Enigma Machine
A vast settings space, attacked through Polish mathematics, Allied crib searches and sustained operational work.
Polish prewar reconstruction; later Allied crib searches and bombe machinery.
A faithful Wehrmacht Enigma I, in the browser. Choose three rotors, set the rings,
position the wheels, wire the plugboard, and type. The rotors step on every keypress
— including the famous middle-rotor double-step. Verified against the canonical test
vector AAAAA → BDZGO.
Symmetric by design. Enigma encrypts and decrypts with the same machine state. To decrypt, set the same rotors, rings, positions, and plugboard, then type the ciphertext. The original plaintext appears.
Why This Matters
Breaking Enigma contributed important intelligence during World War II. Estimates of how much Allied signals intelligence shortened the war concern the wider ULTRA effort and are historical counterfactuals, not measurements attributable to this cipher alone.
Arthur Scherbius patented the Enigma machine in 1918 as a commercial product. The German military adopted it in 1926 and progressively enhanced it throughout WWII. At its peak, the three-rotor Enigma I had 158,962,555,217,826,360,000 combinations of rotor order, starting positions, and ten plugboard pairs with ring settings fixed — and the naval M4 more still.
The Polish breakthrough. The story properly begins not at Bletchley but in Warsaw. In 1932 the young Polish mathematician Marian Rejewski, working for the Biuro Szyfrów with colleagues Jerzy Różycki and Henryk Zygalski, reconstructed the wiring of the German Army Enigma's rotors using intercepted traffic and compromised documents obtained through French intelligence. Rejewski did this by formulating message-key permutations as group-theoretic equations and solving them. By 1938 the Poles were reading roughly three-quarters of intercepted German Enigma traffic, using their own electromechanical machines (the bomba kryptologiczna, a predecessor using a different attack) and Zygalski's perforated sheets.
The handover. When Germany added two new rotors and changed procedures in late 1938, the Polish bureau's lead shrank. On 25 July 1939, five weeks before the German invasion, Rejewski and his colleagues met British and French cryptanalysts in a forest near Pyry, south of Warsaw, and presented them with everything: the rotor wirings, the bomby, the Zygalski sheets, working Enigma replicas. The handover supplied crucial knowledge and equipment, building on earlier work in several countries.
Hut 6 and Hut 8. At Bletchley Park, Hut 6 (under Gordon Welchman, then Stuart Milner-Barry) attacked German Army and Luftwaffe Enigma; Hut 8 (under Alan Turing, then Hugh Alexander) attacked Naval Enigma — a far harder problem due to rigorous procedures and, from February 1942, the four-rotor M4 used by the U-boat fleet. Naval decrypts helped convoy routing and anti-submarine operations, alongside other intelligence and operational measures.
Turing's bombe and Welchman's diagonal board. Turing's bombe mechanised crib-based attacks: given a guessed plaintext fragment, it tested rotor settings electrically at the rate of thousands per minute, exploiting the loops in the implied permutation graph. Welchman’s diagonal board strengthened the constraint checking by exploiting reciprocal plugboard connections. Over 200 bombes were built, operated by Wrens working in shifts day and night.
Strategic impact. Sir Harry Hinsley, the official historian of British intelligence in WWII, estimated that ULTRA — the codename covering decrypts from Enigma and other systems — shortened the war in Europe by at least two years and "possibly four." This is a historical estimate rather than a measurable counterfactual. The value of particular decrypts varied by campaign and period.
Sources: Hinsley, “British Intelligence in the Second World War,” HMSO 1979–1990; Kozaczuk, “Enigma,” 1984; Welchman, “The Hut Six Story,” 1982; Hodges, “Alan Turing: The Enigma,” 1983.
