How the Enigma machine worked: rotors, reflector and plugboard

What happens when you press a key

How did the Enigma machine work? Each key press sent an electric current through a plugboard, three rotors and a reflector, then back through the rotors and the plugboard to light a lamp with a different letter. The right-hand rotor stepped on every key press, so the wiring changed and the same letter came out differently each time.

A German radio operator in 1941 had a wooden box on the table, about 35 by 29 cm and 16 cm deep in its oak case, weighing around 12 kg. He pressed a key, one small bulb lit up under a lettered window, and a second soldier wrote that letter down. Press the same key again and a different lamp lights. That is the whole user interface of the Enigma I, and the model above works the same way.

This page follows the current from the key to the lamp, part by part, using the real wiring of rotors I to V and reflector B. The cipher in the model is the real one: set it the way the sender did and it reads a message sent from the Russian front on 7 July 1941.

The parts the current passes through

Pressing a key closes a switch. A 4.5 volt battery inside the case pushes current through this chain:

1. Keyboard: 26 keys in the German QWERTZ order.
2. Plugboard (Steckerbrett): sockets on the front panel. A cable between two sockets swaps those two letters.
3. Entry wheel: a fixed disc that passes the current to the rotors. On the Enigma I it is wired straight through, A to A.
4. Three rotors, right to left. Each one scrambles the alphabet.
5. Reflector: a fixed half wheel that pairs the letters and sends the current back.
6. The three rotors again, left to right, along a different path.
7. Entry wheel and plugboard again, then one of 26 lamps.

The current crosses a rotor six times on its way, three times in and three times out. If the machine stopped there, it would be a fixed substitution, which a schoolchild with a pencil can solve by counting letters. The trick is that the rotors move.

Why the rotors move before the lamp lights

The key does two jobs in a strict order. The first few millimetres of its travel push a pawl against the right rotor's ratchet and turn that rotor by 1/26 of a turn. Only at the bottom of the stroke does the key close the electrical contact. So the letter is always enciphered with the rotors in their new position.

Turn on See inside and type a few letters. The red and blue wire inside each rotor jumps to a new place with each key press, even when you press the same key, because the rotor has turned and a different internal wire now sits in front of the fixed contact.

Inside a rotor: 26 wires in a scrambled order

A rotor is a thick disc of insulating material. Its right face carries 26 spring-loaded pins and its left face 26 flat contacts. Inside, 26 insulated wires join each pin to one contact. Rotor I, for example, sends A to E, B to K and C to M; the full list is EKMFL GDQVZ NTOWY HXUSP AIBRC J. The model uses the published wiring of all five rotors:

Around the rim sits a movable alphabet ring with a notch. The ring decides which letter shows in the window, and the ring setting (Ringstellung) decides how far the letters are shifted against the wiring. Changing the ring by one place has the same effect on the wiring as turning the core by one place while the letters stay put.

The reflector, and why no letter becomes itself

Reflector B joins the 26 contacts in 13 pairs: A with Y, B with R, C with U, and so on (YRUHQ SLDPX NGOKM IEBFZ CWVJA T). Current that arrives on A leaves on Y and travels back through the three rotors.

This had two consequences. The good one for the operators: the machine is its own inverse. If A becomes B at some setting, then B becomes A at the same setting, so the same machine and the same procedure decrypt a message. The bad one: a letter can never turn into itself. The return path cannot end where the forward path began, because the reflector never joins a contact to itself. In the model you can type 1,000 letters and you will never see the lamp match the key you pressed. Codebreakers used this to rule out positions of a guessed word (a crib): if the guess put a letter over the same letter in the cipher text, that position was impossible.

Stepping, notches and the double step

The right rotor steps on every key press. When it moves past its notch position (V for rotor III), it carries the middle rotor one step. When the middle rotor moves past its own notch, it carries the left rotor.

The mechanism has a quirk. The pawl that pushes the left rotor rests on the middle rotor's notch, and when it pushes, it also drags the middle rotor along. So the middle rotor steps twice on two consecutive key presses. Tour step 5 shows it with rotors I, II and III starting at ADU:

• ADU becomes ADV (right rotor reaches its notch at V)
• ADV becomes AEW (the middle rotor is carried to E, its own notch)
• AEW becomes BFX (the middle rotor steps again, and takes the left one)
• BFX becomes BFY

Because of the double step, the middle rotor only has 25 distinct positions in the cycle, not 26. The machine repeats after 26 × 25 × 26 = 16,900 key presses. The model's code was run for a full cycle and returns to the start after exactly 16,900 steps.

