Buttoning-Up

My crypto Home Page
Enigma Cryptanalysis home Page

Introduction

The Button-up method allows you to find the wiring of the fast rotor of an Enigma. It requires knowing the input wiring of the machine (ETW or Qwertzu) and having many in-depth messages (several pairs of messages in plaintext and encrypted with the same key). It is also possible to have only a long cryptogram for which you know the corresponding plaintext.

Note: if you deduce the wiring of the rotor, you do not know its initial position.

This method was invented in 1937 by Dilly Knox who was part of the English cryptological services. At the same time, he also invented the Rodding method which allows a message to be deciphered if one has the fast rotor wiring as well as a Crib.

Use of the method before and during the 2nd World War

Dilly Knox used these methods (Buttoning-up and Rodding) to decipher messages from the Francoists during the Spanish Civil War. The Enigma used by the Francoists was the commercial model but with a rewiring of the rotors.

The Rodding method allowed Mavis Batey to decipher a message from the Italian Navy (which used the same rotors as the Francoists). This deciphering allowed Admiral Cunningham to win the great battle of Matapan in 1941.

If Dilly Knox had imagined that the ETW disk (the Enigma input disk) was wired simply (ABC...Z) instead of using the commercial Enigma wiring (QWERTZU....), he could have, with his Buttoning-up method and the messages provided by French espionage, repeated Rejewski's feat and would have reconstructed the Enigma wiring.

The method

Reminder: The Rodding method

Since the Butting-up method is based on the same vision of the Enigma as the Rodding method, it is good to briefly recall the latter.

The Rodding method uses rods that each correspond to the encryption of different letters but which give the same encrypted letter at the different positions of the fast rotor. Two rods are associated to decipher a few letters that all pass through the slow rotors (left and middle rotor) and through the reflector when them don't move. Thus we can ignore not only their wiring but also their positions.

The Enigma Military Rotor I Cipher Table

In the following table, on the abscissa we have the position of rotor I of the military Enigma and on the ordinate the encrypted letter. At the intersection of the abscissa and the ordinate we have the plain letter.

The first column (UWYFAD...QOJ) corresponds to the wiring of the fast rotor. In the following, it is the unknown that must be reconstructed.

Note: The diagonals reproduce the wiring of the input disk (ETW or Qwertzu).

           A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
        A: U V W D W Y Z I N Q R T Q X Y E R G A S X N R T Q K
        B: W X E X Z A J O R S U R Y Z F S H B T Y O S U R L V
        C: Y F Y A B K P S T V S Z A G T I C U Z P T V S M W X
        D: G Z B C L Q T U W T A B H U J D V A Q U W T N X Y Z
        E: A C D M R U V X U B C I V K E W B R V X U O Y Z A H
        F: D E N S V W Y V C D J W L F X C S W Y V P Z A B I B
        G: F O T W X Z W D E K X M G Y D T X Z W Q A B C J C E
        H: P U X Y A X E F L Y N H Z E U Y A X R B C D K D F G
        I: V Y Z B Y F G M Z O I A F V Z B Y S C D E L E G H Q
        J: Z A C Z G H N A P J B G W A C Z T D E F M F H I R W
        K: B D A H I O B Q K C H X B D A U E F G N G I J S X A
        L: E B I J P C R L D I Y C E B V F G H O H J K T Y B C
        M: C J K Q D S M E J Z D F C W G H I P I K L U Z C D F
        N: K L R E T N F K A E G D X H I J Q J L M V A D E G D
        O: M S F U O G L B F H E Y I J K R K M N W B E F H E L
        P: T G V P H M C G I F Z J K L S L N O X C F G I F M N
        Q: H W Q I N D H J G A K L M T M O P Y D G H J G N O U
        R: X R J O E I K H B L M N U N P Q Z E H I K H O P V I
        S: S K P F J L I C M N O V O Q R A F I J L I P Q W J Y
        T: L Q G K M J D N O P W P R S B G J K M J Q R X K Z T
        U: R H L N K E O P Q X Q S T C H K L N K R S Y L A U M
        V: I M O L F P Q R Y R T U D I L M O L S T Z M B V N S
        W: N P M G Q R S Z S U V E J M N P M T U A N C W O T J
        X: Q N H R S T A T V W F K N O Q N U V B O D X P U K O
        Y: O I S T U B U W X G L O P R O V W C P E Y Q V L P R
        Z: J T U V C V X Y H M P Q S P W X D Q F Z R W M Q S P

In the following lines, we have a plain text pair and the corresponding cryptogram. We used a Military Enigma, reflector B, rotors III,II,I, no steckers, ringstellung AAA and the initial position of the rotors AAZ.

