessage, say, 01011001… the lights wouldperhaps code it as 11001010… This is clearlythe simplest scheme inspired by the Enigma.Unfortunately, because of their design, anEngima with only two buttons would have adisastrous property: 0 would always code as 1,and 1 always code as 0 — hardly a code. Theproblem arises due to the Enigma’s wiring, but isusually explained more simply: no letter cancode as itself. This property of the real Enigmawas one of its main weaknesses. Had Scherbiusmade a reduced Enigma first, he would certainlyhave spotted the problem. Instead he went for26 letters straight away,1 and hence disguisedthe flaw in a layer of complexity. He and otherdevelopers fell for the classic trap of making acomplication illusoire. Just making codes morecomplex rarely makes them harder to solve.

We will see below that this problem of theEnigma design is not the only one that areduced Enigma exposes.

Figure 4 shows an Enigma circuit taken from aGerman navy manual. It is easiest to follow thewiring from the battery connection + on theright of the diagram. Suppose the Y button ispressed. Current is connected (along the solidwire at the far left) up to the rotors. The threerotors make a ‘random’ connection through tothe reflector, and then back, where the circuitcontinues in the dashed wire (emerging fromthe rotors at the top right). The return wireconnects (in this case) to the Z button’s switch,where it is connected through to the Z lamp.All lamps have a common return to the -(negative) battery connection. So for theserotor positions, if Y is pressed Z lights; and if Zis pressed Y lights.

626

The reduced Enigma

Harold Thimbleby

Figure 3. Close up of the Enigma plugboard, showing 9 connections. Note that the plugs and sockets aresymmetric and can be inserted incorrectly.

1 The Scherbius patent also describes a simpler, but stillcomplex, Enigma design that used 10 digits rather than 26letters. His patent also illustrates using multiple rotors, upto 10.

Figure 4. Part of the Enigma circuit, from a German navy manual (from Kahn, 1996b). The diagram shows threerotors at the top, with a reflector on the far left and a contact wheel on the right. In the middle, connected tothe – battery terminal, are two (of the 26) lights; at the bottom (connected to the + battery terminal) are twoof the key switches.

In actual operation, when a button is pressedthe rotors turn, and the particular connection ofY→Z and Z→Y might not be repeated for avery long time. Of course if Y and Z are theonly buttons, whatever the rotors do in detail,ultimately they cannot connect them any otherway than together: which, as we’ve seen isdegenerate. The German navy manual shows aworthless Enigma!

In general the Enigma wiring ensures that noletter can code as itself. The button Y (forexample) either connects to the + batteryterminal or to the Y lamp. If the Y button ispressed, the Y lamp cannot come on. The sameis true for all 26 letters.

This, the Engima’s major weakness that noletter can code as itself, facilitates codebreaking. If a crib (a suspected word in theplaintext) is slid along a ciphertext, if no letterscorrespond anywhere, then the crib is a possibledecrypt at that point. A good crib might beHEILXHITLER, not least because it was saidoften, but because it has a pattern of several Hsand Es and Is.

Exploiting this weakness, the Britishcryptanalysts at Bletchley Park, developingoriginal Polish work, built a machine, theBombe, that automatically looked for possibledecodings. A Bombe would typically findseveral possible Enigma settings that couldpossibly code a message containing (say)HEILXHITLER, and a room full of Enigmaoperators would work through the possiblesettings systematically until the message wassuccessfully decoded. Using a reduced Enigmahelps explain this issue to an audience: it ispossible to press one button repeatedly andeasily see its corresponding lamp never lightsup; on a real Enigma, with 26 lamps flashing, itis impractical to see that a particular lampnever lights.

Why does the Enigma have this property? Thesimple wiring of the Enigma ensures the code isreciprocal: if Y codes as Z, in the same setting,

Z codes as Y. An Enigma set up with the rotasin the same position can be used either to code or decode, and this has practicaladvantages. In fact, the Enigma could havebeen designed to be reciprocal without thisproblem (see Appendix 5), but the problemwas not noticed.

Since every letter on the Enigma is coded asanother letter, it might seem possible to build areduced Enigma with three buttons and threelights. Suppose the buttons are XYZ. There arethen just two possible codes: {X→Y, Y→Z,Z→X} or {X→Z, Y→X, Z→Y}. But the Enigmawas also designed to be reciprocal, so that withthe same key settings it could be used to bothcode and decode messages. With three keys thisis not possible. Suppose X codes as Y, then atthe same setting Y should code to Z, not to X.Instead, the Enigma should code so that if Xcodes as Y, then Y codes as X. This reciprocalrelation must be true for any pair of letters, andtherefore an Enigma must have an even numberof letters. The real Enigma had 26 buttons, andin consequence X was used to double up as aspace. (There are reciprocal codes with threeletters that do work, but which the Enigmawiring can’t handle: for instance {X→Y, Y→X,Z↔Z} which doesn’t work because Z→Z codesone letter onto itself.)

The simplest Enigma must have 4 buttons and 4lights.

The reduced Enigma

Figure 5 shows the reduced Enigma, which isbuilt in a transparent box so its workings can beseen. Table 1 compares the construction of thereduced Enigma with a typical real Enigma.Table 2 examines the complexities of thereduced Enigma. The essential wiring exactlymirrors the real Enigma’s. (Appendix 4 givesthe circuit diagrams.)