Three-rotor Enigma (basic model): 1. Plugboard: swap 10 pairs of letters (150 trillion possible settings) 2. Three rotors: the rightmost advances before each letter; notches govern the others (17,576 rotor position combinations) 3. Reflector: sends signal back through rotors in reverse (this is Enigma's fatal flaw: a letter can never encrypt to itself) 4. Rotor selection: 3 from 5 rotors (60 rotor order combinations) Total: ~158 quintillion settings But: same letter never encrypts to itself → cribs work
Enigma's fatal flaw: a letter can never encrypt to itself (the reflector guarantees this). If you know (or guess) a plaintext word — called a crib — you can eliminate all configurations where any crib letter would encrypt to itself. Weather vocabulary could supply useful guessed plaintext, though message formats varied. A correct crib supplies constraints for key search, while an incorrect guess can fail to produce a valid candidate. The Bombe machine tested the remaining configurations electromechanically at thousands per minute.
Predictable plaintext, repeated settings, captured material, and operating procedures gave attackers useful information. Machine structure mattered too: the reflector’s no-self-encipherment property helped reject impossible cribs. It is misleading to attribute the breaks exclusively to human error rather than mathematics.
1 · Self-encryption rejection
Enigma's reflector means no letter can ever encrypt to itself. This fact lets you reject impossible candidate alignments of a crib without testing rotor settings: if any letter of the crib lines up with the same letter in the ciphertext, that placement is impossible.
Each row is a candidate placement of the crib over the ciphertext. Rows in red are impossible (a crib letter would have to encrypt to itself). Rows in green survive and would be passed to the bombe for full testing.
2 · Brute-force rotor & position search
With the plugboard and ring settings fixed, the rotor order and starting positions form a search space of 60 × 17 576 ≈ 1 054 560 configurations. The bombe was needed because the plugboard explodes this by a further factor of ~1.5 × 1014. Without the plugboard, the search is small enough to run in your browser. Below: enter a ciphertext encrypted with rings AAA and no plugboard, give it a known crib, and watch the search recover the rotor settings.
The defaults reproduce the canonical "AAAAA → BDZGO" vector and its 25-letter extension. The search recovers I · II · III at positions AAA. Click "Load into machine" on any candidate to test it above.
Honest scope. This browser search enumerates rotor orders and starting positions while fixing rings and plugboard. It is not a simulation of the British Bombe’s menu constraints or diagonal board. Ten plugboard pairs alone have 150,738,274,937,250 arrangements, but multiplying search spaces is not a description of the historical attack. The separate Bombe exhibit explains that distinction.
| Concept from Enigma Machine | Modern Evolution |
|---|---|
| Rotor substitution per keypress | AES: round keys change each round, creating a different transformation per step |
| Reflector creates a no-self-encipherment constraint | Reciprocity alone is not a weakness; XOR-based stream encryption also uses a self-inverse operation |
| Physical key distribution (codebooks) | Diffie–Hellman enables public-channel key agreement; authentication and key management still matter |
| Structure and operational procedures both mattered | Modern systems also need side-channel defenses and sound key-handling procedures |
Plaintext: A T T A C K
Settings: Rotors I-II-III, Reflector B
Ring setting: 01-01-01 (AAA)
Plugboard: (A↔M) (T↔G)
Start position: A-A-Z
Encrypting the first letter "A":
(Rotor III steps first: positions A-A-Z → A-A-A)
1. Plugboard: A → M (A is swapped with M)
2. Rotor III: M → maps to Z
3. Rotor II: Z → maps to E
4. Rotor I: E → maps to L
5. Reflector B: L → maps to G
6. Rotor I ← G → maps to F
7. Rotor II ← F → maps to W
8. Rotor III← W → maps to R
9. Plugboard: R → R (no swap for R)
Lamp "R" lights up.
Full message: ATTACK → RXWKBV
Stepping occurs before encipherment. The rightmost rotor advances each time.
Notch positions trigger the other rotors, including the middle double-step.
Changing rotor state changes the substitution, but an individual
plaintext letter can still produce the same output at different positions.The encryption side of Enigma is well-covered on the open web. Several excellent simulators and explainers already exist; the rotor-search and crib-rejection demos above are this museum's contribution. The resources below offer further explanations, simulators and historical accounts.