Position  : A B C D E F G H I J K
Plain text: c h i n e s e t t i n
Cryptogram: X M Q L D I D C P A W
Rod     M:  C J K Q D S M E J Z D F C W G H I P I K L U Z C D F
Rod     R:  X R J O E I K H B L M N U N P Q Z E H I K H O P V I
Match       *       * *

It is recalled that the Enigma cipher is symmetrical. Thus at positions E and F, there is no difference between the plain text ES which gives the cryptogram DI or the plain text EI (at Rod R) which gives the cryptogram DS (at Rod M).

Note: If we know the 13 pairs of Rods, we can decipher the cryptogram which is between 2 turnovers.

The principle of the Butting-up method

Now that we remember the Rodding method well, let's move on to the Butting-up method. Let's suppose that the letters H and X follow each other in the first column (position A). Consequently, at positions E and F we have the text DS which (as we have seen) corresponds either to a plain, ciphered or mixed text. In the cipher table, this text DS belongs to Rod M.

On the other hand, we know that the DS cipher (or plain or mixed text) gives the plain text EI (or ciphered or mixed text). If we go down the diagonals (which correspond to Qwertzu), we obtain in the first column the letters I and N (the I above the N). We have just made a deduction: if H and X follow each other in column A, I and N follow each other in the same column.

Note: Dilly Knox calls Beetle two adjacent letters in the same Rod (for example DS and EI). Normally beetles, are very few in a single plain/cryptogram pair. On the other hand, if we have lots of in-depth messages, there are a lot of them, even if the two letters that form them belong to different messages!

Position: a b c d e f 
Plain t.: c h i n e s 
Crypto. : X M Q L D I

Rod M   :         D S
  .             E T
  .           F U
  .         G V
  .       H W
Rod R   : X       E I
  .             F J
  .           G K
  .         H L
  .       I M
  .       N

The details of the method

We will show the details of the method through an example using our Simplified Enigma.

Messages in-depth

Here are two in-depth messages:

Position:   0 1 2 3 4 5
Plain text: 0 1 1 0 3 2
Crypto.:    1 5 3 5 5 4


Plain text: 2 4 5 1 1 4
Crypto:     5 0 2 4 2 2

First step: Create tables I and II

Table I: For each position (called column here), we record the different pairs (plain letter / encrypted letter) that appear in the in-depth messages.

Table II: we take table I, but we replace the value of a couple by the couple at position 0 (we go down the diagonals). For example, the pair 52 in column 2 gives the pair 14 in column 0.


Table I:
Column   0  1  2  3  4  5

Pairs   01 15 13 05 35 24
...     25 40 52 14 12 42



Table II:
Column   0  1  2  3  4  5
Pairs   01 20 35 32 23 13
...     25 51 14 41 50 31

Second step: We choose an initial hypothesis

We take any letter, for example "3" and successively, we try the following hypotheses: 30, 31, 32, 33, 34, 35. A hypothesis corresponds to two letters that follow each other (in order) in the column 0. For example, if we make hypothesis 32, we assume that the letter 3 precedes the letter 2 in column 0, the one which corresponds to the rotor wiring.

Third hypothesis: 32, First deduction

Note: we will deal with the first two hypotheses (30 and 31) later. Hypothesis 32 corresponds to the correct solution. Consequently, the encryption table extract of the rotor will be correct.

We start with the pair 32, so the 3 precedes the 2 in column 0. We are looking for beetles, in plain language, two pairs of letters belonging to adjacent columns are each pair contains one of the letters of our hypothesis (3 or 2). We find the pairs 31 (in column 2) which corresponds to 53 or 35 (in column 0) and 05 in column 3 which correspond to 32 in column 0. Our deduction is stated as follows: if we have 32 in column 0, we have 53 (5 before 3) in column 0.

We took the 5 from the pair 35 from column 2 and the 3 from the pair 32.

Note: Another way to say the same thing: In columns 2 and 3, we have beetles 15 in the 1st Rod and 30 in the 2nd Rod.

Column   :    0 1 2 3 4 5
                        4
                      5 3
                    0 4
1st Rod  :        1 5
                2 0
              3 1
              2
                        0
                      1 4
                    2 5 
2nd Rod  :        3 0 
                4 1 
              5 2 
              3

We have deduced a new pair (53). In general, we do not know the distance on column 0 between the two pairs (hypothesis and deduction). On the other hand, here we have a letter in common: the letter 3. We therefore obtain 3 letters which follow each other in column 0 (our objective): 532.

