French Army C-36: The Allied period () ()

In November 1942, the Allies landed in French North Africa (Operation Torch). The Vichy troops resisted but were quickly defeated.

After the Anfa Convention in January 1943 (Morocco), under American pressure, De Gaulle's FFL [1] and Giraud's regular army of North Africa merged. At the beginning of 1944, five DIs and three DBs were formed [2]. Three components emerged:

• Army A (then called CEF [3]), led by General Juin, which fought first in Tunisia (From November 1942 to May 1943), then in Italy (From November 1943 to July 1944).
• The First French Army [4], (at first called Army B), led by General De Lattre de Tassigny, which landed in the South of France in August 1944 (Operation Dragoon).
• The 2nd Armored Division (2eDB), led by General Leclerc, which landed in Normandy in August 1944.

In September and October 1943, General Giraud (against the advice of De Gaulle) liberated Corsica.

Footnotes:

• [1] FFL: “Forces Françaises Libres”: Free French Forces.
• [2] DI: “Division d’Infanterie”: Infantry Division, DB: “Division blindée”: Armored Division.
• [3] CEF: “Corps Expéditionnaire Français”: the French Expeditionary Corps.
• [4] The French First Army was made up of seasoned troops (those of General Juin) and those who were in training in North Africa.

From late 1942 to August 1944, a part of the French Army trained. At the beginning, the encryption method already available during the Vichy period was used but gradually the American M-209, introduced into the French Army from May 1943, establishes itself as the principal means of encryption for small units and replaces the C-36.

At the same time, another part of the French Army was fighting in Tunisia. The staff exclusively used the B-211 and C-36 (SHD-10P237) [1].

Regarding the Italian campaign led by General Juin, I could not find any information at SHD that indicated whether or not the C-36 was used. Nevertheless, it is likely that the French contingent was equipped (among others) with the C-36.

In May 1943, a document (SHD-11P189 1944) lists the encryption methods used by the 1st DB: the B-211, C-36, code 72, ATM code, and the process without dictionary type 1943 (modification of process SD 1923 with diagonals).

In addition, the following is specified:

• B-211: normal means of encryption for armies and army corps.
• C-36: normal means of encryption up to regimental level.

From the end of 1942 to July 1944, the procedures for using the C-36 became increasingly complex to compensate for its lack of security. Finally, at the end of July 1944, the C-36 was withdrawn from active service. Here is the document announcing this withdrawal (SHD-11P189 1944):

     ARMEE "B" – Bureau du Chiffre - No 172/2 CH-TS - Reference: 
     Standing Instruction for Transmissions, No 10, of July 25, 1944. 
     (Red stamp "VERY SECRET")
     Subject: Return of encryption procedures - Memorandum -

     The referenced standing instruction specifies which encryption 
     methods are currently authorized for use in operations under 
     the provisions adopted by the U.S. 7th Army.
      1e- Converter M.209 (used according to the instructions in force 
     in the United States Army - See: Instructions for the use of 
     Converter M-209A, Part No 7-1 of 7/25/44 of the weekly order of 
     the Command of Transmissions.)
      2e- SD 43 process ...

     Thus will be donated:
     - The EMPIR codes and their superencipherment system.
     - The C36 machines as well as all the instructions and notices 
     concerning their use and the last telegram received concerning 
     their keying.
     - All instructions and notes from the Bureau du Chiffre or the 
     army concerning the use of Converter M-209 according to the 
     modalities that were adopted in North Africa, including the 
     complete copies of the collections of 60 "SIGRBA" tables and 
     the last telegram received regarding periodic changes to these 
     instructions.
     - The ATM 1943 codes and their superencipherment system.
     - The Codes 72 and their superencipherment system.

     Regarding the index of conventional abbreviations No 733 CH/CAB, 
     it will not be returned, the first part of these provisions 
     remaining in force ... The transfers prescribed above do not 
     apply to the army corps with regard to their own endowment.

     The units which, following these transfers, would find themselves 
     deprived of cipher procedures, will use AFCODE [3] for their secret 
     messages combined with the cartographic coordinate code and the 
     authentication table …

The last unencrypted message intended for encryption in C-36 that I found in the archives dated from July 12, 1944. It corresponds to a message exchanged between Oran and Constantine, that is, inside North Africa, which is in the hands of the Allies (SHD-1460B10 1944).