Instead of rotors, a uniselector is used: unusedand second-hand uniselectors can be obtainedfairly easily, whereas rotors are hard to make

The reduced Enigma

Harold Thimbleby

627

Harold Thimbleby

Harold Thimbleby is GreshamProfessor of Geometry, and aRoyal Society WolfsonResearch Merit Award Holder.He is Director of UCLIC, theUCL Interaction Centre, amultidisciplinary centre atUniversity College London.He is particularly interestedin the human understandingof computers and complexsystems, whether to usethem more effectively andenjoyably or to understandthem in a more technicalsense – rather than beuncritical and passiveconsumers of the latestproducts. He gives manypublic and schools lectures.See http://www.uclic.ucl.ac.uk/harold for moreinformation.

(although during the war they would have beeneasier to mass produce than wiring-upuniselectors). Uniselectors are electricallyoperated switches: sending an electrical pulse totheir coil changes their connections. AlthoughEnigma rotors changed their connections bymechanical rotation caused by the operatorpressing buttons, uniselectors can be used tosimulate them, just provided every button hasan extra wire to control them. In fact,uniselectors were standard parts of earlyautomatic telephone exchanges, and were alsoused at Bletchley Park in the “Tunny,” asimulator for the German Lorentz codemachine.

The uniselector in the reduced Enigma can beseen working through the Enigma’s transparentcover, and it makes a very satisfying clunkysound as the reduced Enigma is used. Theuniselector chosen gives a maximum key lengthof 50, and it can be wired arbitrarily over thewhole length of the key (which rotors cannotbe). The reduced Enigma was wired toaccurately simulate two 4-way rotors over itsfirst 16 positions, and the remaining 34positions are random — though it would havebeen preferably if the uniselector had had a keylength of 64 = 43, which would have allowedsimulating three rotors correctly.

Reduced Enigma controls

The knobs (bottom left of Figure 5) set theinitial rotor positions; pressing the bottom redbutton resets the reduced Enigma to any of thepossible 16 key settings.

The remaining control switch (at the bottomright of Figure 5) selects four choices of keylength: both rotors locked (a key length of 1,which is useful for demonstration purposes), onerotor locked (a key length of 4), both rotate (akey length of 16), or — for fun rather thanaccurate simulation — all positions of theuniselector are used, giving, for this reducedEnigma, its maximum key length of 50. (Therandom wiring of the 34 extra positions waschosen to nearly balance the frequencies ofeach code.)

The reduced plugboard

The wires from the 4 buttons go to a plugboard,which works just like the Enigma’s, to mix upthe wiring. A wire plugged between any twosockets swaps the original connections.

The real Enigma has 26 sockets, and hence upto 13 wires. For practical reasons usually only 6pairs of plugboard connections were made,though the number used increased during thewar. The real Enigma used two-pin plugs for theplugboard; the reduced Enigma uses standardjack plugs, which can only be inserted one wayround.

Given there are 4 sockets on the reducedEnigma, one might think that there are 4!=24ways of mixing up its four wires and that thereshould ‘obviously’ be 4! reflectors. Similararguments have been made in the publishedliterature for the real Enigma, where largenumbers (26!≈1027) are reportedunquestionably.

Drawing diagrams of 26 crossed wires is quiteimpractical, but the reduced Enigma is smallenough for erroneous thinking to be made moreobvious. Four sockets and two connector cables

628

The reduced Enigma

Harold Thimbleby

Table 1. Enigma and reduced Enigma construction compared.

Real Enigmas Reduced Enigma

26 letters and lamps 4 letters and lamps

26 way plugboard, typically 6 plug cables 4 way plugboard, 2 plug cables

Switch and lamp wiring Identical switch and lamp wiring

Adjustable rotor ring settings Rotors cannot be adjusted

Mechanical rotor action (The Scherbius Electromechanical rotor simulation by patent has electromechanical action.) uniselector

Control for internal or external power External power only supply, and for bright/dim lamps

Swiss K model has external lamp board Plugable external lamp board on 6m on ~0.5m cable ‘network’ cable

12Kg, in wooden box 2.6Kg, in transparent plastic box

Exchangeable set of 8 rotors Fixed set of 1 or 2 simulated rotors (and an optional key of length 50)

can only provide 3 permutations if both cablesare always used; but if 0, 1 or 2 cables can usedthen 10 permutations can be achieved — butthis is still less than half the 24 theoreticallypossible. The remaining 14 permutationsrequire a different sort of cable: a single cablewith three plugs can achieve 8 morepermutations (all leaving one socketunchanged), and a single cable with four plugscan achieve the remaining 6 permutations (seeAppendix 4). It is interesting that a single cabledoes better than two: it might also be easier tohandle under the pressure or war (or a difficultlecture) — plugboard wiring mistakes whetheror not the operator is under pressure wouldobviously render the Enigma less than useless.If, for the reduced Enigma, the three differenttypes of connection cables are coloureddifferently then the codebook table (Appendix2) can have another entry and all 4!permutations can be used.

The reduced reflector

Out of a hopeful 4! reflectors, by drawing orotherwise, it is easy to see that there are only 3possible (see Table 2). Furthermore a ‘secure’reduced Enigma should only support 2 of these3 possibilities because two of the reflectors arerotations of each other. (The actual reducedEnigma has wiring for one only.)

Because the reflector connects and hence pairsletters together, the number of reflector wiringsis equal to the number of reciprocal simplesubstitutions. An interesting observation maybe made about the real Enigma: since thenumber of all codes, counting both reciprocaland non-reciprocal codes, is 26! and which isconsiderably larger (by a factor of ~1014 forn=26; see Table 2), it means that the designdecision to make the Enigma reciprocalsignificantly reduced its security — a penaltypresumably hoped to be offset against theoperational convenience. For the reduced

The reduced Enigma

Harold Thimbleby

629

Table 2.The basic formulae and actual values for the reduced Enigma. A good exercise is to work through these formulae forcases of 6 key Enigmas, through to 26 key Enigmas.

