# How cryptographically secure was the original WW2 Enigma machine, from a modern viewpoint?

If cryptanalysts today were to crack the original Enigma machine, how fast/ how easily could they do it? What methods would they use?

The original cracking was significantly helped by operator mistakes, like always including the same header, always including a weather report, and finally, a long message of "LLLLLLLL..." being sent. Let's assume no such operator mistakes happened.

-
Does the question also assume that the workings of the Enigma machine (all versions) are made available to the cryptanalyst, in accordance with Kerckhoffs's principle? –  Thomas Jan 27 '14 at 7:44
AES is believed to be (IND-CPA) secure even if the plain text is chosen by the attacker, so why do you include the restriction of no operator errors? –  Henrick Hellström Jan 27 '14 at 9:31

What methods would they use?

Since WW2, we know the security of Enigma machines was weakened by the reflector, resulting in two problems:

1. No difference between en- and decryption, which means that if K ↦ T, then T ↦ K.
2. No letter can be encrypted by itself because electricity can not travel the same way back, which results in a reduction of encryption alphabet.

Also, history has shown that Enigma had another security problem: the contradiction to Kerckhoff's principle "The security of a system should not depend on the privacy of the algorithm. It should only be based on the secrecy of the key.".

Enigma got it wrong because:

• Security of Enigma depended on wiring of rotors,
• Wiring was part of algorithm and not part of key, and
• Wiring never changed from 1920s until 1945.

Since you're asking about today, I will therefore assume the fact that we know about the internal workings of Enigma since WW2.

Based on your assumptions and the known Enigma weaknesses, one of the well-known attacks to break Enigma is using the Index of Coincidence (short: IC), a statistical measure of text which distinguishes text encrypted with a substitution cipher from plain text.

Let's put Enigma into the formula: $IC = \frac{{\textstyle \sum_{i=0}^{25} } f_i(f_i-1)}{n(n-1)}$ where $x_1,...,x_n$ is the string of letters and $f_0,...,f_{25}$ the frequency of the letters in that string. For a random string that boils down to $IC ≈ 0.038$ and for a natural language $IC ≈ 0.065$.

I'll skip the details and simply give you some raw numbers while summing up how IC can be used for an attack on Enigma:

1. Find the rotor order
Trying all rotor orders and positions searching highest IC takes $60*26^3 ≈ 2^{20}$ operations.
2. Approximation to rotor start positions
Starting with a rotor order from step $1$ and $w$, trying all rotor positions and ring positions for 1st ring only, again searching highest IC. That takes $26^4 ≈ 2^{19}$ operations.
3. Find ring and rotor start positions
We have the 1st ring and 1st rotor start positions, approximations for other rings and starting positions from 1 and 2. First search positions for the 2nd ring and rotor, then use the same procedure for last remaining rotor. This will take $26^2 ≈ 2^9$ operations.
4. Find the plug settings
We have the rotor order, position and ring positions. Now we can use IC as statistical test again, deriving of the trigram information of the underlying language.

how fast/ how easily could they do it?

Generally, that's hard to say without having any specific information about available resources you are assuming an attacker would have.

A single computer might take a little while depending on how old it is (in terms of CPU power), but things like distributed networks will probably make you cry by successfully attacking Enigma in a few blinks of an eye. If you happen to have any specific computing setups in mind, you can take the provided number of operations mentioned above and simply do the related maths to calculate the related speeds.

And last but not least - to answer the title of your question too...

How cryptographically secure was the original WW2 Enigma machine, from a modern viewpoint?

Totally insecure. The weaknesses described above provide ample proof to that claim.

On the other hand, we can't really compare today with the situation during WW2. They used machines that were mainly mechanical (eg: Bletchley Park Bombe), while we have computers with powerful CPUs. WW2 cryptanalysts would probably have killed to get their hands on such a futuristic "wunder Maschine" which we use to do simple things like surf the internet.

Nota Bene: If you're a book reader and interested in the maths behind Enigma, you might want to check on "The Cryptographic Mathematics of Enigma" by Dr. A. Ray Miller, NSA. Center for Cryptologic History.

The above book certainly provides more insights related to the internals and maths behind Enigma than the usual "freebee" stuff which tends to restrict itself to talking about the history instead of cryptography.

-
If I understood the real WW2 events which lead to the cracking of Enigma correctly, the operator mistakes were useful to actually discover the "algorithm" itself. How would modern cryptanalysts with modern tools to their disposal discover the algorithm of an Enigma-like machine without putting their hands on a physical copy of the machine? –  vsz Jan 27 '14 at 15:36
@vsz A pretty hypothetical question when talking about Enigma since we all know what really happened, but I'll answer it as good as a comment allows to: assuming they know absolutely nothing about the cipher algorithm yet, and assuming we speak of today, they would start by walking the usual path of frequency analysis and co. Eventually, things like Enigma's "no letter can be encrypted by itself" etc. will open small cracks that enable cryptanalysts to learn about the cipher's characteristics. In case of Enigma - it would eventually enable them to break the cipher, thanks to today's computers. –  e-sushi Jan 27 '14 at 15:58
@e-sushi: I'm a little confused by $IC(x) = \frac{{\textstyle \sum_{i=0}^{25} } f_i(f_i-1)}{n(n-1)}$. The right-hand side appears independent of $x$ - is there a reason you call it $IC(x)$ rather than simply $IC$? –  figlesquidge Jan 27 '14 at 17:06
@figlesquidge Erm... actually no. I'll correct that, thanks! (Must be the fact it's Monday.) –  e-sushi Jan 27 '14 at 17:12

there is a full breakdown of key size on this site

to sum up

• if all rotor combinations are included then you have a possible $3*10^{114}$ possible keys

however that didn't happen (the operators would need to keep $\frac{26!}{26}=1.5*10^{25}$ rotors at hand if they didn't allow repeats)

• by selecting $3$ out of the existing $5$ rotors you have 60 combinations and each rotor has $26$ positions, the first 2 rotors also have a settable advancement ring for another 26 possible settings, this gives $60*26^3*26^2=712,882,560$ which is a 30 bit key equivalent

this is without the plugboard which (with 10 cables) adds a factor of $150,738,274,937,250$ resulting in a 77 bit key

if the message exceeds $17576$ characters then the key will cycle back to the start. So if there is a longer message you know where to overlap them.

then there is the issue that letters never map to themselves. The enigma is also weak against a known plaintext in a sequence of cyphertext by a crib attack

-

It looks like with no leakage or errors, Enigma is still secure.

Quoting http://www.enigmaathome.net/:

Enigma@Home is a wrapper between BOINC and Stefan Krah's M4 Project. 'The M4 Project is an effort to break 3 original Enigma messages with the help of distributed computing. The signals were intercepted in the North Atlantic in 1942 and are believed to be unbroken.' [read more] You can participate by downloading and running a free program on your computer.

Given how the war ended, it would seem all encryption details would have been captured in 1945 - although the Germans might destroyed some of the secret documents about key changing.

I think that short & true messages, for which the rotor positions aren't known, would allow you effectively unbreakable communication. However, in the current digital age, encrypting a large amount of Traffic (eg HTTP) with original Enigma would not be a good idea.

-