The archives of the first DB (SHD-11P187 1944) are full of telegrams with the machine-printed tape as well as the text of the unmarked message. Here are some of the abbreviations observed:

     GAL Général (General)       CHIF Chiffre (Bureau du Chiffre)
     DS  Dans (in)               REF Référence (reference)
     LT  Lieutenant (Lieutenant) OFF Officier (officer)
     VS  Vous (you)              DIV Division (Division)
     COL Colonel (Colonel)       MESS Message (Message)
     PR  Pour (for)              ASPT Aspirant (Aspirant)
     CDT Commandant (Commander)  RGT, REGT Régiment (Regiment)
     TELEG Télégramme (telegram)
     MESAGE instead of MESSAGE (message)
     HEUR for “heure” (time) 
     COMDMT for “commandement” (command)
     S, SP, TS, STP, STOP for the word STOP (sentence separator)
     NUM, NR, NO instead of “numéro” (number)

In the archives, I found several circulars that specified the location of the two key groups (SHD-11P189 1944). Figure 3 corresponds to the first telegram. It uses a form that is of French origin.

     PC. October 10, 1943 - Undrafted decryptment of an encrypted 
     telegram - (SECRET stamp) Gustave to Danaide - Departure from 
     Algiers on 10/9/43, Received by Bureau du Chiffre on 10/10/43, 
     Telegram number: 844/CH/CABINET - Plain text - For 2e Bureau, 
     Bureau du Chiffre - Request for acknowledgment of receipt [1]- 
     From October 15, midnight - observe the following rules for 
     C36 encryption:
     - First: Place immediately before the 1st key group 3 null groups.
     - Second: Formal prohibition to use a pronounceable word for key 
     formation or to use the same key for different telegrams; offenders 
     will be severely sanctioned –

     TELEGRAM TO BE ENCRYPTED - Danaide to Base-Destructeur-digitale-
     Deesse-Artillerie divisionaire - Text - N ° 134/2-CH. From November 
     20 at midnight, the packaging of ciphered telegrams by C36 machines 
     will be as follows: Firstly, group date, number of groups. Secondly, 
     a field of three null groups. Thirdly, first key group. Fourthly, 
     second key group. Fifthly, cipher text STOP Please acknowledge 
     receipt ... Signed Joubert des Ouches

     PC. 11/13/43 - General TOUZET du VIGIER, Commander of the 1st 
     Armored Division [2] 
     By Order: The Chief of Staff

• Do not use a pronounceable word for the message key.
• Do not reuse the message key.

Another document (undated) specifies that the header of the message (date group, number of groups) as well as the division of the cryptogram into groups of five letters corresponds to a signature of the messages: this made it possible to deduce that they were encrypted by means of the C-36 [3]. Here is the example provided (SHD-11P189 1944):

     22.015 DHAPR HRVTM ... (22nd day of the month, 15 groups, cryptogram)

     20 Dec 1942 – Memorandum – telegrams limited to 80 groups, in 
     exceptional cases to 100 groups.

Note: All the information that I give on the headers of the messages as well as on the indicators is taken from data derived from the slips containing the plain text of the messages. I was not given access to any encrypted messages that could have confirmed my assertions.

Footnotes:

• [1] In the French text, the military term "Accution" was used to request an acknowledgment of receipt.
• [2] We learn incidentally that the code name "DANAIDE" corresponds to the first DB.
• [3] Conversely, a message encrypted with the code 72 began with the number of groups followed by the message in the form of groups of four letters, for example: "0015 PLYA RBOM ..."

During the Free France period (1943, 1944), new procedures emerged.

At the very beginning of the engagement of the French alongside the Allies, it was the means of encryption and the keys in force that were used. Thus Tables A, B, and C N° 232/EM.CA/TS of C-36, which had been put into service on August 21, 1942, were used until mid-January 1943. They were only incinerated on August 21, 1944 (SHD-11P189 1944).

From January 1944, the keys related to the encryption processes, in particular those of the C-36, were mainly distributed inside a sealed envelope bearing a keyword. The slip associated with the delivery of the envelope specified the date on which it was put into service, but this could be anticipated if its holder received a telegram from the Bureau du Chiffre containing the key word. When the new key was put into service, the old one was incinerated. Here are the envelopes for the C-36 that I found [1]:

• The BETA envelope sent on December 7, 1942 (I do not know when it was put into service).
• The JUPIN envelope sent on December 25, 1942 (I do not know when it was put into service). It was cremated on April 15, 1943 when the CERES envelope was put into service.
• The CERES envelope, put into service from April 15, 1943, was still in service at the beginning of November 1943.
• The PERMA envelope sent on February 16, 1944 was put into service from April 1, 1944 at midnight. The associated key remained in effect for the entire month of April.