Following one letter from A to B

Set I-II-III at AAA, no cables, and press A. The right rotor steps first, so the window reads AAB. Then the current goes:

Type A four more times and the lamps show D, Z, G and O. The string AAAAA becoming BDZGO is the standard test for an Enigma simulator, and the model passes it. With the rings set to BBB instead, the same five keys give EWTYX, another published check that the model's code passes.

How many ways to set the machine

An army operator had to set four things from a daily key sheet. The numbers below are computed, and the formulas are given so you can check them.

• Rotor order: three of five rotors in a chosen order, 5 × 4 × 3 = 60.
• Start positions: 26 × 26 × 26 = 17,576.
• Plugboard with ten cables: choose ten pairs from 26 letters. The count is 26! / (6! × 10! × 2^10) = 150,738,274,937,250. The 6! accounts for the six letters left unplugged, the 10! for the order of the cables, and 2^10 for the two ends of each cable.

Multiplying: 60 × 17,576 × 150,738,274,937,250 = 158,962,555,217,826,360,000, about 1.6 × 10^20, or roughly 2^67. The ring settings of the middle and right rotors change when the turnovers happen, which multiplies the total by up to 26 × 26 = 676 more, to about 1.07 × 10^23.

The plugboard gives most of that number. Ten cables is not even the maximum: eleven cables would give 205,552,193,096,250 pairings. Before January 1939 the army used only six cables, which gives 100,391,791,500.

A large key space is not the same as a strong cipher. The rotors, which look like the clever part, contribute only 60 × 17,576 = 1,054,560 settings. The codebreakers' machines at Bletchley Park attacked exactly that part and dealt with the plugboard by logic.

Encrypting and decrypting are the same action

Type HALLO at I-II-III, AAA with no cables and the lamps light IDBDA. Press Back to start and type IDBDA: the lamps spell HALLO. The button Type the lamps back does this for you. Because of the reflector, the receiver did not need a separate decrypt mode. He set the same rotors, rings, plugs and start position and typed the cipher text.

In wartime use, the start position for each message was itself enciphered. The operator picked three letters (the message key), enciphered them at the day's basic setting, sent the result at the start of the message, and then turned the rotors to his message key. The 1941 message in the first tour step uses message key BLA, rotors II, IV and V, rings B U L and ten cables (AV BS CG DL FU HZ IN KM OW RX). Its first words read AUFKL XABTE ILUNG XVONX KURTI NOWA, where X stands for a space: a reconnaissance unit reporting from Kurtinowa, near Sebezh.

How the model differs from a real machine

• The lid, the lamp filter and the lid window are left off so you can see the rotors.
• The plug cables hang lower than real ones so they do not hide the sockets. Real plugs have two pins of different thickness, which is why one cable swaps both directions.
• The red and blue current path is drawn as a direct line. Inside a real machine, the wires run through the base along a fixed loom.
• The keys of a real machine also switch the lamp circuit, so a pressed key cannot light its own lamp. The model does the same in logic but not in the drawing.
• The case is an Enigma I. When you pick the naval M3 in the lab, the rotors VI to VIII and reflector C are worked out exactly, but the box stays the same. When you pick the M4, the fourth wheel and the thin reflector are computed and named on the reflector tag; the drawing still shows three rotors.
• The travelling light of Follow the current moves at walking pace. Real current crossed the machine in a few nanoseconds.

How Enigma was broken

Arthur Scherbius applied for a patent on a rotor cipher machine on 23 February 1918. The German navy took the machine into service in 1926 and the army added the plugboard in 1928. In December 1932 the Polish mathematician Marian Rejewski worked out the rotor wiring with the theory of permutations. He had help: German manuals and daily key lists that a spy in Berlin, Hans-Thilo Schmidt, had sold to French intelligence. The Poles built their own copies and a device called the cyclometer, and read much German traffic during the 1930s.

