I wonder if a rotor machine similar to enigma can be considered secure by today's standards under four conditions:

  1. A rotor machine which consists of 50 rotors picked out of a set of 100.

  2. A rotor machine in which a letter can encipher to itself.

  3. You can select the very same rotor multiple times.

  4. No plugboards, no secret wirings, and no operational errors

So with these in mind, can it be considered safe in terms of the needs of modern era, especially against known-plaintext and chosen-plaintext attacks?

I kind of don't know so I decided to ask, any answer will be appreciated.

  • 2
    $\begingroup$ In crypto, the devil lies in the details. Like how the rotors are stepped (in particular: past some threshold, increasing the number of rotors that in practice never move does not sizably increase security), the setup procedure, how many different letters/contacts per rotor there are, how "a letter can encipher to itself" is achieved (is it by removing the reflector, or some other method), and the amount of known plaintext. $\endgroup$
    – fgrieu
    Commented Jan 26, 2023 at 7:04

1 Answer 1


No, modern standards for symmetric cryptography are heavily over-engineered and the power of chosen plaintext attacks/chosen ciphertext attacks can quickly uncover the structure of such a variant despite its very large key space.

Assuming that you machine is Enigma like with "odometer" stepping, but omitting the Umkehrwalze that introduces the "no fixed point" property, we can describe a set-up device using an initial step position $s$ (which I'll take to be secret rather than a known IV) and fifty permutations $\pi_0,\ldots,\pi_{49}$ on the set of 26 characters. In this case your device would be encrypt the input $x$ at position $t$ in the message as $$\pi_{49}(\pi_{48}(\pi_{47}(\cdots\pi_1(\pi_0(x+(s+t)\mod{26})+[(s+t)/26]\mod{26})\cdots+[(s+t)/26^{47}]\mod{26})+[(s+t)/26^{48}]\mod{26})+[(s+t)/26^{49}]\mod{26}),$$ or more iteratively/compactly as $y_{50}$ where $y_0=x$ and $$y_{i+1}=\pi_i\left(y_i+\left[\frac{s+t}{26^i}\right]\right).$$

I'll first describe how to recover $\pi_0$ using CPA analysis. Using Banburismus-like methods, I can recover $s\mod{26}$, I'll take 26 plaintexts where the plaintext characters in the first positions where $(s+t)\mod{26}=0$ and $(s+t)\mod{26}=1$ are AA, BB, CC, DD,... ZZ. As the position of the other rotors does not change between our chosen characters we can treat the encryption of these as $\Pi(\pi_0(x))$ and $\Pi(\pi_0(x+1\mod{26})$ for some fixed permutation $\Pi$. As we have a full set of inputs to these permutations we can remove $\Pi$ by creating a cycle of letters with $x_0=A$ and choosing $x_{i+1}$ such that $$\Pi(\pi_0(x_i))=\Pi(\pi_0(x_{i+1}+1\mod{26})$$ which by the permutation property tells us that $$\pi_0(x_i)=\pi_0(x_{i+1}+1\mod{26})$$ which is the tells us the cycle representation of the permutation $\pi_0^{-1}\circ\sigma\circ\pi_0$ where $\sigma$ is the cycle $(0,1,\ldots,25)$. This is a full cycle permutation, of which there are $25!$ so that there are 26 possible values of $\pi_0$ amongst the full $26!$ possible permutations of 26 characters and we should be able to uniquely identify $\pi_0$ in a list of 100.

Once $\pi_0$ is recovered, we can recover $\pi_1$ in a similar fashion by considering chosen plaintexts where $s+t=0\mod{26^2}$ and $s+t=26\mod{26^2}$ and so on for the remaining rotors.

  • $\begingroup$ Glad you've answered! There are other questions like mine in crypto-SE but none of them provided a good answer. There were some who claimed a modern rotor cipher can be secure under certain conditions in exchange for a convenience/security tradeoff. I kinda understand why it is insecure now. Your explanation also makes sense considering that Germans sending same messages encrypted twice with same configuration of rotors has led to enigma-encrypted messages getting deciphered by Allied codebreakers quite often. It seems rotor machines are device of past, as far as I see they can't be revived. $\endgroup$ Commented Jan 26, 2023 at 12:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.