Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

If cryptanalysts today were to crack the original Enigma machine, “how fast” or “how easily” could they do it? What methods would they use?

The original cracking was significantly helped by operator mistakes, like always including the same header, always including a weather report, and finally, a long message of LLLLLLLL… being sent. Let's assume no such operator mistakes happened.

share|improve this question
Does the question also assume that the workings of the Enigma machine (all versions) are made available to the cryptanalyst, in accordance with Kerckhoffs's principle? – Thomas Jan 27 '14 at 7:44
AES is believed to be (IND-CPA) secure even if the plain text is chosen by the attacker, so why do you include the restriction of no operator errors? – Henrick Hellström Jan 27 '14 at 9:31
@vsz, the mistakes were helpful, but remember that the mechanism had been for sale as a commercial product, so the "how" of Enigma was a matter of public record. The original WWII military machine descended from the commercial product, and the original solution, in principle, was worked out by two Polish intelligence officers before the war. All of e-sushi's comments are quite on point, but I'd pull back even a bit further. David Kahn's books, "The Codebreakers", and particularly, his later "Seizing The Enigma", go into the nuts and bolts of the historical solution. Knowing how the actual so – Bill IV Apr 10 '15 at 4:10
Much of the answer will depend on what qualifies as "operator mistakes" and to what degree they are known; what "the original Enigma machine" is assumed to be (there was several variants, even the number of rotors was variable); and if the wiring of rotor (and plugboard, if any) is assumed known or not. – fgrieu Apr 10 '15 at 10:58
"Cracking Enigma" was not a single event. The 3 different German military arms used the machine 3 different ways. Cracking 1 didn't yield actionable intelligence from the other 2. Hence the pointer to history. The OP asks how modern crypt analysts would go about cracking Enigma, in the absence of operator mistakes. And, by implication, without knowledge of the machine itself. But which Enigma? What constitutes "cracking"? Knowing some history would allow the question to be better focused, and make the answer more useful. – Bill IV Apr 12 '15 at 0:31
up vote 25 down vote accepted

What methods would they use?

Since WW2, we know the security of Enigma machines was weakened by the reflector, resulting in two problems:

  1. No difference between en- and decryption, which means that if K ↦ T, then T ↦ K.
  2. No letter can be encrypted by itself because electricity can not travel the same way back, which results in a reduction of encryption alphabet.

Also, history has shown that Enigma had another security problem: the contradiction to Kerckhoff's principle "The security of a system should not depend on the privacy of the algorithm. It should only be based on the secrecy of the key.".

Enigma got it wrong because:

  • Security of Enigma depended on wiring of rotors,
  • Wiring was part of algorithm and not part of key, and
  • Wiring never changed from 1920s until 1945.


Since you're asking about today, I will therefore assume the fact that we know about the internal workings of Enigma since WW2.

Based on your assumptions and the known Enigma weaknesses, one of the well-known attacks to break Enigma is using the Index of Coincidence (short: IC), a statistical measure of text which distinguishes text encrypted with a substitution cipher from plain text.

Let's put Enigma into the formula: $IC = \frac{{\textstyle \sum_{i=0}^{25} } f_i(f_i-1)}{n(n-1)}$ where $x_1,...,x_n$ is the string of letters and $f_0,...,f_{25}$ the frequency of the letters in that string. For a random string that boils down to $IC ≈ 0.038$ and for a natural language $IC ≈ 0.065$.

I'll skip the details and simply give you some raw numbers while summing up how IC can be used for an attack on Enigma:

  1. Find the rotor order
    Trying all rotor orders and positions searching highest IC takes $60*26^3 ≈ 2^{20}$ operations.
  2. Approximation to rotor start positions
    Starting with a rotor order from step $1$ and $w$, trying all rotor positions and ring positions for 1st ring only, again searching highest IC. That takes $26^4 ≈ 2^{19}$ operations.
  3. Find ring and rotor start positions
    We have the 1st ring and 1st rotor start positions, approximations for other rings and starting positions from 1 and 2. First search positions for the 2nd ring and rotor, then use the same procedure for last remaining rotor. This will take $26^2 ≈ 2^9$ operations.
  4. Find the plug settings
    We have the rotor order, position and ring positions. Now we can use IC as statistical test again, deriving of the trigram information of the underlying language.

how fast/ how easily could they do it?

Generally, that's hard to say without having any specific information about available resources you are assuming an attacker would have.

A single computer might take a little while depending on how old it is (in terms of CPU power), but things like distributed networks will probably make you cry by successfully attacking Enigma in a few blinks of an eye. If you happen to have any specific computing setups in mind, you can take the provided number of operations mentioned above and simply do the related maths to calculate the related speeds.

