If cryptanalysts today were to crack the original Enigma machine, “how fast” or “how easily” could they do it? What methods would they use?

The original cracking was significantly helped by operator mistakes, like always including the same header, always including a weather report, and finally, a long message of LLLLLLLL… being sent. Let's assume no such operator mistakes happened.

  • 2
    $\begingroup$ Does the question also assume that the workings of the Enigma machine (all versions) are made available to the cryptanalyst, in accordance with Kerckhoffs's principle? $\endgroup$
    – Thomas
    Commented Jan 27, 2014 at 7:44
  • $\begingroup$ AES is believed to be (IND-CPA) secure even if the plain text is chosen by the attacker, so why do you include the restriction of no operator errors? $\endgroup$ Commented Jan 27, 2014 at 9:31
  • 1
    $\begingroup$ @vsz, the mistakes were helpful, but remember that the mechanism had been for sale as a commercial product, so the "how" of Enigma was a matter of public record. The original WWII military machine descended from the commercial product, and the original solution, in principle, was worked out by two Polish intelligence officers before the war. All of e-sushi's comments are quite on point, but I'd pull back even a bit further. David Kahn's books, "The Codebreakers", and particularly, his later "Seizing The Enigma", go into the nuts and bolts of the historical solution. Knowing how the actual so $\endgroup$
    – Bill IV
    Commented Apr 10, 2015 at 4:10
  • $\begingroup$ Much of the answer will depend on what qualifies as "operator mistakes" and to what degree they are known; what "the original Enigma machine" is assumed to be (there was several variants, even the number of rotors was variable); and if the wiring of rotor (and plugboard, if any) is assumed known or not. $\endgroup$
    – fgrieu
    Commented Apr 10, 2015 at 10:58
  • 2
    $\begingroup$ "Cracking Enigma" was not a single event. The 3 different German military arms used the machine 3 different ways. Cracking 1 didn't yield actionable intelligence from the other 2. Hence the pointer to history. The OP asks how modern crypt analysts would go about cracking Enigma, in the absence of operator mistakes. And, by implication, without knowledge of the machine itself. But which Enigma? What constitutes "cracking"? Knowing some history would allow the question to be better focused, and make the answer more useful. $\endgroup$
    – Bill IV
    Commented Apr 12, 2015 at 0:31

4 Answers 4


What methods would they use?

Since WW2, we know the security of Enigma machines was weakened by the reflector, resulting in two problems:

  1. No difference between en- and decryption, which means that if K ↦ T, then T ↦ K.
  2. No letter can be encrypted by itself because electricity can not travel the same way back, which results in a reduction of encryption alphabet.

Also, history has shown that Enigma had another security problem: the contradiction to Kerckhoffs' principle "The security of a system should not depend on the privacy of the algorithm. It should only be based on the secrecy of the key.".

Enigma got it wrong because:

  • Security of Enigma depended on wiring of rotors,
  • Wiring was part of algorithm and not part of key, and
  • Wiring never changed from 1920s until 1945.

(source: https://www.infsec.cs.uni-saarland.de/teaching/SS07/Proseminar/slides/maurer-Enigma.pdf)

Since you're asking about today, I will therefore assume the fact that we know about the internal workings of Enigma since WW2.

Based on your assumptions and the known Enigma weaknesses, one of the well-known attacks to break Enigma is using the Index of Coincidence (short: IC), a statistical measure of text which distinguishes text encrypted with a substitution cipher from plain text.

Let's put Enigma into the formula: $IC = \frac{{\textstyle \sum_{i=0}^{25} } f_i(f_i-1)}{n(n-1)}$ where $x_1,...,x_n$ is the string of letters and $f_0,...,f_{25}$ the frequency of the letters in that string. For a random string that boils down to $IC ≈ 0.038$ and for a natural language $IC ≈ 0.065$.

I'll skip the details and simply give you some raw numbers while summing up how IC can be used for an attack on Enigma:

  1. Find the rotor order
    Trying all rotor orders and positions searching highest IC takes $60*26^3 ≈ 2^{20}$ operations.
  2. Approximation to rotor start positions
    Starting with a rotor order from step $1$ and $w$, trying all rotor positions and ring positions for 1st ring only, again searching highest IC. That takes $26^4 ≈ 2^{19}$ operations.
  3. Find ring and rotor start positions
    We have the 1st ring and 1st rotor start positions, approximations for other rings and starting positions from 1 and 2. First search positions for the 2nd ring and rotor, then use the same procedure for last remaining rotor. This will take $26^2 ≈ 2^9$ operations.
  4. Find the plug settings
    We have the rotor order, position and ring positions. Now we can use IC as statistical test again, deriving of the trigram information of the underlying language.

how fast/ how easily could they do it?