Property Formula Value for reduced Enigman letters, upto p plugboard connections, r rotors, s rotors in use

Number of rotor wirings n! 24, but only 4 are non-degenerate, of which 2 are used on the reduced Enigma.

Number of plugboard 10permutations, allowing compare with n=26 button anywhere between i=0 Enigma’s 100391791500 for p=6 and p connections (eventually increased to 10)

Number of reflector 3, of which 2 are similar. The wirings reduced Enigma has 1 fixed rotor.

(equals basic formula for plugboard with p=n/2)

Rotor permutations 1 (the reduced Enigma’s 2 simulated rotors cannot be changed)

(with judicious choice of rotors)

Key length ns 1, 4, 16 (simulating s=0, 1 or 2 (with judicious choice of rotors) rotors) and 50 (not simulating

rotors)

Enigma, requiring the reciprocal propertyreduces the number of codes by a factor of 8 —which is still a pretty severe tradeoff, since thereare only 24¥key length different possiblesubstitution codes to start with.

The reduced rotors

In principle there are 4!=24 rotors. But most ofthe rotors don’t achieve anything useful. Many4 wire rotors are obviously degenerate, aproblem which isn’t at all obvious when theyhave 26 wires. For example, the trivial wiringthat takes wire 1 to 1, 2→2, 3→3 and 4→4,

does nothing different as it is rotated. Indeed,the rotor taking 1→2, 2→4, 3→1 and 4→3,and many other possible rotors do nothing asthey are rotated. They are therefore quiteuseless. There are then two rotors (e.g., swap1↔2, swap 3↔4) that have only two effectivelydifferent positions. This leaves only 4 rotors outof the 24 that do anything useful. Overall,instead of a possible 4! = 24 rotors, only 4 arenon-degenerate.

A reduced Enigma with one rotor (carefullychosen from the 4 non-degenerate rotors)would have a key length of 4. One with tworotors should have a key length of 16. Somecombinations of rotors give shorter key lengths.

A real Enigma has swappable rotors (to changethe wiring) and the rotors rotate. With threerotors, there are 26x26x26 = 15,576 differentrotor positions, and the rotors can be put in anyorder. Later in the war, the rotors were selectedfrom a fixed set of eight, further increasing thenumber of permutations. The reduced Enigmahas the rather more modest arrangement of two(non-degenerate) fixed rotors — the uniselectoris wired to simulate the correct wiring androtation of two rotors.

A uniselector can easily out-perform thenumber of permutations of a simple 4-way rotor,and it need have no degenerate connections.Indeed a contemporary uniselector could easilyhave out-performed a 26 way original Enigmarotor. But small rotors were more practical foractual use, and they would have been easier towire up. A single 26 letter rotor has only 26internal wires; in contrast a single 50 wayuniselector has already, even for the reduced 4button Enigma, 100 wires. To make thecomparison clearer: the two 4 letter rotors itsimulates would have required 8 wires, but justthe 16 positions two 4 letter rotors can be inrequire 48 connections to simulate. Despitethese unpromising comparisons, a pair oruniselectors could be wired together, and wewould then be comparing 502=2,500 codes (for

630

The reduced Enigma

Harold Thimbleby

Figure 5. The reduced Enigma in its transparent box. Two wires are shown connected in the plugboard at thetop of the machine, connecting A-S and E-T. The central silver object is the uniselector, which simulates theEnigma’s rotors. In this photograph, 25 of its random connections can easily be seen, and the uniselector’s‘rotor’ is at the sixth position. The knobs and button at the bottom are used to change the initial key settings, asexplained in the text. The reduced Enigma is 16¥24¥12cm.

two uniselectors) or 503=125,000 codes (forthree) against a conventional 26 way rotor’simprovement to 262=676 or 263=17,576.

Uniselectors are heavier and larger than rotors,and the standard uniselector used in thereduced Enigma requires additional wiring forkey setting (to simulate electrically what for arotor is purely mechanical). Rotors aremechanically easier, which is an importantcriterion for a device that is intended to be usedin action. Building rotors and swapping themaround in the field (as keys are changed) meanthat a rotor is a lot more convenient than auniselector.

Since Enigma rotors turn at progressively slowerspeeds, even for runs of 26 characters two rotorsand the reflector are essentially stationary. Thismakes breaking the code easier, as Alan Turingrealised. A set of uniselectors can be wiredrandomly over the full key length, and need nothave this limitation. Thus a uniselectorapproach to wiring an Enigma would not havethis weakness the Enigma had; in fact, theJapanese Purple (so-called by the US) codemachine used coupled uniselectors instead ofrotors. Appendix 5 shows how the weakness canbe avoided with conventional rotors.

Using the reduced Enigma

Each day the real Enigma’s settings would bechanged according to a code book. This was acomplex procedure, designed to ensure thatsecure messages could be exchanged but thatthe enemy would be unlikely to read manymessages using the same settings. Essentially, theoperator chose a ‘random’ one-off setting, whichwas encoded on the Enigma using the codebook’s day setting. This brief code was thentransmitted. The rotors were reset to the choice,and then the real message sent using that as thesetting. In practice there were a number of otherchanges and code books used to further encryptthe message setting, and the details of theprocedure changed throughout the war.

The code book for the reduced Enigma is muchsimpler than the real Enigma’s, but can be usedto show some of the cillies — the likely humanfactors errors — operators would make underwartime conditions.

