M-209 (Hagelin C-38)
The US Army's portable WWII pin-and-lug cipher machine
Strong (tactical)
The interactive is a deterministic teaching model: a seed generates all six pin patterns and all 27 lug bars. It demonstrates the pin-and-lug mechanism but is not an operational key-sheet simulator.
Why This Matters
Boris Hagelin's C-38 design, sold to the US Army as the M-209, became the standard tactical cipher of American forces in WWII. Compact (about the size of a hardcover book), it weighed 2.7 kg and ran without electricity — a clerk operated it by hand, advancing a wheel and reading off ciphertext one letter at a time. The large production contract made the machine a major commercial success.
Hagelin's family company — Cryptoteknik in Stockholm — had been producing pin-and-lug machines since the 1920s. When Germany invaded Norway in 1940, Hagelin escaped to the United States with the C-38 design rolled up under his arm. The US Signal Corps bought it, mass-produced it as the M-209, and shipped 140,000 units to the front lines. The cipher was known to be vulnerable to skilled cryptanalysis (German Army cryptanalysts broke many M-209 messages), so it was used only for tactical traffic — operational orders meant to be obsolete within hours of being intercepted.
Six pinwheels with co-prime lengths (26, 25, 23, 21, 19, 17) advance one position per letter. Each wheel has tiny pins around its edge, set to "active" or "inactive" by the operator. A bank of 27 lug bars reads which wheels are currently active and produces a displacement K from 0 to 27. The indicator alphabet is reversed, so with A=0 encryption uses the reciprocal transformation:
cipher = (25 - plaintext + K) mod 26With no displaced bars A becomes Z; with 20 displaced bars A becomes T. Because the wheel lengths are pairwise co-prime, the joint wheel positions repeat after 26 × 25 × 23 × 21 × 19 × 17 = 101,405,850 steps. The output keystream can have a smaller period, depending on pin and lug settings.
If an attacker knows or guesses the plaintext of a message (a stereotyped opening, known place name, time stamp), the resulting key stream constrains the lug settings. German cryptanalysts in WWII broke many M-209 messages this way, though it took hours per message.
Because the key is a sum of binary signals modulo 26, certain shift values are over- or under-represented. With enough ciphertext, a statistical attack on the key distribution recovers the lug count for each wheel.
| Concept from M-209 (Hagelin C-38) | Modern Evolution |
|---|---|
| Pin-and-lug as keystream generator | Modern LFSR (linear feedback shift register) stream ciphers |
| Co-prime period maximization | Same trick used in pseudo-random number generators today |
| Beaufort involution | Encryption and decryption use the same operation |
| Exhibit | 47 of 169 |
| Era | World War II · 1940 |
| Trust | Broken |
| Inventor | Boris Hagelin (Sweden) |
| Year | 1940 (US Army adoption) |
| Production | ~140,000 units (Smith Corona, US) |
| Key Type | 6 pinwheels (lengths 26, 25, 23, 21, 19, 17) + 27 lug bars |
| Period | 101,405,850 wheel-position cycle; output period may divide it |
| Modern Lesson | Mechanical key streams need long periods |
See the Hagelin C-36 / C-52 lineage exhibit for the family and Crypto AG history. The M-209 belongs to the broader Hagelin line (C-36, C-38/BC-38, and M-209). These pin-and-lug pocket machines traded top-tier security for field practicality and became the standard tactical wheel ciphers for multiple armies.
Later Hagelin successors became part of the Crypto AG ecosystem connected to Operation Rubicon, where intelligence services reportedly leveraged supply-chain influence for cryptanalytic advantage.