The Query-Menu

My Bombe simulator

Query-Menu and Throw-on methods

In 1930, the Germans used a very unsecure indicator method. Thanks to it, the Polish Rejewski broke the Enigma: he found the wiring of the rotors and found a method (The Catalog method) to break the daily key.

Here's how it works: The operator chooses a message key that he encrypts twice at a particular rotor position called GrundStellung, which is part of the key of the day. English cryptologists called these kind of methods that twice encrypted the message key “throw-on”.

In 1942, Hug Alexander had a hard time breaking the Porpoise network, which used this indicator method, but for the 4-rotor Navy Enigma. Indeed, he had not been made aware of the existence of the throw-on methods.

The menus generated are called Query-menu. They are special because the Crib contains numbers instead of letters. These numbers actually represent letters that are unknown but identical for a given indicator.

The particularities of query-menu

Unlike menus based on message routines which are never 100% certain, query-menus are certain. Indeed the pairs 1-4, 2-5 or 2-6 coming from the indicators are repeated several times in several messages and thus allow their verification.

The clear of the Crib is composed of three repeated letters. They are not known. In the menu they are replaced by question marks.

The turnover position is not known but as the crib is short (6 letters) it is unlikely.

The stops are unfortunately very numerous. Testing them all by hand is almost impossible. You must have a Bombe that has the "machine-gun" option that eliminates invalid stops.

Example with a Enigma three rotors

Here is an example of a query-menu, but with a three-rotor Enigma (and therefore with a three-rotor bombe).

Note: it is easier to test the solution.

The key used (Solution)

• Walzenlage: I III IV
• Ringstellung: X M K
• Grundstellung: W E C
• Steckerverbindungen: HS OV CU ER FN GZ MP BJ DQ IW
• Kenngruppen: xgf rqv qmq psp

An example of a message

SJRQV MWSPW RXRUD GZCJZ QLCXW ACZFH INBJB OFMXW LEVOK CQRBZ
FAGQJ JJUZE NHYEN AGIN

• Kenngruppe: SJRQV
• Indicator: MWSPWR (the twice encrypted message key)
• Cryptogram: XRUDGZCJZ...

A list of indicators

MWSPWR RRGYJU TDJGYE XXVJOJ
BFEKTS SSUCDP KTIOVV ONTQZF
EAGFKU WCQZCX SCDCCD IGTWQF
SCWCCQ EPDFBD HRJHJE ZSDEDD
LYYBXY UCSICR

Menu creation

The menu is created from the indicators. For example if we take the RRGYJU indicator:

         Positions: a b c d e f
         Indicator: R R G Y J U

          zza     zzd
        R -----? ----- Y

The letters R and Y correspond to the same letter of the key, but it is unknown. R is encrypted at position "a" (zza) and Y is encrypted at position "d" (zzd). These two encryptions can be represented by two menu segments. The unknown letter is replaced by a question mark.

The menu

                      zza   zzd   zze   zzb
                    R-----?2----Y-----?3----D
                    |                       |
                    |zzb                    |zze
                    |                       |
                    ?1                      ?4
                    |                       |
                    |zze                    |zzb
           zza  zzd | zzb   zze   zzc   zzf |
        X-----?7----J-----?6----E-----?5----S
        |           ^           |
        |zzb        |           |zza
        |          Input        |
        ?8        letter        ?13
        |                       |
        |zze                    |zzd
        |                       |
        O                       F
        |                       |
        |zza                    |zzf
        |                       |
        ?9                      ?12
        |                       |
        |zzd                    |zzc
        | zze   zzb    zzd  zza |
        Q-----?10---G-----?11---T

Using my Bombe simulator

I wrote a software that emulated the Turing / Welchman Bombe. This software supports query-menu. To indicate the unknown letters, one uses registers numbered from 0 to 9. Beyond 10, one uses the special characters ":", "; "," <"," = ","> ", ... (we follow the ASCII order).

$ more query_menu.cri4
ZZAR2
ZZEJ1
ZZB1R
ZZD2Y
ZZEY3
ZZB3D
ZZED4
ZZB4S
ZZFS5
ZZC5E
ZZEE6
ZZB6J
ZZDJ7
ZZAX7
ZZB8X
ZZEO8
ZZA9O
ZZD9Q
ZZEQ0
ZZB0G
ZZDG<
ZZA<T
ZZCT:
ZZF:F
ZZDF;
ZZA;E
=J=A=
+++++

$ ./bombe.exe -mg query_menu.cri4 I III IV
STOP ESSAIS/query_plus_xxx.cri4 I III IV ZST J:B DQ ER FN GZ JB OV QD RE SH TT XX
YY
machine_gun ESSAIS/query_plus_xxx.cri4 I III IV ELE J:L DL EL FL GL JL OL QL RL SL
TL XL YL
machine_gun ESSAIS/query_plus_xxx.cri4 I III IV FHW J:W DA EA FW GW JW OW QA RA SW
TA XA YW
machine_gun ESSAIS/query_plus_xxx.cri4 I III IV GQA J:I DI EI FI GI JI OI QI RI SI
TI XI YI
machine_gun ESSAIS/query_plus_xxx.cri4 I III IV ITQ J:K DK EK FK GK JK OK QK RK SK
TK XK YK
machine_gun ESSAIS/query_plus_xxx.cri4 I III IV MLV J:C DC EC FC GC JC OC QC RC SC
TC XC YC
machine_gun ESSAIS/query_plus_xxx.cri4 I III IV MSO J:W DW EW FW GW JW OW QW RW SW
TW XW YW
machine_gun ESSAIS/query_plus_xxx.cri4 I III IV NYV J:U DU EU FU GU JU OU QU RU SU
TU XU YU
machine_gun ESSAIS/query_plus_xxx.cri4 I III IV PAK J:H DH EH FH GH JH OH QH RH SH
TH XH YH
machine_gun ESSAIS/query_plus_xxx.cri4 I III IV QCL J:P DP EZ FC GP JP OV QZ RV SV
TH XH YZ
machine_gun ESSAIS/query_plus_xxx.cri4 I III IV SVO J:W DW EW FW GW JW OW QW RW SW
TW XW YW
machine_gun ESSAIS/query_plus_xxx.cri4 I III IV WOZ J:M DM EM FM GM JM OM QM RM SM
TM XM YM
machine_gun ESSAIS/query_plus_xxx.cri4 I III IV XQY J:I DI EI FI GI JI OI QI RI SI
TI XI YI

    DQ ER FN GZ JB OV QD RE SH TT XX YY