To code: Choose any two letters from AEST:this will be the message setting. Set the reducedEnigma to the day settings, taken from the tablein Appendix 2, and reset the Enigma. Code thetwo message setting letters and transmit usingthe day settings. Now set the Enigma to themessage setting, reset it, and code the messageto be sent. (This scheme is considerably simplerthan the one used on the real Enigma, but itcaptures the spirit without unnecessarycomplication.)

To decode: Set the Enigma to the day settings,taken from the table. Decode the first twoletters to obtain the message setting. Set the

The reduced Enigma

Harold Thimbleby

631

Figure 6. Like the Swiss K Enigma, the reduced Eniigma has a remote lamp unit. Messages can be sent across aroom to afford some privacy for the sender. The remote lamp unit can be used by people in the audience orvideoed for projection (this allows the audience to see the code but not the plaintext).

Enigma to the message setting, and reset it.Now decode the rest of the message as itarrives.

Because the reduced Enigma has knobs to set it,an operator may be tempted not to change itssettings between messages. The simplest choiceof letters for another message setting, then, is torepeat the initial settings. In contrast, on a realEnigma the rotors (and hence their settings)change position on each key press: thus on areal Enigma the easiest choice of messagesettings is to use is the final rotor position, notthe initial, of a message.

When a second message is coded usingpredictable message settings it is of course easierto decode, and strict operational procedureswere in place to help avoid it occurring.Bletchley Park called such procedural errorsJABJABs, presumably because an earlyoccurrence was the rotors set on JAB endingone message and ‘reset’ to JAB to start the nextmessage.

There are many other sorts of cillies. Forinstance, were a message to end with the rotorsset at HIT, the operator might find it hard toresist choosing the next message setting to beLER. The Army Enigma shown in Figures 1–3used numeric settings, so there would be less ofa temptation to use words.

The reduced Enigma does not have adjustablerotor rings as the real Enigma did during thewar, and therefore they cannot be set from thecode book. Thus the Herivel Tip cannot bedemonstrated on the reduced Enigma. (Herivelsuggested that operators, having rotated and setthe rings on the rotors, might position therotors in the easiest way, as it were just droppingthem in to the Enigma, to obtain the messagesetting with no further rotations.)

Typical use in a lecture

Depending on the size of the audience orlecture room, it can help enormously to use avideo camera and projector, so that people can

easily seem the demonstrations. Beforeintroducing the reduced Enigma, show someslides of the real Enigma and explain the majorfeatures.

The reduced Enigma is then demonstrated withthe key length set to 1. The uniselector doesnot rotate, and the wiring does not change. It isthen easy to explain the basic principles: noletter is coded as itself, and, by going through asimple example, the reciprocal nature of thecode.

We then show how the code changes (pseudo)randomly when the uniselector is switched on.At this stage, it is best to have a key length of50. It is easy to demonstrate that pressing abutton repeatedly makes the lights come onunpredictably, and that it would be impossible(at least from such a short demonstration) towork out from which light was coming onwhich button had been pressed.

The setting mechanism can be explained:setting the two knobs and pressing the resetbutton can be done several times to confirmthat the coding is repeatable.

The monthly code table is simple enough to beexplained, and it helps that the date of thelecture can be used to select the initial settings.

The reduced Enigma can be used more easilywithout the complication of the messagesettting, a topic which can be introduced whenthe audience recognises the weakness ofrepeating messages (many times during a day)using fixed initial settings.

A volunteer resets the Enigma to the daysettings, and selects a word (shown on theoverhead projector) taken from Appendix 3 —a list of words easily spelt with 4 letters. If the‘network’ lamp box is used, another volunteercan write down the code directly. Otherwisetwo other volunteers are required: one to writedown the code (and not reveal the word), whothen acts as the ‘transmitter’ and takes the codeover to the third volunteer.

632

The reduced Enigma

Harold Thimbleby

A volunteer using the lamp board (on its 6mcable) can be far enough away not to see theother volunteer’s button pressing. Alternativelythe external lamp board can be projected usinga video camera so the entire audience can seethe code. But to decode the message, thereduced Enigma has to be brought over to thedecoding volunteer. (External buttons on thelamp board would have simplified things, butwould have made explaining what is going onmore complex and less believable.)

It is surprisingly difficult to write down thecoded message from the flashing lights; oftenthere are requests to start again, and the senderwill forget to reset the Enigma… (There wouldtypically be an Engima operator and anassistant.)

One persistent problem is that the volunteercoding often presses buttons almost as fast asthey would as typing them — forgetting thatthe other volunteer needs time to write downthe code message. Typically, there are manyopportunities to point out that all errors occurin a relatively calm lecture setting, which onecan emphasise is a lot easier than being in asubmarine at war!

The third volunteer is given the reducedEnigma, and types in the code. It is fun to dothis first without resetting the Enigma: decodingwill go wrong. When the Enigma is correctly setto the day settings, it will correctly decode themessage (because of its reciprocal property).

After or during the demonstrations —depending on audience participation — it ishelpful to emphasise that the encoding anddecoding Enigmas must be both the same andinitialised to the same settings. This observationleads into the key distribution problem, a topicwhich can be picked up in following lectures.

During the war, as the Germans worried aboutweaknesses in the Enigma code, theyintroduced further complications (such as morerotors). Because some boats and submarines

would be at sea when the Enigmas wereupgraded, the Germans were forced to transmitmessages both on the old and new systems. Thisduplicate transmission often allowed BletchleyPark to work out the new Enigma wirings, andhence almost immediately compromise the“more secure” codes.