Video explainers
-
Mike Pound & Computerphile — Enigma & the Bombe playlist ↗
Dr Pound's University of Nottingham series is the gold-standard general-audience explanation. The videos explain the machine and crib-based attacks. -
Bletchley Park Trust ↗
The site itself, in Buckinghamshire — Hut 6, Hut 8, the rebuilt Bombe in Block H. If you can visit, do.
Other interactive Enigma simulators
-
Louise Dade — Enigma Simulator ↗
Long-running, accurate, and visually beautiful — a skeuomorphic interface that mimics the look and feel of a real Enigma I machine. Best for the tactile experience. -
Cryptii — Enigma pipe ↗
An in-browser cryptography toolkit. Clean UI, real Enigma logic, and uniquely lets you chain Enigma with other ciphers in a visual pipeline. -
101computing.net — Enigma Machine Emulator ↗
A polished, classroom-friendly simulator with configurable rotors, plugboard, and ring settings. Widely used in UK GCSE and A-level computer-science teaching.
Cryptanalysis & the Bombe
-
Tony Sale — Virtual Bombe ↗
The late Tony Sale led the rebuilding of Colossus at Bletchley. His menus-and-diagonal-board walkthrough of the bombe is the most authoritative source on the open web. Dense but accurate. -
Crypto Museum — Enigma index ↗
The reference for rotor wirings, machine variants, and operating procedures. The wirings used in this exhibit's engine were verified against this site.
Books
- Hodges, Andrew. Alan Turing: The Enigma. Princeton University Press, 1983 (rev. 2014). The definitive biography; chapters 4–6 cover Hut 8.
- Welchman, Gordon. The Hut Six Story. McGraw-Hill, 1982. First-person account by the architect of the diagonal board.
- Kozaczuk, Władysław. Enigma: How the German Machine Cipher Was Broken. University Publications of America, 1984. The Polish side of the story, in detail.
- Hinsley, F. H. British Intelligence in the Second World War. HMSO, 1979–1990 (5 vols). The official history; source for the "two-to-four-year" shortening estimate.
| Exhibit | 29 of 172 |
| Era | WWII · 1918–1945 |
| Trust | Broken |
| Inventor | Arthur Scherbius (inventor) · German Armed Forces (operator) |
| Year | 1918 (patent) · 1926 (military adoption) |
| Key Type | Rotor selection, rings, positions and plugboard settings |
| Broken By | Polish reconstruction; later Allied cryptanalysis and Bombe searches |
Three naval M4 signals intercepted by HMS Hurricane in the North Atlantic in 1942 went unread at the time. Ralph Erskine reprinted them in a 1995 letter to Cryptologia as an open challenge, and for a decade they were the best-known still-unsolved Enigma traffic.
In January 2006 Stefan Krah launched the M4 Message Breaking Project, a distributed-computing effort combining brute-force rotor search with hill-climbing on the plugboard. The first signal fell on 20 February 2006 — Kptlt. Hartwig Looks of U-264, forced under by depth charges. The second fell on 7 March 2006 — a routine sighting-and-weather report signed Schroeder, matching the war diary of U-623.
The third resisted for another seven years. It was broken in January 2013 by Dan Girard, with Michael Hörenberg, and proved to be a fuel-and-provisions report from Kptlt. Hermann Rasch of U-106. None of the three remains unsolved.
These later solutions combined historical knowledge, cryptanalytic search and substantial computation. They do not establish that every surviving Enigma message is solvable under the same conditions.
Sources: Stefan Krah, M4 Message Breaking Project ↗; Michael Hörenberg, Breaking German Navy Ciphers ↗; John Leyden, “Codebreakers unravel second Enigma intercept,” The Register, 15 March 2006; Ralph Erskine, letter to Cryptologia, 1995.
British planners concealed ULTRA's true source by attributing critical insights to a fictional high-level human spy codenamed Boniface. This deception protected the Enigma break by explaining "impossibly accurate" intelligence without revealing cryptanalytic capability.