1. It is possible that the BETA envelope (and possibly also the JUPIN envelope) was never commissioned. In fact, a slip indicates the issuance and entry of keys into service from January 21, 1943, replacing keys from the Vichy period. These keys are named under their classic name (Tables A and B) instead of using the name of an envelope.
2. A document dated January 30, 1944 records the incineration of a CERES envelope. We can deduce that the key associated with this envelope expired at the end of January 1944 at the latest.
3. The CERES envelope was distributed with another envelope with the same number but bearing the name "Machine C-36." I think its contents specified the procedure and the use of the indicator system (which conceals the message key).

A few months later (April 14, 1944), another document requests their incineration: "Order to incinerate secret notice n ° 986 of 11/11/1943 relating to encryption by C36 machine." Figure 4 corresponds to the delivery note for the key in December 1943.

Regarding this last envelope (PERMA), I found its distribution list in the archives, which specifies the number of envelopes each recipient receives and the number of each copy. In total, there were 187 envelopes, which were all intended for members of the C-36 network of French units in North Africa (a priori one envelope per machine). The main recipients were Army A, Army B, and 19 ° CA. Here is, for example, the sixth recipient, the 19th Army Corps and all the units of which it is composed:

     6° / - Mr. General Commanding the 19 ° CA - 2e Bureau – Bureau 
     du Chiffre – ALGIERS-:  30 copies (n ° 70 to 99) For allocation 
     of all the territorial divisions, subdivisions, and bases in 
     the possession of Machine C-36 (AIR included).

Footnote:
[1] The C-36 was not the only system that used envelopes. Thus, the superenciphered keys of the ATM code were transmitted by the LATEM/TAMIS envelopes and then SATIM. The superenciphered keys of the Empir code were transmitted by the KASOR envelope and then LIPAL. Even the M-209 used the ARMIC envelope for a while.

From May 1944, the keys were transmitted by radio. Following is a reproduction of the documents. Because they were transmitted over the air, I found several copies: especially in each unit receiving the key. The following keys were received by the 1st Armored Division belonging to the B Army, which will land in the south of France (SHD-11P189 1944).

     05/24/44.- (VERY SECRET stamp)
     1st ARMORED DIVISION - STATE-MAJOR – 2e Bureau – 
     Bureau du Chiffre    No.99/E CH-TS. PC May 24, 1944

     Active positioning of internal secret elements for C.36 machine, 
     valid from June 1, 1944:

     LA   ZONE    DANGEREUX   EST   A   FRANCHIR -
     UNE   HALTE   EST   NECESSAIRE -
     POUR   ETABLIR   LA   JONCTION -
     LE   MAUVAIS   TEMPS   RETARDERA   NOTRE   ??UVEMENT - 
                                               [mouvement ?]
     ATTENDRE   ORDRE   D'URGENCE   POUR   PASSAGE -

     Verification of the 26 letters (take L as “calage” letter)
          JEYWF   EESSJ   HQGLL   TFJYX   CVAHP   SQFMF.

     The General of Division, TOUZET DU VIGIER, Commander of the
     1e Armored Division. PC Lieutenant Colonel LEHR, Chief of Staff.

     Recipients [1]:
          Tank Brigade, Support Brigade, 1/2 Zouaves Brigade, Base, 
          3rd R.C.A, Souche.

Footnote: [1] The last two key tables are for the same recipients.

     1st ARMORED DIVISION - STATE-MAJOR – 2e Bureau – 
     Bureau du Chiffre  No. 97 CH-TS.  PC June 23, 1944. 
     (VERY SECRET stamp)

     Active positioning of internal secret elements for C.36 
     machine, valid from July 1, 1944:

     NOS   APPAREILS   A   LONG   RAYON    D'ACTION
     ATTAQUE   EN   FORCE   LES   AERODROMES   ENNEMIS
     DE    NOMBREUX   INCENDIES
     SONT   SIGNALES   AINSI   QUE   DES   EXPLOSIONS
     AUCUN    APPAREIL   EST   MANQUANT

     Verification of the 26 letters (take N as “calage” letter)
          YGKYG    OVUGS   OVFNX    VHBJL   GWNSK    D

     This table cancels and replaces the 79/2 CH-TS, which will be 
     cremated on July 1 at 24 Hours. Incineration report to be 
     provided upon execution.

     The General of Division, TOUZET DU VIGIER, Commander of the 
     1e Armored Division. PC Lieutenant Colonel LEHR, Chief of Staff.

From May to July 1944, the keys are transmitted by radio message and are valid for one month. They are encrypted with the old key. The key does not appear directly; it must be deduced from key phrases ("LE ZOUAVE DU PONT DE L'ALMA A DIT"). This method is obviously extremely insecure: In fact, if the enemy succeeds in finding the old key, they know the next one. Indeed, this was the case. In the interview with Otto Buggisch (TICOM I-58 1945), I was surprised to again discover (from the German side) this enigmatic sentence: "LE ZOUAVE DU PONT DE L'ALMA A DIT." This sentence provides indisputable proof that the Germans read French C-36 messages. The dispersion of the units and the lack of means to edit and distribute the keys was undoubtedly the origin of the transmission of the keys by radio.