Cribs are easy to explain, since there are only alimited number of words that the reducedEnigma can work with (see Appendix 3). Ifvolunteers can be pressed into coding longermessages, then it is possible to try to decodeusing a crib; however, finding the key settingsrequires a more detailed knowledge of thereduced Enigma than can be conveyed in asingle lecture. Perhaps one day somebody willdesign a reduced Bombe good enough to beused real-time in lectures.

Some audiences worry about sending numbers:how can this be done with a plain alphabetickeyboard? Obviously, numbers could be speltout, or a number code could be used. The SwissK, which has 26 alphabetic letters, also labelsten letters 1 to 9. (Curiously, the letter O islabelled 9.) During the war, many numberswould have been map grid references: to reducethe chances of these important numbers beingdecoded, a special code book was used, whichwas changed from time to time. Thus gridreferences were transmitted as (coded)alphabetic words, rather than as latitude andlongitude.

Some audiences may suggest that the 4 buttonsmight be labelled 00, 01, 10 and 11. Now anyletter or digit can be coded using, say, ASCII orthe older 5 bit (Baudot) code. One might thendevelop the discussion to introduce prefix freecodes and other coding schemes.

Finally, one can introduce the concept ofmessage setting, and explain how it increasessecurity (because now the day setting is onlyused for a two letter code, which has nointrinsic meaning). Discussing the rigours ofreal use of message settings nicely introduce

The reduced Enigma

Harold Thimbleby

633

further human factors issues. For examplebecause of the difficulty of setting Enigmas(imagine being under war-time conditions inthe field) it was common practice to repeat aletter such as AAA or BBB at the beginning ofa transmission so that the recipients couldcheck the machine’s day settings were correct.

More advanced topics

Lectures that go on to discuss public keycryptography will doubtlesss discuss trapdoorfunctions (see Bauer, 1997; or Singh, 2000, for amore popular account). One way to introducethese is to discuss the equivalent logicimplementation of the reduced Enigma:decoding is then reduced to satisfiability.Satisfiability is NP hard, and a good example ofa trapdoor function: given some variables andtheir values (e.g., in this case the binaryrepresentation of the message setting and theplaintext) one can very easily construct aparticular Boolean formula that is true if andonly if the variables have the given values.Decoding means finding the values of thevariables from the formula, and this is muchharder (though of course the reduced Enigmahas some structure that might be exploited:even so, there is no fast way to decode ingeneral).

In any lecture it is worth emphasising that theEnigma achieved its secrecy by trying to ensurethat its physical construction was secure(specifically, trying to ensure it never fell intoenemy hands): in contrast, we believe NPproblems are hard because they are open toinspection. Of all the people who’ve tried,nobody has found any efficient solutions. Theopenness of abstract problems thereforeparadoxically ensures their strength, quite theopposite of the physical Enigma situation.(There are problems harder than NP, but that’sfor another lecture.)

The reduced Enigma does have one problemwith this sort of explanation. Discussion ofcomplexity (e.g., to claim that the Enigma

represents a trapdoor function) can requiredistinguishing linear (e.g., coding), polynomialand exponential (e.g., decoding) problems.Now, the reduced Enigma has 4 buttons, whichcan be represented as two bits because 22=4.Confusingly, it’s also the case that2+2=2x2=22=4. Unless care is taken, then, theaudience won’t believe that decoding isseriously harder than encoding, because theycan see — in this case — that the complexitiesof the linear and exponential problems are ofthe same order!

Simulating Enigmas by computer

Simpler than building a reduced Enigma is touse a computer program to simulate one. Thereare many programs available to do this,including Russell Schwager’s award-winningJava applet. A picture of an Enigma can beprojected onto a screen, and the audienceshown how the Enigma works.

There are at least four disadvantages to using asimulation. One needs to ensure the computer,software and projector all work happilytogether. This isn’t always as easy as it seemswhen lecture theatres have projectors withresolutions that one’s computer is not happywith. Secondly, the more realistic thesimulation, the harder it is to understandexactly what is going on. Of course, a simulatormight be reprogrammed to provide both a realEnigma and a reduced Enigma for comparisonand discussion. Thirdly, one might not want topass an expensive and delicate laptop around alecture theatre so that people can use it easily.But, finally, the main disadvantage is that acomputer simulation does not engage audiences.It is too complex and loses the principles for thedetails of successful computer interaction.

Conclusions

A real Enigma is a fascinating gadget, but isvery complex. Even if one is available they aretoo valuable to use freely in lectures. A reducedEnigma — the simplest possible coding

634

The reduced Enigma

Harold Thimbleby

machine that faithfully works like a real Enigma— is a very successful lecturing aid, whichallows hands-on use, and no special worriesabout damage. Its much simplified design allowsthe principles of the Enigma code to beexplained much more easily. (Being able to lockthe rotors and have short key lengths is alsovery helpful.)

Most lectures on cryptography cannot go verydeeply into worked examples of coding, becauseof the time required. A working machine helpsenormously, because it automates the tedium ofcoding and decoding. In practice, the reducedEnigma has been used to explain two importantcryptology concepts, which are usually lost inthe practical complexity of a real Enigma: thekey distribution problem, to motivate theadvantages of public key cryptography; secondly,the human factors weaknesses of the Enigmaconventions (such as choosing messagesettings).