Other deductions from the initial hypothesis 32, the rotor wiring

From couple 32 in column 0, we deduce too the couple 24 from couples 32 from column 3 and 23 in column 4.
From couple 53 in column 0, we deduce the couple 01 from couples 50 in column 4 and 31 in column 5.
From couple 53 in column 0, we deduce the couple 15 from couples 51 in column 1 and 35 in column 2.
From couple 01 in column 0, we deduce the couple 24 from couples 20 in column 1 and 14 in column 2. This is a confirmation.

Let us summarize our deductions: 532, 01, 24, 15. We can deduce the rotor wiring: 015324.

On the other hand, we do not know the start of the rotor. The solution 324015 is equivalent to the previous one.

Back to the Failed Hypotheses

Initial Hypothesis 30

From couple 30 in column 0, we deduce the couple 25 from couples 32 in column 3 and 50 in column 4.
From couple 25 in column 0, we deduce the couple 03 from couples 20 in column 1 and 35 in column 2.
The couples 30 and 03 are not combatible. We can reject hypothesis 30.

Initial Hypothesis 31

From couple 31 in column 0, we deduce the couple 54 from couples 35 in column 2 and 41 in column 3.
From couple 54 in column 0, we deduce the couple 11 from couples 51 in column 1 and 14 in column 2.

The couples 31 and 11 are not combatible. We can reject hypothesis 31. Moreover, a pair made of two identical letters is impossible.

If we test the other hypotheses (33, 34 and 35), all fail equally.

Butting-up Method Automation

I wrote a program in Python (BUTTON-UP) that automates the main steps of the Buttoning-Up algorithm.

How to get it and install it?

C:\> curl -O http://www/crypto/enigma/crypta/BUTTON-UP.tar
C:\> tar -xf BUTTON-UP
C:\> cd BUTTON-UP
C:\BUTTON-UP>dir /s

Note: The README.txt file shows the syntax and one or two usage examples.

Here is the syntax and options of the program:

 
C:\BUTTON-UP> python button_up.py -h
Usage:
Syntaxe: button_up.py -F data.txt
         
Options:
  -h       Help
  -d       Debug mode
  -o       One Shot (we test only one hypothesis)
           False by default
  -F file  The file which contains plain and crypto
  -T TO    The Turnover position, 0 by default
           (not yet implemented).
  -Q ETW   The wiring of enter disk (Qwertzu)
           ETW is a string of 26 letters or
           the word QWE for the ETW of the commercial
           Enigma, the word ABC for the ETW of
           military Enigma. QWE by default
  -H hyp   The starting hypothesis, AB by default

Note: At the moment, my version does not support the Turnover position.

In the MSGS directory, we find the in-depth messages. So the dilly.txt file contains the in-depth messages given in the example explained by Frank Carter. It is then easy to reproduce all the steps of his demonstration.

C:\BUTTON-UP> python button_up.py -F MSGS\dilly.txt -Q QWE
...

Note: I modified Frank Carter's example. Indeed, there is a turnover in position 14. Consequently, the E/M pair of message 12 ending with ...OFFICE and VJYUBM as well as the end of message 15 should not be used.

A complete example using my software

Personally, I like to create my own examples to understand a subject. Thanks to my software, you will be able to test an example that you have created yourself and not spend hours (if you work manually) to verify it.

Note: in fact, my example will not succeed completely (unlike Frank Carter's example). I kept it to show that the method fails if the amount of data (in short, the number of encrypted letters) is not large enough. On the other hand, as in Frank Carter's example, I assume that I know the location of the turnover (which my program does not yet manage).

The in-depth messages

I created the following cryptograms using a military Enigma with the following configuration: Enigma Militaire, UKW B, rotors III,II,I, no steckers, ring=AAA, grund=AAZ.

01234567890
Thesecurity  1      enerallycha  6      dvanceandon  11
VMFDDDFPZMK         HKFFMTJUNSP         UETLLPIFGFW

ofthesystem  2      ngeddailyba  7      othersettin  12
KAAWDIZAPGD         AYFSEGAJQUP         KZPTQIDCPAW

dependsonma  3      sedonsecret  8      gsthatwerec  13
UVHTPCVBCTP         QVMQPIDTFGQ         JXAWMLBHFGV

chinesettin  4      keylistsdis  9      hangedforea  14
XMQLDIDCPAW         OVCNXIXAGAB         EFWMDCUBFGP

gsthatwereg  5      tributedina  10     chmessageTh  15
JXAWMLBHFGL         VJQPTLDQZWP         XMDTJIIMKMX

I create a file (in-depth.txt) in the MSGS directory that contains all the messages. For each message we have three lines. The first contains the plain text, the second contains the corresponding cryptogram, the third line is empty. If the third line (or a line at the beginning of the file) does not start with a letter, it is considered empty and can be used to contain a comment.