On 15 December 1938 the army added rotors IV and V, raising the rotor orders from 6 to 60, and in January 1939 the number of plug cables went up from six. On 26 and 27 July 1939, at Pyry near Warsaw, the Polish Cipher Bureau gave its methods and reconstructed machines to French and British officers. At Bletchley Park, Alan Turing and Gordon Welchman designed the bombe, an electromechanical machine that tested rotor positions against a crib. The first one, named Victory, arrived on 18 March 1940. The second, with Welchman's diagonal board, came on 8 August 1940.

Try it yourself in the lab

Under the controls there is a lab with six tools. None of them is a separate simulation: each one drives the same cipher code as the machine above, the code that is checked against the 1941 message.

Set the machine. Pick a model, three rotors, a reflector, the ring settings and the start position. The plugboard is a row of 26 sockets. Drag from one socket to another to plug a cable, or tap two in turn. Tap a plugged socket to pull its cable out. You can also tap the brass sockets on the front of the 3D machine. Every change resets the tape, because a cipher text only means something together with the setting it was made at.

Follow the current. Turn this on and press a key. The rotors step first, then a small light leaves the key, crosses to its plug socket, swaps if a cable is there, enters the entry wheel and goes through the right, middle and left rotors. In the reflector it turns round and comes back through the left, middle and right rotors by another route, to the plugboard and up to the lamp. The strip at the top of the stage lights each stop as the light passes it. Try it with See inside on: the rotor bodies turn see-through and you can watch the light jump between the contacts.

Double step in slow motion. This sets rotors I-II-III at ADU, slows the rotor movement and presses A three times. The log underneath records which rotors moved on each key: ADU to ADV moves only the right rotor, ADV to AEW moves the right and the middle, and AEW to BFX moves all three. The middle rotor moved on two key presses in a row.

A letter never becomes itself. One button presses A ten thousand times, each time on a fresh random setting with ten random cables, and draws how often each lamp lit. The A bar is always empty. The other 25 bars sit around 400 each, because 10,000 / 25 = 400. In one run on this page they ranged from 343 to 444. That empty bar is the weakness the codebreakers used.

Encrypt and decrypt. Write a message and press Encrypt. Then press Decrypt the result: the same setting turns the cipher text back into your message, and the line says so. Type it on the machine sends the message through the 3D model letter by letter.

How many settings. A table multiplies the parts of the key for each model. You can slide the number of plug cables from 0 to 13 and see the total change. All numbers are exact integers, and the same formulas were also worked through by hand.

Naval machines: three of eight rotors, and then four wheels

The German navy was more careful with Enigma than the army. Its M3 took the same rotors I to V and added three of its own, VI, VII and VIII. These naval rotors have two notches each, at Z and at M, so the next rotor turns over twice per revolution instead of once. With eight rotors to choose three from, there are 8 × 7 × 6 = 336 rotor orders instead of 60. The navy also used reflector C as well as B.

Putting those numbers into the same product as before (336 rotor orders, 2 reflectors, 17,576 start positions, 676 ring settings and ten cables) gives 1,203,537,298,065,206,936,832,000, about 1.2 × 10^24.

In 1942 the U-boat machine changed again. The case had no room for a fourth rotor, so the reflector was made thin and a thin wheel, Beta or Gamma, sat between it and the left rotor. This fourth wheel could be set by hand but never stepped. The British called the new U-boat traffic Shark. The International Spy Museum, which shows a four-rotor machine Germany built for Japan, notes that Shark took nearly a year to break again.

The fourth wheel had a hidden convenience. Set Beta to A with the thin reflector B, and the M4 encrypts exactly like a three-rotor machine with the old reflector B. The same identity holds for Gamma with the thin reflector C. It meant U-boats could still read messages from shore stations that used three-rotor machines. With the fourth wheel free to take 26 positions and two choices of wheel, the M4 count in the lab rises to about 6.3 × 10^25.

Cribs: guessing the plain text

A crib is a piece of plain text you expect to find in a message. Weather reports began with the same German words every day. Units reported in fixed formats, and some sent the same "nothing to report" line night after night.

The first job is to line the crib up with the cipher text. Here the reflector helps the codebreaker. Because no letter can encrypt to itself, the crib cannot sit anywhere a crib letter matches the cipher letter underneath it. Take the first 96 letters of the 1941 message on this page and the true start of its plain text, AUFKLXABTEILUNG, 15 letters long. There are 82 places the crib could start. At 40 of them at least one letter collides, so only 42 remain, and position 0, the right one, is among them. With longer cribs the cut is bigger.