The design of the reduced Enigma puts some ofthe design flaws of the real Enigma in a newlight, and makes them very obvious. In today’scomputerised binary world, it is obvious that acode machine that cannot work in binary musthave problems. Had Scherbius or one of theother early inventors built a reduced Enigmaprototype, perhaps they would have noticed thefundamental problems. Instead, as time went bythe Enigma concept was made increasinglycomplex — adding more rotors, adding aplugboard — without addressing its basiclimitations. Even the plugboard has problems,again which are obvious with the reducedEnigma.

The basic limitations of the Enigma are veryapparent in the reduced Enigma. Because itscalculations are easier, the reduced Enigmashows that some of the standard claims of thecomplexity of the Enigma and of the difficultyof breaking its codes are over-stated. If theAxis powers had recognised some of theEnigma’s limitations they could have fixed

them; the moral is that when designingsystems, first design reduced ones to get theprinciples right. In various forms (e.g., getcomputer programs working correctly thenoptimise them), this is standard wisdom, buttoo often ignored!

For lecturers and teachers, the lesson is thatbuilding real things for ourselves, checkingclosely what people say by doing our ownexperiments — perhaps making our ownmistakes too! — is the best way of reallyunderstanding and learning, and even ofprogressing a field. It is certainly the mostenjoyable and best foundation forcommunicating a fascinating subject.

Further resources

Excellent written accounts of the Enigma areSimon Singh’s popular book The Code Book(2000), and David Kahn’s The Codebreakers(1996a) which is a standard reference. MallmanShowell’s Enigma U-Boats (2000) has numerousillustrations, both of the Enigma and of thesubmarine war. A recent book, which provides amore balanced view of both the Allies and Axisuse of codes is Stephen Budiansky’s Battle ofWits (2000). A mathematician’s introduction tothe field is Freidrich Bauer’s Decrypted Secrets(1997). A popular film Enigma based on a storyby Robert Harris (1996) has been made, whichuses the Enigma and Bletchley Park as thebackdrop to a fictional detective story.

Any serious student of the Enigma and itshistory should visit Bletchley Park (seewww.bletchleypark.org.uk) where many exhibitsand resources are available. Tony Sale’s Codesand Ciphers in the Second World War web site atwww.codesandciphers.org.uk provides a greatvariety of authoritative and extensive material,and is highly recommended.

ReferencesFriedrich Bauer, Decrypted Secrets, Springer, 1997.

Tim Bell, Harold Thimbleby, Mike Fellows, Ian Witten, NeilKoblitz & Matthew Powell, “Explaining Cryptographic

The reduced Enigma

Harold Thimbleby

635

Systems to the General Public,” Journal of Computers &Education, 40(3):199–215, 2003.

Stephen Budiansky, Battle of Wits, Penguin Books, 2000.

Robert Harris, Enigma, Arrow Books, 1996.

David Kahn, The Codebreakers, Scribner, 1996a.

David Kahn, Seizing The Enigma, Arrow, 1996b.

Jak P. Mallman Showell, Enigma U-Boats, Ian Allan, 2000.

Russell Schwager, Java applet Enigma simulation,http://www.ugrad.cs.jhu.edu/~russell/classes/enigma/

Simon Singh, The Code Book, Fourth Estate, 2000.

Acknowledgements

Gresham College supported the developmentof the reduced Enigma, which was first used ata Gresham public lecture. Harold Thimbleby isa Royal Society-Wolfson Research MeritAward Holder. Tony Sale, Frank Carter andSimon Singh provided helpful informationabout Enigmas; this jourmal’s anonymousreferees made extensive and insightfulcomments for which the author is grateful.Figures 1 to 3 are my photographs of SimonSingh’s Army Enigma. Figure 4 is taken fromKahn, 1996b.

Appendix 1: Programmingproblems

The reduced Enigma project required thesolution of several problems, which inthemselves generate interesting programmingproblems:

• Which four different letters generate themost words? (I chose AEST, though AERTdoes more words but doesn’t make suchgood ones; see Appendix 3.)

• Which rotors should be used, and what isthe correct uniselector wiring to simulatethe chosen two rotating rotors?

• What is a best (most secure) randomsequence that should be used on the 34uniselector positions left that are notsimulating the two rotors?

• Finally, how would one build a Bombesimulator to attack the reduced Enigma?

Appendix 2: Settings from thereduced Enigma code book

The reduced Enigma plugboard settings arechanged daily. The real Enigma plugboard wasat first changed less often than daily, which wasa security risk (though one that had to beweighed against the size and complexity ofcodebooks, and the practical difficulties ofreplugging). The plugboard connections were

636

The reduced Enigma

Harold Thimbleby

Reduced Enigma Daily Key Settings: January 2002

Date Plugboard Rotor settings

1 A–E, S–T E–E

2 A–E, S–T E–E

3 A–S, E–T S–T

4 A–S E–T

5 A–E S–E

6 S–T E–A

7 A–T S–T

8 A–E, S–T A–A

9 A–S, E–T S–T

10 NONE A–T

11 E–T A–S

12 A–T T–A

13 A–S, E–T A–S

14 A–S E–E

15 A–S, E–T S–S

16 A–E, S–T S–S

17 A–S, E–T A–A

18 E–S T–S

19 NONE A–T

20 S–T T–T

21 A–S T–T

22 E–T A–T

23 A–T S–E

24 A–S, E–T S–A

25 E–S T–E

26 E–S A–S

27 A–T, E–S E–E

28 A–T A–S

29 E–T T–S

30 A–T, E–S A–E

31 A–S E–S

changed daily from the end of 1936; duringWWII the plugboard settings were changedevery 8 hours — a delicate balance of securityagainst the risk of wiring the Enigma incorrectlyand possibly having to retransmit messages,which would be a grave error.