And last but not least - to answer the title of your question too...

How cryptographically secure was the original WW2 Enigma machine, from a modern viewpoint?

Totally insecure. The weaknesses described above provide ample proof to that claim.

On the other hand, we can't really compare today with the situation during WW2. They used machines that were mainly mechanical (eg: Bletchley Park Bombe), while we have computers with powerful CPUs. WW2 cryptanalysts would probably have killed to get their hands on such a futuristic "wunder Maschine" which we use to do simple things like surf the internet.

Nota Bene: If you're interested in the maths behind Enigma, you might want to check on "The Cryptographic Mathematics of Enigma" by Dr. A. Ray Miller, The Center for Cryptologic History – National Security Agency.

The above publication certainly provides more insights related to the internals and maths behind Enigma than the usual NSA "freebee" stuff (PDF) which tends to restrict itself to talking about the history instead of cryptography.

Edit: The last two links are now offline and seem to have been removed from the website. As they are still available via, the links have been updated point there.

share|improve this answer
If I understood the real WW2 events which lead to the cracking of Enigma correctly, the operator mistakes were useful to actually discover the "algorithm" itself. How would modern cryptanalysts with modern tools to their disposal discover the algorithm of an Enigma-like machine without putting their hands on a physical copy of the machine? – vsz Jan 27 '14 at 15:36
@vsz A pretty hypothetical question when talking about Enigma since we all know what really happened, but I'll answer it as good as a comment allows to: assuming they know absolutely nothing about the cipher algorithm yet, and assuming we speak of today, they would start by walking the usual path of frequency analysis and co. Eventually, things like Enigma's "no letter can be encrypted by itself" etc. will open small cracks that enable cryptanalysts to learn about the cipher's characteristics. In case of Enigma - it would eventually enable them to break the cipher, thanks to today's computers. – e-sushi Jan 27 '14 at 15:58
The "Wiring never changed from 1920s until 1945" part of this answer is factually incorrect. According to this and this, rotor wrings used by the German armed forces during WW2 did not exist before 1930, or (I believe) 1938. This source, and others, mentions that reconstructing the wring of the rotor was a critically important step, performed by Polish cryptographers. – fgrieu May 20 at 6:00
@frgieu As for the wiring, even cryptomuseum states: ”…the M3 is functionally identical to the compatible Enigma I that was used by the Heer and Luftwaffe.” There were merely some manufacturing differences. Also… `The wiring of the M3 is given in the table below. Wheels I thru V are identical to those of the Enigma I. The same is true for UKW B and C. The three additional wheels (VI, VII and VIII) were used exclusively by the Navy.” But introducing 3 additional wheels did not change Enigma’s wiring (as already in place for wheel 1-5). – e-sushi May 20 at 11:16

It looks like with no leakage or errors, Enigma is still secure.

Quoting the Enigma@Home project website:

Enigma@Home is a wrapper between BOINC and Stefan Krah's M4 Project. “The M4 Project is an effort to break 3 original Enigma messages with the help of distributed computing. The signals were intercepted in the North Atlantic in 1942 and are believed to be unbroken.”

Given how the war ended, it would seem all encryption details would have been captured in 1945 - although the Germans might destroyed some of the secret documents about key changing.

I think that short and true messages, for which the rotor positions aren't known, would allow you effectively unbreakable communication. However, in the current digital age, encrypting a large amount of Traffic (eg HTTP) with original Enigma would not be a good idea.

share|improve this answer
Any cipher is 'unbreakable' if the message is short enough. – Dillinur Apr 13 '15 at 7:04

There is a full breakdown of key size on a website talking about the “Technical Details of the Enigma Machine”. To sum up:

  • If all rotor combinations are included then you have a possible $3*10^{114}$ possible keys. However, that didn't happen (the operators would need to keep $\frac{26!}{26}=1.5*10^{25}$ rotors at hand if they didn't allow repeats).
  • By selecting $3$ out of the existing $5$ rotors you have 60 combinations and each rotor has $26$ positions, the first 2 rotors also have a settable advancement ring for another 26 possible settings. This gives $60*26^3*26^2=712,882,560$ which is a 30 bit key equivalent.
  • This is without the plugboard which (with 10 cables) adds a factor of $150,738,274,937,250$ resulting in a 77 bit key.

  • If the message exceeds $17576$ characters then the key will cycle back to the start. So if there is a longer message you know where to overlap them.

  • Then there is the issue that letters never map to themselves. The enigma is also weak against a known plaintext in a sequence of cyphertext by a crib attack, as described at a website talking about “The Turing Bombe”.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.