A crib that is lined up gives pairs of letters: plain A became cipher E at step 1, U became D at step 2, and so on. Those pairs are the input of the bombe.

The bombe at Bletchley Park

The Polish bomba of 1938 had worked by spotting the doubled message key at the start of each message. When the Germans stopped doubling the key and added rotors, that approach failed. Alan Turing designed a new machine that worked from cribs instead.

A bombe carried many sets of drums that copied Enigma rotors. For one rotor order it stepped through all 17,576 start positions. At each position it tested whether the letter pairs from the crib could all be true together with some plugboard. Most positions led to a contradiction at once, and the machine moved on. When it stopped, operators wrote down the position and a plugboard guess and checked it by hand on a Typex or Enigma copy.

Gordon Welchman added the diagonal board. It wired in the fact that a plug cable swaps both ways, so if A is plugged to V then V is plugged to A. That cut the false stops sharply. According to The National Museum of Computing, the first bombe, Victory, started work in March 1940, the first with the diagonal board, Agnus Dei, in August 1940, and by the end of the war about 1,676 Wrens and 263 RAF personnel ran 211 bombes. The museum runs a working rebuild.

Once a day key was found, thousands of messages still had to be decrypted. Bletchley Park used British Typex machines adapted to behave like Enigma for that work.

Other rotor machines: Typex and SIGABA

Britain bought two commercial Enigmas in 1928. The Air Ministry then had the teleprinter makers Creed & Company build an improved copy, and the first Typex Mark I machines reached the RAF in early 1937. Typex had five rotors, two of which stayed still while typing, and it printed onto paper tape instead of lighting lamps. The Mark 22 gained a plugboard, which is why it could imitate Enigma. The Imperial War Museums record that the Germans captured at least two Typex machines but never broke it, and it stayed in service until the early 1960s.

The US Army's SIGABA, called ECM by the US Navy, also used wired rotors. Frank Rowlett gave it a stepping motion so tangled that it looked random. The NSA's National Cryptologic Museum notes it was the only machine system of the war never broken by an enemy. From November 1943 adapted ECM and Typex machines worked together as the Combined Cipher Machine, so British and American ships could share messages.

The weak point in Enigma was not that it used rotors. It was the regular stepping, the reflector, and the habits of its operators. The lab's list of 50 machines, people and methods follows that story with a source for each entry.

Why thirteen cables give fewer settings than eleven

Filling every plugboard socket looks like the safest choice. Yet the count falls after eleven cables. To see why, call the number of arrangements with n cables P(n). Comparing two successive values of the factorial formula above cancels almost everything:

P(n + 1) / P(n) = (26 − 2n)(25 − 2n) / (2(n + 1)).

At ten cables, six sockets remain free. Adding an eleventh gives a ratio of 6 × 5 / 22 = 15/11, so the count grows from 150,738,274,937,250 to 205,552,193,096,250. At eleven cables, four sockets remain. The next ratio is 4 × 3 / 24 = 1/2, so twelve cables give 102,776,096,548,125 arrangements. The final ratio is 2 × 1 / 26 = 1/13: thirteen cables leave only 7,905,853,580,625 arrangements. These are counts of possible complete boards, not the number of ways to add a cable to one particular board.

Why divide by n + 1? Each finished board can be reached by removing any one of its n + 1 cables and putting it back. Counting all possible additions without that division would count the same finished board several times. The factor 2 prevents counting the two orientations of one cable separately. A cable joining A to B is the same connection as one joining B to A.

In the settings counter, leave the machine model unchanged and move the cable slider from 10 through 13. All the other factors stay fixed, so the total follows the same rise and fall. This tests a counting assumption, not the time needed to break a message. Eleven cables maximize this particular search space; that alone does not prove that eleven cables give the strongest practical cipher. Cornell University's combinatorics handout derives the underlying formula from choosing sockets and pairing them.

Breaking a message on the bombe stage

Switch on the bombe stage and the Enigma gives way to a model bombe. The front carries 108 drums in three banks. The National Museum of Computing describes the machine this way: each vertical set of three drums does the work of one Enigma's rotors, so the front holds 36 Enigmas. The model's drums turn with the search, and the side drums show the position being tested.

