Professional Documents
Culture Documents
The Hagelin M-209 Cipher Machine: Gjøvik University College Cryptology 1
The Hagelin M-209 Cipher Machine: Gjøvik University College Cryptology 1
Cryptology 1
John-Andr Bjrkhaug
2013.10.01
Abstract
During WW2 cipher machines were extensively used, both by the allied and axis
nations. Most famous is the German Enigma machine. The allied used multiple
machines, but the Swedish M-209 stood out. The fully mechanical, and impressive
complex machinery, was produced in the amazingly amount of 140000 during
WW2, and used by multiple allied nations. This paper will first give a short
introduction to cryptographic rotor machines, describe the history of Boris
Hagelins cipher machines, then discuss details of the M-209s, its mechanical
properties, how its ciphering works, how to use it, and cryptanalysis work done on
it.
Table of Contents
1
Introduction ......................................................................................................................... 3
3.1.
3.2.
Setup .......................................................................................................................... 10
3.3.
Accessories ................................................................................................................ 11
3.4.
Cryptanalysis ............................................................................................................. 11
Conclusion ........................................................................................................................ 13
Reference .................................................................................................................................. 14
1 Introduction
The first rotor cipher machines were developed at the end of WW1, including the one that after
some modifications would become the most famous of them all, the Enigma. It was invented
by Arthur Scherbius, and cryptanalyzed at Bletchley Park during WW2. But there was another
less famous rotor machine, which was just as important during WWII, the Swedish Hagelin M209. Produced in a stunning amount of approximately 140000, and used mainly by the US Army
and Navy, but also by other allied nations, like Norway.
This paper will first give a short introduction to cryptographic rotor machines, describe the
history of Boris Hagelins cipher machines, starting in 1925, leading up to the M-209 in WW2,
the successors of this complex little machine, and ending in the 1960s, when the electronic age
was entered. The text will then discuss details of the M-209s, its mechanical properties, how its
ciphering works, how to use it, and at last a part about cryptanalysis work done on it.
teeth in a cogwheel in a variable gear. A type wheel was then turned the same number of rounds
as bars in their left position. The keys in the changing machine were switched with pin-wheels,
and the type wheel now carried letters instead of numbers. Hagelin have now built the C-35
ciphering machine with 25 horizontal bars in the cage and five pin-wheels. The cage is also
discussed in detail in chapter 3. The numbers of letters on the wheels were 17, 19, 21, 23 and
25, which made them align after 3900225 enciphered letters.
It was later made several changes to the C-35, making in
more suitable for tactical use, adding one pin-wheel, and
introduce movable lugs on the bars in the cage. The pinwheel and cage changes were made in a direct response to
cryptoanlysis work made by the Swedish cryptoanalyst
Yves Gylden in 1935. The changes led to the model C-36.
The numbers of letters on the wheels were 26, 25, 23, 21,
19 and 17, which made them align after 101405850
enciphered letters.
In 1937 Hagelin travelled to the US, trying to get the
Figur 1: C-35
Figur 3: BC-38
have a pure mechanical enciphering/deciphering process. The only electric parts is a motor and
its driving circuit. The motor is only used for driving the mechanical encipher/decipher
method. It can also be used without electricity, by driving the encipher/decipher process by a
handle on the right side, much like on the M-209.
Near the end of WW2, even the Germans showed interest in Hagelins BC machine to replace
the Engima, since it had been broken by the British at Bletchley Park. Since Sweden was neutral
they had no problems with selling to both sides. Germany even started to produce Hagelin
machines under license, and kept doing so into the 1950s. There were also licensed production
in France.
In the end of 1944 and beginning of 1945, Hagelin came with a slightly modified version of the
M-209, the C-446. At first sight there were not many changes, but it had two printers, one for
clear text and one for cipher text, and two locks, one for the operator and one for the offices.
But the most interesting part is that the C-446 also came with a version without the pin-wheels.
Instead it had a reader for one-time pad paper tape, which with truly random keys generated a
cipher which Claude Shannon in his world famous 1949 paper Communication Theory of
Secrecy Systems termed perfect secrecy. Perfect secrecy means that the cipher gives no
additional information about the plaintext, and is unbreakable. The most famous one-time pad
6
even more secure. The machine also had five more bars in the cage than the M-209, in a total
of 32 bars. The extra five bars controlled the irregular stepping of the pin-wheels. Using the
wheels with twice the numbers of letters than the M-209 wheels, and a special lug configuration
in the cage, made the machine compatible with the M-209, BC-38 and C-446.
A bad design in the irregular pin-wheels stepping made the last of the six wheel move in a way
that it did not contribute very much to the security of the machine. This was fixed in a new
version called the CX-52. The CX-52 came in many different versions including one with a
one-time pad paper tape reader instead of the pin-wheels, and one with Arabic letters.
The CX-52 were Hagelins most successful mechanical cipher machine, both commercially and
technically. It was sold to over 50 countries, and in use even after Hagelin started to produce
fully electronic machines in the 1960s. The CX-52 was used as backup machines during the
cold war into the 1980s, and by some countries all the way into the 1990s.
In 1992, it came into the light that the National Security Agency (NSA) in 1957, only five years
after they were formed, made a deal with Hagelins company, Crypto AG, to place a backdoor
in, among other cipher machines, the CX-52. This backdoor made the NSA able to easily
decrypt messages sent by the Iranian Isalmic regime, Saddam Hussein, Moammar Gadhafi,
Ferdinand Marcos, Idi Amin, and even the Vatican. The backdoor access was also shared with
the British intelligence service Government Communications Headquarters (GHCQ). After this
it was widely accepted that this machine was not more used [OSVDB]. In September 2013 there
was a huge media coverage in connection with the Edward Snowden leakage, that the NSA had
backdoors into communication and cryptology equipment. The press wrote about this as it was
7
3 The M-209
The M-209 is very small, about the size of a lunchbox, measuring only 83 x 140 x 178 mm, and
weighing a little over 3 kg including its rugged case. The small size, its low weight, and the fact
that it is non-electrical, made the M-209 well suited for tactical use on the battlefield. It is no
problem for the machine to survive hard shocks, dust, sand, tropic humidity or arctic cold
[Kahn]. In addition the machine is capable of performing both enciphering and deciphering,
which is a huge plus compared to many other ciphering machines.
