Firstly, against all my expectations and stories I’ve read so far, Gordon Welchman basically says that the Enigma encryption was broken twice, and independently, within three months of Britain entering World War 2. It is absolutely mind-blowing (at least for me).
Imagine a state-of-the-art encryption system that many other countries used to design their own encryption systems (including British) in the years leading to WW2, a system that was deemed unbreakable and became the communication backbone of German military, etc. This system has been broken within months of someone getting seriously interested in it!
Even more staggering is the fact that while there was a “bug” (advertised as a proof of the Enigma security at the time) in the machine design, the main reason for it being broken was the way it was used. And the way it was used was by no means stupid. It was a set of well thought through procedures allowing efficient use of Enigma.
Just like British (and Allies) were employing hundreds of people to figure out how to use decryptions of German communication without revealing the source, Germans had to train thousands of specialists to operate Enigma machines so that information got from all front-lines (from France to Russia, Middle-East or Africa) to Berlin and back.
Even today, techniques we use for managing encryption are very similar to those Germans devised for secure communication of their fast-moving armies and Navy to their high command.
- They separated communication in several networks – the first one was a training one and then networks for each geographical region or a segment of the military.
- Each of the networks had a “master key” for communication within the network. This key changed every 24 hours and was distributed on a monthly basis.
- Each message had its own key that was encrypted by the daily key and sent at the beginning of each message.
It is a very secure system, but it had one big drawback that became apparent when Bletchley Park (a picture from its mansion is above) lost the ability to decrypt messages for several months in 1941. That is – the method they used became useless as Germans changed the implementation of steps 2-3 above.
In theory, the British should become blind and unable to decrypt a single German message. Still, a large chunk of the German traffic was decrypted – how is that possible? The reason was that keys created in 2 and 3 above were not “random”. One (probably) soldier responsible for creating monthly lists of new keys started re-using old lists. Funny enough, one guy in Bletchley was checking this every beginning of the month and as a result, Bletchley Park learnt keys or their parts for a whole month in advance.
Secondly, the message keys were supposed to be random, but they were not. Very often the operators of Enigma machines created message keys by typing alternate left and right hand or they didn’t change Enigma configuration (or state) between messages. All these human errors significantly decreased the security of encryption and allowed Bletchley Park wizards decrypt many important messages.
Eventually, Bletchley Park built “bombe” machines (on the left) that removed this dependency on human error, sped up decryptions and made the whole “Ultra” operation much more predictable. The “Bombes” used the design flaw in the Enigma encryption (i.e., no letter is ever encrypted as itself). However, this vulnerability to simple human errors of one of the best encryption systems at the time remains a lesson that keeps amazing me and it’s a lesson still valid today.