Appendix 3: Reduced Enigmacribs (anagrams of AEST)

Appendix 4: The reducedEnigma circuit

The reduced Enigma circuit uses componentsthat could have been sourced during WWII, oreven earlier. Two miniature modern relays areused, rather than the contemporary Post Office3000 type relays. Coincidentally the modernrelays used are telecom approved types, and areessentially PO3000 replacements. The relays arein transparent packages and are mounted inside

the reduced Enigma so that their armaturemovement can be seen easily.

The wires are colour-coded to help in lectures:black is wiring that copies original Enigmafunctionality, red is original power, yellow is keylength control, and green is rotor setting.

Some non-functional compromises to historicalreality were made: instead of incandescentlamps, four bright LEDs are used; the three relaycoils have silicon diode suppressors; a diode wasused on the uniselector to save requiring a morecostly switch for the key length circuit; andthere is a final diode in the supply circuit tostop damage if a power supply is incorrectlyconnected. (Such silicon diodes were notavailable until the 1970s; suppressors were notused on the Enigma since there are noinductive loads.) For clarity we have not shownthe suppressors in the circuits below.

Power supply

It was cheapest to provide a standardtransformer/rectifier solution, though off-theshelf 24V 1A SMPS are available. An externalpower supply makes the reduced Enigma lighter,which is an advantage for handling in lectures.

Enigma buttons and lamps

The buttons, plugboard and lamps are wiredexactly as on a real Enigma. A two pole pushswitch is used for each of the four buttons: onepole is the original Enigma wiring, one poleprovides the stepping current for theuniselector.

All switches are push buttons, sprung change-over industrial control panel type. Theconnections labelled + and – continue to othercircuits below (providing power). Theconnections labelled A, E, S and T correspondto original Enigma wiring and are connected ina later circuit, shown below. The connection‘Step’ provides a signal to step the uniselectorwhen any button is pressed. The socket on theright is for the external lamp board.

The reduced Enigma

Harold Thimbleby

637

A

AS

ASS

ASSES

ASSESS

ASSESSEE

ASSET

ASSETS

AT

ATE

ATTEST

ATTESTS

EASE

EASES

EAST

EAT

EATS

ESS

ESTATE

ESTATES

ETA

SAT

SATE

SATES

SEA

SEAS

SEAT

SEATS

SE

SEE

SEES

SESTET

SET

SETA

SETAE

SETT

SETTS

SETS

SETTEE

SETTEES

STATE

STATES

STET

TA

TASS

TASTE

TASTES

TAT

TATA

TATTA

TE

TEA

TEAS

TEASE

TEASES

TEAT

TEATS

TEE

TEES

TESS

TESSA

TESSAS

TEST

TESTS

TESTA

TESTATE

TESTEE

TESTEES

TSETSE

A fuse is required because of the external lampboard socket and the possibility of externalfaults. A diode is provided to protect the relaysuppressor diodes in case an incorrectly wiredpower supply is used. (A standard batteryelimination socket is used, and they are notalways connected the same way.)

Plugboard connectors

There are two pairs of plugboard connectors:they are wired (in pairs) to swap over theconnections of the jack plugs.

The wiring of the unconventional sets of 3 and4 plugs, mentioned in the text, is as shownbelow.

Note that a 3 plug cable can be simulated bythe 4 plug cable by connecting a shorted socketover any one of its plugs, so the remaining 3 arethen wired as the 3 plug cable. A reducedEnigma could be built with 6 sockets, fournormal and 2 shorted: using 1 or 2 shortedsockets reduce the 4 plug cable to exactly a 3 or2 plug cable. (In the limit, using 3 shortedsockets would reduce a 4 plug cable to a nullplug.)

External lamp board

The external lamp board simply copies thereduced Enigma’s main lights. If one was reallyserious, it could go to a 4 way mains lightcontroller.

A technical solution is possible to avoid therapid keying problems mentioned in the text:monostables could drive the lamps, so they stayon a minimum time to make them easier toread.

Since the lamp board (in our model) is in anopaque box, the circuitry necessary to achievethis can be completely hidden. In fact, LEDs areused: note that the resistor should be rated tosupport the current of two LEDs simultaneously(which happens when two buttons are pressedon the Enigma).

638

The reduced Enigma

Harold Thimbleby

Figure 7. Power input to reduced Enigma; button and lamp wiring.

Figure 8. Standard single plugboard connector.

Figure 9. Non-standard four and three plug connector wirings.

Our lamp board has the lamps mounted in arow, exactly matching the layout on thereduced Enigma itself. For some audiences, thisdesign could be used to introduce the standardergonomic issue of compatibility (cf. the usualincompatible arrangements of a row of fourknobs and a square of cooker rings on acooker).

It might be helpful to provide external buttonsas well as lamps, though this requires an extramulti-pole switch to select internal/externalbutton control.

Rotor simulation

The rotor circuit is deceptive: it looksasymmetric, because it seems to treat the wire Adifferently. In fact, each position of theuniselector shorts two ‘random’ pairs of theAEST wires. (The wiring shown is not theactual wiring used: the uniselector’s 150terminals needed for the rotor simulation werewired from a program-generated table.)

The uniselector is easier to wire up than itlooks. A single wire (e.g., A in the diagrambelow) can be trace through all uniselectorcontacts, then the remaining pair can be

shorted in whatever way is convenient toconnect.