The most important parts in the machine is the cage, the key wheels and the guide-arms which
bind them together.
The drum bar cage, also known as the lug cage, but mostly called just the cage, consists of
27 horizontal bars between two disks, which forms a revolving cylinder. Each bar has two
movable lugs which can be placed in eight positions. Two neutral, and six positions which
interacts with the key wheels. Depended on the lug and key wheel pin setting, the individual
bars can slide to the left, and add a cog tooth to the variable gear. The number of bars in their
left position is the same as the offset between the clear text letter and the cipher text letter.
Each letter on each wheel has a movable pin. Setting the pin to the right means that the letter
position is enabled, and to the left for disabled. An enabled letter position will in turn set the
wheels guide arm in its operative position, which determines whether lugs in the cage is
contacted. If a lug is in contact with a guide arm, its bar slide to the left, and interact with the
cogs in the variable gear, as previously mentioned.
The wheels have the following letters:
Wheel 1: ABCDEFGHIJKLMNOPQRSTUVWXYZ
Wheel 2: ABCDEFGHIJKLMNOPQRSTUVXYZ
Wheel 3: ABCDEFGHIJKLMNOPQRSTUVX
Wheel 4: ABCDEFGHIJKLMNOPQRSTU
Wheel 5: ABCDEFGHIJKLMNOPQRS
Wheel 6: ABCDEFGHIJKLMNOPQ
3.2. Setup
Before use the operator needs to set the two lugs on each of the 27 horizontal bars in the cage
and enable or disable the pins under each letter on each wheel. This is a complex process that
takes quite a bit of time. These settings are called the internal key. Because of this the settings
was changed relatively infrequently. Once a day was common. The setup was done with the
help of tables, distributed equally to the sender and recipient. An example setup table can be
seen in Table 1.
NR
01
02
03
04
05
06
LUGS
3-6
0-6
1-6
1-5
4-5
0-4
1
A
B
D
-
2
A
D
E
-
3
A
B
-
4
C
E
F
5
B
D
E
F
6
A
B
BAR
01
02
03
04
05
06
D
-
10
1
X
X
-
2
-
3
X
-
4
X
X
5
X
X
-
6
X
X
X
-
0-4
0-4
0-4
2-0
2-0
2-0
2-0
2-0
2-0
2-0
2-0
2-0
2-0
2-5
2-5
0-5
0-5
0-5
0-5
0-5
0-5
H
I
K
M
N
S
T
V
W
-
G
J
K
L
O
R
S
U
X
-
G
H
I
J
L
M
N
R
S
T
U
X
H
I
M
N
P
S
T
U
H
M
N
P
S
H
K
N
O
Q
07
08
09
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
X
X
X
X
X
X
X
X
X
X
X
X
-
X
X
X
-
X
X
X
X
X
X
X
X
Plaintext: AAAAAAAAAAAAAAAAAAAAAAAAAA
Cipher: TNJUW AUQTK CZKNU TOTBC WARMI O
Table 1: Example setup sheet [Cryptomuseum]
When the internal settings are set, the operator set the start position on the key-wheels. This is
called the external key, and is changed from message to message. This key is inserted into a
prearranged position in the cipher text, which makes the deciphering operator set his machine
to the correct start position.
3.3. Accessories
On the inside of the top lid, there is
compartments for accessories, see Figure 6. At
the center of the lid there is a paper tape holder,
on the left side there is a screwdriver for
opening the machine when setting the lugs and
pins, a cylinder with blue or purple ink and one
with oil. On the right side there is a pair of
tweezers used for feeding the paper tape through
the printer and removing blocked paper tape.
Figur 6:Accessories inside the M-209s lid
3.4. Cryptanalysis
The security of the M-209 was good for its time, but not perfect. Unlike one other cipher
machine used by the US in WW2, the SIGABA, M-209 cipher texts could be decrypted by hand
relatively easy once the enemy knew the internal mechanics of the machine. This was done
11
12
4 Conclusion
The Hagelin M-209 was a very advanced ciphering machine, ahead of its time. The fact that it
was fully mechanical, was an amazing achievement. In addition the M-203 was very small,
rugged and able to perform both enciphering and deciphering which made it perfect for tactical
use. But one thing to think about today, is how much work it was to change the internal
ciphering key, compared to how easily this can be done on todays crypto equipment. I cant
imagine how frustrating this could be for soldiers in the field, with bullets flying around them.
But I guess this was the reason keys most often were changed once a day.
The machine built on principles from the early 1920s, and was improved to the last rotor
machine from Boris Hagelin, the CX-52, which still today is hard to decrypt by an adversary.
One interesting thing today, after the Snowden leakage on NSA backdoors, is that they already
had backdoors as early as in 1957 in the CX-52.
13
Reference
[Beckman]
[Hagelin]
[Johnson]
[Kahn]
[Menezes et al.]
[OSVDB]
[Rice]
[Rijmenants]
[Ritchie]
[Trappe et al.]
[Wikipedia1]
[Wikipedia2]
[Wikipedia3]
[Wikipedia4]
[Wikipedia5]
M-209, http://en.wikipedia.org/wiki/M-209
[Wikipedia6]
[Wikipedia7]
14