The message on the stage is a made-up U-boat weather report, enciphered with a day key the page keeps hidden until the end. The guess is that it contains WETTERVORHERSAGE, weather forecast, a word the museum names as typical of naval cribs. The first panel slides that crib along the cipher text. Wherever a crib letter stands over the same cipher letter it turns red, and the position is ruled out, because an Enigma never enciphers a letter to itself. Of the first 20 positions, 12 survive. The true one is position 8.

Press "Make the menu here" and the panel draws the menu. Each letter of the crib and the cipher letter under it are joined by a line marked with its place in the message. This crib gives 15 letters, 16 lines and 3 closed loops. The most connected letter, E, becomes the input letter. Loops matter most. A guess about E's plug partner can be followed round a loop and must come back to agree with itself, so every loop is one more test that a wrong guess can fail.

Then the run. For one rotor order the bombe steps through all 17,576 drum positions. At each position it assumes E is plugged to some letter, follows that guess through every scrambler on the menu, and uses Welchman's diagonal board (if E is plugged to w, then W is plugged to e) to spread it further. A wrong guess quickly implies that E is plugged to every letter at once, which is impossible, and the drums move on. The bombe stops only where some guess survives. The model does the same test in full, so its stops are real results of the cipher, not a scripted animation. Each one is then checked the way the checking machine did: if any letter would need two partners it is a false stop. With the true order II-V-III the run stops once, at YIV, and the check passes. The other three orders on the panel give no stop at all.

The stop gives the drum position and the plug partners of every menu letter. Press "Decipher with this stop" and most of the message comes out readable, with a few letters wrong: ANUFDXXWETTERVORHERSAGE. Those errors sit on the three cables whose letters never appeared in the menu. Finding them from the half-readable text is the last step, and it is one of the tasks in the lab.

Two things are simplified. The ring settings are fixed at A, because the bombe finds drum positions and the rings only shift the letters shown in the window. And the model's scramblers step exactly like an Enigma, middle rotor included, instead of copying the bombe's own drum gearing. The museum gives the speed of a real machine: the top drums turned at 97.5 revolutions a minute, so a run without a stop took at least 10.4 minutes. The speed slider runs the model at that pace or up to a thousand times faster.

Lorenz and Colossus: the other German cipher

The German Army High Command did not use Enigma for its most important messages. It used the Lorenz SZ40 and SZ42, attachments that enciphered teleprinter traffic. Bletchley Park called the system Tunny. Teleprinters send each character as five on and off signals, and the Lorenz added five key bits from twelve wheels. Five chi wheels, with 41, 31, 29, 26 and 23 cams, moved with every character. Five psi wheels moved only when the two motor wheels allowed it. A raised cam gives a 1 and a lowered cam a 0, and the key is chi plus psi.

The Lorenz stage shows the twelve wheels with all 501 cams. "One character" moves them by one step. The table shows the chi bits, the psi bits and the key bits they make, and whether the psi wheels moved. The cam patterns on the model are random, and the motor follows the simple SZ40 rule without the later limitation, so treat it as a working diagram, not a copy of one machine.

According to Crypto Museum, an operator sent a long message twice in August 1941 on the same wheel settings and typed it a little differently the second time. From that pair the codebreakers recovered nearly 4,000 key characters, and Bill Tutte worked out the machine's logic by January 1942 without ever seeing one. To set the wheels for each new message fast enough, Tommy Flowers built Colossus, an electronic machine of more than 1,700 valves that read the cipher text from paper tape. The first arrived at Bletchley Park in January 1944. By the end of the war, The National Museum of Computing says, ten Colossi and 550 people had decrypted 63 million characters.

Fifty machines, people and methods

The catalogue in the lab now lists 50 entries, each with its source, and it can be searched and filtered by kind. Entries for machines open a comparison card beside the Enigma I. The card compares how each machine scrambles, its moving parts, its contacts or letters, its years in use and whether it was broken. The Japanese Purple machine used telephone stepping switches instead of rotors, and the US Army's codebreakers rebuilt it in 1940 without ever seeing one, according to the NSA's National Cryptologic Museum. The M-209 was a pocket-sized pin-wheel machine. The Germans could sometimes break one of its messages in about four hours, which was acceptable for orders that lost their value within hours, and it was still in use in the Korean War. The KL-7 of 1952, whose users included South Korea, and the Soviet Fialka of 1956 carried the rotor idea into the Cold War with more rotors and more complicated stepping.