Initial key setting

SW1 and SW2 are used to set the initialsetting of the rotors: they are turned to one of16 positions (4 each) then the reset button(SW4) is pressed. Note that SW4 is a sprungchange-over push button; the other switches

The reduced Enigma

Harold Thimbleby

639

Figure 10. Remote lamp board. The resistor is required if lamps are LEDs.

A

E

S

T

Figure 11. Uniselector rotor wiring (schematic).

(SW1, SW2, SW3) are standard rotaryswitches.

SW2 sets the key length to be in the range 1–4,4–8, 9–12 or 13–16. SW3 sets key length;SW3a overrides SW2 when the key length isset to 4, to stop the initial position being setbeyond 4 — otherwise the uniselector wouldhunt when it is reset.

Since the uniselector steps on being switchedoff, the uniselector will make one further step.It is always ‘out by one,’ but this doesn’t mattersince the uniselector is wired with the ‘correctpositions’ one out to compensate. However toensure the uniselector resets correctly if theinitial settings happen to be selected as onebeyond the current position (which relay A‘thinks’ it is already in), relay A is disconnectedon pressing the reset switch (SW4). Thisensures the uniselector always starts stepping ona reset, and therefore always ensures itconsistently oversteps by 1. (The other, NO,

connection of SW4 is shown in the nextcircuit.)

Key length and reset

Relay B latches the reset button (SW4), and is released when relay A is switched on (and hence normally open contacts NOA open) by the uniselector being in the correct position, as determined by SW1and SW2. Note that pressing SW4 alsodisconnects relay A, so guarantees thenormally closed relay A contacts are indeedclosed.

When the reset button is pressed, relay Blatches. The normally closed relay B contacts(NCB) in series with the Step signal ensurethat the uniselector hunting after a reset is notstopped by someone pressing one of the mainEnigma buttons.

If desired, the diode in this circuit could beavoided by using a 4 pole 4 way switch for SW3

640

The reduced Enigma

Harold Thimbleby

RLA

SW1

SW2SW3a

+

–

SW4

1–4 9–125–8 13–16

17

17

Figure 12. Initial key setting circuit.

instead of a (readily available) 3 pole 4 wayswitch.

Appendix 5: Improved wiringfor the original Enigma?

The real Enigma ensured that codes werereciprocal by using a reflector. A weakness ofthe Enigma was that the reflector wiring alsoensured that no letter could be coded as itself.The reason for this weakness was explained inthe text of the article; here we show that hadthe weakness been recognised by the Enigmadesigners it could easily have been avoided.

In the original circuit, the problem is not justthe reflector but also that each button is a two

way switch that either selects a batteryconnection or a lamp connection: therefore if abutton is pressed, its lamp cannot light. Thefollowing circuit (simplified to two buttons)shows how an improved Enigma might havebeen wired to avoid this limitation. The buttonsare one way switches and connect through therotor permutations to the lamps. With thisscheme, there is clearly no intrinsic restrictionthat button X cannot light lamp X, etc. Now,however, the box labelled Rotors, which workslike the original Enigma rotors, now mustprovide a reciprocal permutation directly.

In the original Enigma, rotors were wiredconnecting their input terminals 1–26 to their

The reduced Enigma

Harold Thimbleby

641

SW4

Step

RLB

NCA

NOB

Uniselector

NC

SW3b

SW3c

5–16 17–50

+

–

SW3 (key length) positions

Lock

50

16

4

NCB

Figure 13. Enigma reset and setting key length circuit. (NC: normally closed; NO: normally open.)

output terminals 1–26. The only restriction wasthat the wiring had to be one-to-one, so thateach input terminal was connected to adifferent output terminal. In the modifiedwiring, the rotors must additionally bereciprocal, so that if input terminal x goes tooutput terminal y, there must also be aconnection from input terminal y to outputterminal x. In the special case that x goes to x,no additional wire is required, since x–x isalready reciprocal. If each rotor is reciprocal,any series of rotors will also provide a reciprocalpermutation, so the rotors can be connected(and rotated) exactly as on the original Enigma.With this restriction on the wiring of the rotors,and using the circuit above, we achieve all theEnigma advantages (exchangeable rotors,plugboards, long key lengths, etc) with areciprocal code but without the limitation thatletters cannot code as themselves.

The restriction on the wiring of the rotorsreduces the number of possible rotors from26!=4x1026 to 5x1014, but this isn’t the problemit seems. The reflector in the original Enigmamakes many rotor wirings equivalent (because itshorts pairs of terminals) and reduces theeffective number to 8x1012. This number is lessthan 5x1014 because it excludes all reciprocalcodes (x–x). The reciprocal wiring does notrequire an even number of buttons: the revisedEnigma could have had a space button (ratherthan using a convention such as X representsspace).

This modified Enigma can have a standardplugboard circuit without problem, though itwould suffer from the limitations discussed inthe body of the paper. Alternatively, since anyrotor behaves as a (movable) plugboard, simplyincreasing the number of rotors would achievethe same effect.

Finally, a weakness of the original Enigma isthat while one rotor rotates on every buttonpress, the others turn slowly. For about 26button presses, the rest of the wiring isessentially fixed. (The German Secret Policeused a more complex rotor scheme, but theirEngima did not have a plugboard; it was brokenby Knox in 1941/2.) A better approach wouldbe to rotate all rotors, but at every, every other,every third, every fifth… every prime number(or, better, randomly, since everybody knowsabout primes!) of button presses. This couldeasily be arranged by suitably sized cogs, whichmight be replaced by the operator to change theperiods.

642

The reduced Enigma

Harold Thimbleby

Rotors

Figure 14. Alternative rotor wiring.