Generally, that's hard to say without having any specific information about available resources you are assuming an attacker would have.

A single computer might take a little while depending on how old it is (in terms of CPU power), but things like distributed networks will probably make you cry by successfully attacking Enigma in a few blinks of an eye. If you happen to have any specific computing setups in mind, you can take the provided number of operations mentioned above and simply do the related maths to calculate the related speeds.

And last but not least - to answer the title of your question too...

How cryptographically secure was the original WW2 Enigma machine, from a modern viewpoint?

Totally insecure. The weaknesses described above provide ample proof to that claim.

On the other hand, we can't really compare today with the situation during WW2. They used machines that were mainly mechanical (eg: Bletchley Park Bombe), while we have computers with powerful CPUs. WW2 cryptanalysts would probably have killed to get their hands on such a futuristic "wunder Maschine" which we use to do simple things like surf the internet.

Nota Bene: If you're interested in the maths behind Enigma, you might want to check on "The Cryptographic Mathematics of Enigma" by Dr. A. Ray Miller, The Center for Cryptologic History – National Security Agency.

The above publication certainly provides more insights related to the internals and maths behind Enigma than the usual NSA "freebee" stuff (PDF) which tends to restrict itself to talking about the history instead of cryptography.

Edit: The last two links are now offline and seem to have been removed from the nsa.gov website. As they are still available via web.archive.org, the links have been updated point there.


There is a full breakdown of key size on a website talking about the “Technical Details of the Enigma Machine”. To sum up:

  • If all rotor combinations are included then you have a possible $3*10^{114}$ possible keys. However, that didn't happen (the operators would need to keep $\frac{26!}{26}=1.5*10^{25}$ rotors at hand if they didn't allow repeats).
  • By selecting $3$ out of the existing $5$ rotors you have 60 combinations and each rotor has $26$ positions, the first 2 rotors also have a settable advancement ring for another 26 possible settings. This gives $60*26^3*26^2=712,882,560$ which is a 30 bit key equivalent.
  • This is without the plugboard which (with 10 cables) adds a factor of $150,738,274,937,250$ resulting in a 77 bit key.

  • If the message exceeds $17576$ characters then the key will cycle back to the start. So if there is a longer message you know where to overlap them.

  • Then there is the issue that letters never map to themselves. The enigma is also weak against a known plaintext in a sequence of cyphertext by a crib attack, as described at a website talking about “The Turing Bombe”.


It looks like with no leakage or errors, Enigma is still secure.

Quoting the Enigma@Home project website:

Enigma@Home is a wrapper between BOINC and Stefan Krah's M4 Project. “The M4 Project is an effort to break 3 original Enigma messages with the help of distributed computing. The signals were intercepted in the North Atlantic in 1942 and are believed to be unbroken.”

Given how the war ended, it would seem all encryption details would have been captured in 1945 - although the Germans might destroyed some of the secret documents about key changing.

I think that short and true messages, for which the rotor positions aren't known, would allow you effectively unbreakable communication. However, in the current digital age, encrypting a large amount of Traffic (eg HTTP) with original Enigma would not be a good idea.

  • 5
    $\begingroup$ Any cipher is 'unbreakable' if the message is short enough. $\endgroup$
    – Dillinur
    Commented Apr 13, 2015 at 7:04
  • $\begingroup$ You can't call anything "secure" from today's point of view, when it can only withstand ciphertext-only attacks or other unrealistic assumptions like short messages, very few messages, etc. $\endgroup$
    – tylo
    Commented Feb 7, 2017 at 12:01
  • $\begingroup$ Saying that Enigma is still secure is an astonishing comment, isn't it? $\endgroup$
    – Patriot
    Commented Jul 7, 2019 at 12:32
  • 1
    $\begingroup$ Yes it is astonishing. But doesn't it make sense? Treason, treachery, and incompetence would be a far more likely source of Engima codes than Bletchley park, given the equipment at the time. $\endgroup$ Commented Aug 6, 2021 at 15:13

Initially, part of the operation was transmitting three letters twice. It turned out that doing this for about 90 messages with the same settings allowed reverse engineering of the wheels. (I vaguely remember that knowledge of the switchboard was also needed, and that was achieved by non-cryptographic means. My guess is a room cleaner writing down the settings. I don’t know whether in the later more secure operation reverse engineering would have been possible.

In every state, the enigma produces a permutation of 26 letters. A permutation is the product of cycles, for example a->t->f->r->a would be a 4-cycle. So every state produces a pattern of cycle lengths. This pattern is not affected by the switchboard and not affected by rotating the wheels. The pattern can be detected if you have enough messages and when detected, the key space is massively reduced. (Similar to DeCSS where a 40 bit key can be split into a 25 and a 16 bit key).

(All from memory, reality might be different).


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.