# A Modernized Enigma?

I've seen answers here and elsewhere discussing how well the WWII Enigma could hold up to modern cryptanalysis, however, those answers always seem to assume the WWII conditions where the Germans had a limited number of rotor constructions, repeated patterns of plain text, and the Allies had access to a lot of the info about the rotors, their wirings and the limited combinations in use.

What if a software based enigma were executed with the following conditions:

1. 38 characters (versus 26)
2. ten rotors
3. the rotor settings, stecker settings, and rotor permutations themselves change with each message, all pre-planned using a cryptographically secure PRNG (i.e., the operator no longer chooses and transmits settings in a preamble)
4. assume (for sake of argument) no cribs and physical security - i.e., the attacker might have access to the encryptor, but not to any keys

How well would this hold up to modern cryptanalysis using super computers or networks? How long might it take to brute force it?

• [OT:] How to justify employing old technologies? (BTW no full Independence from computers due to CSPRNG.) – Mok-Kong Shen Oct 16 '16 at 8:25
• Not really saying this has to be independent from computers. It'd be an older tech with some modifications and automation by a computer. I think the massive permutations that were theoretically possible for Enigma but not practically possible may be more attainable with computer assistance. I'm just curious how well it'd fare against computer-assisted cryptanalysis today. – thebaker Oct 16 '16 at 9:44
• With that modified Enigma, it would remain that an input letter never enciphers to itself. Therefore, it can be ruled out that some ciphertext deciphers exactly to a certain plaintext, if that's long enough (about 40 characters); that can come handy for a firing order, known to have exactly a certain format. And mere frequency counting allows distinguishing from enough ciphertext if the plaintext is natural language, or already encrypted. Any of this qualifies as a successful attack in modern academic cryptography (if not practical cryptanalysis). – fgrieu Oct 16 '16 at 17:05
• That's a good point. What if we remove the reflector and allow for the possibility that letters encipher to themselves? What's the point of the reflector anyway, except perhaps to simplify the decryption process for electromechanical Enigmas? – thebaker Oct 16 '16 at 21:42
• Note: The National Cryptologic Museum at Ft. Meade, Maryland has two Enigma machines that are available to play with, these are the only ones I have seen that can be touched. – zaph Oct 17 '16 at 0:13

Looking at the possible setup combinations (key space): 10 rotors in random order each set to 1 of 38 positions is ~75-bits ( $\log_2(38^{10}\,10!)$ ). A plugboard of 38 is ~10-bits ( $\log_2\left(38 * 37\over2\right)$ ). The combined key would be ~85-bits of key material. Actually less because the rotors and plugboard suffer from a birthday attack.

AES supports key sizes of 128, 192 or 256 bits.

Thus such a machine would be substantially worse than AES just from brute force. Additionally there will probably be additional attacks which would make it even weaker.

Other issues:

1. If there is no crib how would you identify a correct decryption?
2. How will you securly share the "pre-planned" settings?
3. Settings were not transmitted in a preamble, they were in a pre-shared key sheet. A key sheet setting identifier could be sent in the message but that did not have the settings, it only identified the settings row in the current key sheet the receiver needed to already have.
• Thx for the LaTeX, I am still struggling with that. – zaph Oct 16 '16 at 16:32
• Thanks for the computations and answer. To discuss further some of your questions... – thebaker Oct 16 '16 at 18:58
• Other issues: If there is no crib how would you identify a correct decryption? - in this scenario, it's the attacker that has no crib How will you securly share the "pre-planned" settings? - this would be an in-person transaction. Assumes a small team of trustworthy agents. Settings were not transmitted in a preamble, they were in a pre-shared code book. - perhaps I'm misinformed, but I thought the Germans used the code book to transmit a new setting and then encrypted the rest of the message in the new setting? – thebaker Oct 16 '16 at 19:11
• From what I remember there was a new key sheet each month (or other duration). Each key sheet has an entry for each day. See Image for an example. The column Kenngruppen was to identify the key to the receiver, it was not a setting, just a reference to a row on the key sheet, the receiver had to have the corresponding key sheet to obtain the settings. – zaph Oct 16 '16 at 19:41
• See also Enigma Message Procedures. The Spruchschlussel or message key was essentilly an IV. – zaph Oct 16 '16 at 21:21

I've seen answers here and elsewhere discussing how well the WWII Enigma could hold up to modern cryptanalysis, ...

Ehm, quote? I would say, the general opinion about the Enigma is actually the very opposite. The Enigma is the prime example why such a drastic change in the cryptographic mindset was necessary, where it is not enough if you can't break your own cryptosystem yourself.

Cryptanalysis has gone a long way since then, and today it is not enough to be resistant to ciphertext-only attacks. Back then, the attacks on the Enigma were made much easier by having some partial known plaintexts.
Today we even assume the attacker to have a lot of plaintext/ciphertext pairs. And known-plaintext attacks are the very least what we consider secure today.

So building a new scheme from an old-and-broken design is quite a bad idea. In today's binary world (in computers) using any other alphabet does't make sense.

And then there is one more thing: You suggest having an RNG responsible for the choice of the rotors. They are what provides confusion and diffusion in the Enigma... but randomly chosen functions are really bad at that. There is a reason, why those steps are never chosen randomly in block ciphers.

So to answer your questions: Probably you can break it with a known plaintext attack within seconds on a normal computer. Brute force or ciphertext-only attacks don't matter at all (unless brute-force is the best known stragety). So even if the brute-force attack cannot be done within reasonable time, it doesn't matter.

• Opening sentence probably should've read "...how (not) well the WWII Enigma could hold up...". The point was that I've read through several similar discussions, but they all assume WWII conditions and Enigma configuration, whereas I was proposing a different set of assumptions. Still, you're point is taken, this is just one of several competing alternatives I'm looking at for a project. – thebaker Oct 19 '16 at 1:47
• Since you asked: crypto.stackexchange.com/questions/tagged/enigma is a list of questions and "answers here ... discussing ... the WWII Enigma". google.com/webhp?#q=Enigma+modern+cryptanalysis has a list of people elsewhere discussing Enigma and modern crypanalysis. In particular enigmaathome.net actually is breaking original Enigma messages with modern computers. They're taking much longer than your estimate. – David Cary Oct 19 '16 at 8:58
• @thebaker My answer was mainly adressed to the words modern cryptography in the question. Under the point of view of cryptanalysis back then, the Enigma wasn't that bad, although Kerckhoff made his famous statements in the 19th century already. In today's point of view, ciphertext only attacks are just not enough. For symmetric ciphers (Enigma is one), resistance against chosen message attacks is required to be considered secure. – tylo Oct 19 '16 at 9:58
• @DavidCary I know where the Enigma is discussed. I asked for references about people who think the Enigma is a good design from the point of view of modern cryptography. Also my estimate was about known plaintext attacks, and the link you provided adresses ciphertext-only messages. By the end of WWII, Bletchley park was able to break some ciphertexts within one hour. Considering computation power of today and the advances in algebra and combinatorics, I stand to that estimate of "seconds at most". – tylo Oct 19 '16 at 10:08