# A modern rotor machine, could it be any safe?

I wonder if a rotor machine similar to enigma can be considered secure by today's standards under four conditions:

1. A rotor machine which consists of 50 rotors picked out of a set of 100.

2. A rotor machine in which a letter can encipher to itself.

3. You can select the very same rotor multiple times.

4. No plugboards, no secret wirings, and no operational errors

So with these in mind, can it be considered safe in terms of the needs of modern era, especially against known-plaintext and chosen-plaintext attacks?

I kind of don't know so I decided to ask, any answer will be appreciated.

• In crypto, the devil lies in the details. Like how the rotors are stepped (in particular: past some threshold, increasing the number of rotors that in practice never move does not sizably increase security), the setup procedure, how many different letters/contacts per rotor there are, how "a letter can encipher to itself" is achieved (is it by removing the reflector, or some other method), and the amount of known plaintext.
– fgrieu
Commented Jan 26, 2023 at 7:04

Assuming that you machine is Enigma like with "odometer" stepping, but omitting the Umkehrwalze that introduces the "no fixed point" property, we can describe a set-up device using an initial step position $$s$$ (which I'll take to be secret rather than a known IV) and fifty permutations $$\pi_0,\ldots,\pi_{49}$$ on the set of 26 characters. In this case your device would be encrypt the input $$x$$ at position $$t$$ in the message as $$\pi_{49}(\pi_{48}(\pi_{47}(\cdots\pi_1(\pi_0(x+(s+t)\mod{26})+[(s+t)/26]\mod{26})\cdots+[(s+t)/26^{47}]\mod{26})+[(s+t)/26^{48}]\mod{26})+[(s+t)/26^{49}]\mod{26}),$$ or more iteratively/compactly as $$y_{50}$$ where $$y_0=x$$ and $$y_{i+1}=\pi_i\left(y_i+\left[\frac{s+t}{26^i}\right]\right).$$
I'll first describe how to recover $$\pi_0$$ using CPA analysis. Using Banburismus-like methods, I can recover $$s\mod{26}$$, I'll take 26 plaintexts where the plaintext characters in the first positions where $$(s+t)\mod{26}=0$$ and $$(s+t)\mod{26}=1$$ are AA, BB, CC, DD,... ZZ. As the position of the other rotors does not change between our chosen characters we can treat the encryption of these as $$\Pi(\pi_0(x))$$ and $$\Pi(\pi_0(x+1\mod{26})$$ for some fixed permutation $$\Pi$$. As we have a full set of inputs to these permutations we can remove $$\Pi$$ by creating a cycle of letters with $$x_0=A$$ and choosing $$x_{i+1}$$ such that $$\Pi(\pi_0(x_i))=\Pi(\pi_0(x_{i+1}+1\mod{26})$$ which by the permutation property tells us that $$\pi_0(x_i)=\pi_0(x_{i+1}+1\mod{26})$$ which is the tells us the cycle representation of the permutation $$\pi_0^{-1}\circ\sigma\circ\pi_0$$ where $$\sigma$$ is the cycle $$(0,1,\ldots,25)$$. This is a full cycle permutation, of which there are $$25!$$ so that there are 26 possible values of $$\pi_0$$ amongst the full $$26!$$ possible permutations of 26 characters and we should be able to uniquely identify $$\pi_0$$ in a list of 100.
Once $$\pi_0$$ is recovered, we can recover $$\pi_1$$ in a similar fashion by considering chosen plaintexts where $$s+t=0\mod{26^2}$$ and $$s+t=26\mod{26^2}$$ and so on for the remaining rotors.