After several attempts, I was able to reconstruct the coding method of the internal key: WARNING! The astute reader can immediately stop reading and attempt to find this method themselves.

I found the method by wondering about a spelling mistake. In the first sentence of the second message, it reads "LA ZONE DANGEREUX ..." But in French, it should have read "LA ZONE DANGEREUSE … " The presence of the "X" seemed to me to relate to the letter X existing on the first wheel of the C-36 (the one which has 25 sectors). Here is a brief summary of this method: Each sentence indicates the position of the active pins of a key wheel. Take as an example the last line of the last key: "AUCUN APPAREIL EST MANQUANT." List the letters appearing: ACEILMNPQRSTU. The key (pins active) for Wheel 17 is therefore A_C_E___I__LMN_PQ. The letters R, S, T, U have no meaning for Wheel 17.

In the document shown in Figure 5 [1] (SHD-11P189 1944), I had confirmation that the 26 letter verification corresponded to the encryption of the letter "A" repeated 26 times taken as the message key AAAAA.

Regarding the "calage" letter, it does not correspond directly to the slide; it is the letter on the indicator disc that is opposite the number 1 in red on the disc number of the typewheel. The following formula links it to the slide:

     Slide = (Calage + 9) modulo 26

In the archives of the SHD (10P237 1943, 10P238 1943, 11P187 1944), I came across a catalog of messages with the raw plain text tapes from cipher machines glued to the back of each message. In addition, the cipher clerk had written three groups of letters in pencil on many of these messages, with the first being almost systematically above the following two. I easily deduced that the first group corresponded to the message key and that the two following groups constituted the two indicator groups, with each encrypted with a different substitution alphabet. Indeed, the fifth letter of the first group never included letters from R to Z and the fourth never included letters from T to Z, and so on. As I had several dozen messages, I was able to reconstruct the two alphabets completely for a given period.

In addition, unlike the method used in May 1940, all the possible keys could be used because a key letter no longer corresponded to two or three letters of a substitution alphabet, but only to one. This method also makes it possible to differentiate a B-211 key from a C-36 key. I also found that now almost systematically (but I have at least one conflicting example) the second indicator group was reversed. Hence, for the 06/22 message, the second group is JNTBF instead of FBTNJ (X = F, D = B, E = T, C = N, A = J).

In the archive, C-36 messages were mixed with messages encrypted in the B-211 and M-209 (from May 1943). It was easy to discern the cipher machine used. Indeed, it was often indicated in pencil on the slips containing the messages, along with (still in pencil) the indicator. Figure 6 [1] presents an example. Those using the M-209 were easily recognizable because the first two letters of the first group were equal to the last two letters of the second group (for example JJMSG TREJJ). Those using the B-211 used the same method as during the Vichy period and only used the letters A through K (with J omitted).

As time passes, the use of the C-36 becomes increasingly complex to maintain a sufficient level of security. Here is a first example dating from November 1943 (SHD-11P189 1944):

     Telegram to be encrypted - Danaide at Base Danaide-Destructeur-
     Digitale-Artillerie-divisionaire-Deesse - Text - N ° 141/2 CH. 
     Following telegram 134/2 CH relating to modification of C.36 
     encryption. 

     For reading cipher text subject to paragraph 5 of the aforementioned 
     telegram. The first and all odd groups will be reversed. The 
     following example text: PAXMC HZLBS RQVOJ ... will be collected 
     CMXAP HZLBS JOVQR ... Make an acknowledgment of receipt. 

     PC on 11/15/43, The Cipher Officer.

Note: Well after having formulated this hypothesis (different calage letter for each message), I had confirmation of it by analyzing the numbers present on decipherment tapes coming from two C-36 messages encrypted on June 23, 1943. The letter/number correspondence gives the calage letter "I" for the 1st message and the calage letter "D" for the 2nd message.

For the moment, we can see that the packaging procedures are complex. In fact, unfortunately I have discovered several documents that show that they were even more complex than first thought (SHD-11P189 1944):

     From the Commanding General of the 1st Armored Division to the 
     Army General, December 9, 1943 -

     I have the honor to report that, with reference to note 
     904/CH/CAP of October 21, 1943, the following incidents were 
     noted during the month of November.
     - Mechanical incidents: None.
     - Incidents relating to encryption:
     Method C-36: For telegrams from units of the Divisions: 2 
     telegrams received with the 2nd key group not inverted, 1 of 
     which forgot to set the conventional letter. A telegram with 
     2 same letters in a pronounceable key ...
     - Transmission incidents: For telegrams received by radio, 
     many errors are noted ... 

     1st Armored Division - … Mascara - May 17, 1943 - Instructions 
     for the Bureau du Chiffre - … C-36 cipher machine… Installation 
     of the interior secret elements by applying Table A provided by 
     the Commander-in-Chief. Placement of certain pins in active 
     position. Establishment of a conventional letter. See Chapter 
     III Deciphering 3rd paragraph of the note from the Commander-in-
     Chief ... either the DHERA key, the conventional letter will be 
     E ...

     Danaide à Baptiste - 03/26/44 ... Your telegram 25059 
     indecipherable but the key is correct. Please check “calage” 
     letter and “chiffrante” letter.

In March 1944, a new procedure appeared. The use of the C-36 becomes even more complex: (if it is possible!). The document that describes this method (which is not particularly clear) specifies the location of the key groups, which depend on the group concealing the "chiffrante" letter (SHD-11P189 1944).

     TELEGRAM TO BE ENCRYPTED - Danaide to Holders C.36. - Text -
     N° 52/2 CH-TS. Addendum relating to encryption by C36. 
     Addition to Chapter B, Section Z notice 27 CH/CAB, following 
     instruction: group concealing the "chiffrante" letter is 
     counted to determine the place of the key groups - STOP - 
     If total addition of the first 2 digits on the left to the 
     last 2 digits on the right is ONE, I repeat ONE, the 1st key 
     group or the second according to the case is placed 
     immediately after the group concealing the "chiffrante" 
     letter. The rest without change. PC On March 23, 1944, The 
     Cipher Officer.

When a machine is not in use, it must be put on the transport key (pins in passive position).

     Bureau du Chiffre - Algiers, May 9, 1944 - Subject: Security 
     of the encryption - Memorandum - 
     It was brought to the attention of the Colonel Director of 
     the Bureau du Chiffre that cipher machines C-36 and Converter
     had been transferred to the higher unit by formations that had 
     not taken the care to put the interior elements into the 
     passive position. There is serious negligence here that could 
     compromise the encryption security... The Colonel Director of 
     the Bureau du Chiffre, Signed: Joubert des Ouches.

Here is an authentic sample message (SHD-11P187 1944). On the front, the undrafted message and on the back, the raw message (the strip emerging from the C-36 stuck on the slip). The tapes glued (on the back):

     NUM WUBE SUR WU REPONSE MESAGE NUM WJU SUR CH
     INDIQER POSITION AINSI SUIT SP MA POSITION EST
     MOSTAGANEN   WN SUR WOCCMMC NUM WON Q O SP 

     TELEGRAM TO ENCRYPTION - DANAIDE to AD
     Registration number at number 353 ... Received at number 19h. 
     Shipped to AD at 8 p.m.
     TEXT
     N° 298/2 - RESPONSE MESSAGE N ° 42/CH. INDICATE POSITION THUS 
     FOLLOWS STOP MY POSITION IS MOSTAGANEN 1/200,000 N ° 2I Q O -
     STOP

     PC November 5, 1943

As reported, until the digital indicator system was known, the Germans had to individually break each message. The German cryptanalyst Alfred Pokorn describes the method for a message encrypted in M-209 (TICOM-IF-175 1945, paragraph “Breaking a Third Message”). In the next paragraph, I have adapted his method to a C-36 encrypted message.

Suppose we know the internal key. We have a message ciphered with this key. How to find the external key? If we suppose that the message begins with a probable word (a crib), we can deduce the first pins for each wheel and there we can deduce the external key.

Note: The methods which make it possible to find the internal key (messages in-depth, stereotyped start) only make it possible to discover a relative internal key. The true internal key does not need to be known to decrypt messages. When we decrypt other messages, we will only know message keys relative to the first key we acquired and which we set arbitrarily to AAAAA.

Example:

     Ciphered message:          EBGLF AMNDU PWIU ...
     Plain message (supposed):  REFER K ...
     Internal Key:
     - Position of key wheels pins:
     Wheel 1 (25):   A__DE_G__JKL__O__RS_U_X__
     Wheel 2 (23):   AB____GH_J_LMN___RSTU_X
     Wheel 3 (21):   __C_EF_HI___MN_P__STU
     Wheel 4 (19):   _B_DEF_HI___LN_P__S
     Wheel 5 (17):   AB_D___H__K__NO_Q
     - Slide: 0 (letter A)