Note: It does not matter whether the ciphertext and the cryptogram are swapped because encryption and decryption are equivalent for the Enigma.

First step: Create tables I and II

C:\BUTTON-UP> python button_up.py -F MSGS\in-depth.txt -Q ABC -H SA
Table I:
 0 - TV:OK:DU:CX:GJ:EH:NA:SQ:KO:TV:DU:OK:GJ:HE:CX:
 1 - HM:FA:EV:HM:SX:NK:GY:EV:EV:RJ:VE:TZ:SX:AF:HM:
 2 - EF:TA:PH:IQ:TA:EF:EF:DM:YC:IQ:AT:HP:TA:NW:MD:
 3 - SD:HW:ET:NL:HW:RF:DS:OQ:LN:BP:NL:ET:HW:GM:ET:
 4 - ED:ED:NP:ED:AM:AM:DE:NP:IX:UT:CL:RQ:AM:ED:SJ:
 5 - CD:SI:DC:SI:TL:LT:AG:SI:SI:TL:EP:SI:TL:DC:SI:
 6 - UF:YZ:SV:ED:WB:LJ:IA:ED:TX:ED:AI:ED:WB:FU:AI:
 7 - RP:SA:OB:TC:EH:YU:LJ:CT:SA:DQ:NF:TC:EH:OB:GM:
 8 - IZ:TP:NC:TP:RF:CN:YQ:RF:DG:IZ:DG:TP:RF:RF:EK:
 9 - TM:EG:MT:IA:EG:HS:BU:EG:IA:NW:OF:IA:EG:EG:TM:
10 - YK:MD:AP:NW:GL:AP:AP:TQ:SB:AP:NW:NW:CV:AP:HX:
11 -
Table II:
 0 - TV:KO:DU:CX:GJ:EH:AN:QS:
 1 - IN:BG:FW:TY:LO:HZ:KS:AU:
 2 - GH:CV:JR:KS:FO:AE:PY:
 3 - GV:KZ:HW:OQ:IU:RT:ES:JP:
 4 - HI:RT:EQ:BM:XY:GP:UV:NW:
 5 - HI:NX:QY:FL:JU:
 6 - AL:EF:BY:JK:CH:PR:GO:DZ:
 7 - WY:HZ:IV:AJ:LO:BF:QS:KX:MU:NT:
 8 - HQ:BX:KV:NZ:GY:LO:MS:
 9 - CV:NP:JR:BQ:DK:FW:OX:
10 - IU:NW:KZ:GX:QV:AD:CL:FM:HR:
Number of column  11
...

Notes:

The diagonal of the military Enigma (the ETW disk wiring) corresponds to the identity permutation: ABCD ... Z. It must be indicated with an option (-Q ABC). Indeed, by default, the software assumes that we are using the ETW of the commercial Enigma: QWERTZU ... NML.
By default, my software tests all hypotheses from A/B to A/Z. In our case the correct solution involves the pair A/D (see the rotor I cipher table indicated above). The data provided cannot provide this starting point. Instead, I give another pair S/A (option -H SA). My software will test SA, SB, SC, … up to SZ.

Tests of the different hypothesis

========> Initial Hyptothesis:  SA
Incoherence, hyp, new:  KE SS
Deductions:  ['SA', 'QU', 'KE']
========> Initial Hyptothesis:  SB
Incoherence, hyp, new:  SB QX
Deductions:  ['SB']
========> Initial Hyptothesis:  SC
Incoherence, hyp, new:  SC MV
Deductions:  ['SC']
========> Initial Hyptothesis:  SD
Incoherence, hyp, new:  HJ IK
Deductions:  ['SD', 'MK', 'UV', 'AC', 'IU', 'HJ']
========> Initial Hyptothesis:  SE
Incoherence, hyp, new:  SE KS
Deductions:  ['SE']
========> Initial Hyptothesis:  SF
Incoherence, hyp, new:  SF MW
Deductions:  ['SF']
========> Initial Hyptothesis:  SG
Incoherence, hyp, new:  SG KV
Deductions:  ['SG']
========> Initial Hyptothesis:  SH
Incoherence, hyp, new:  SH KW
Deductions:  ['SH']
========> Initial Hyptothesis:  SI
Incoherence, hyp, new:  QN EX
Deductions:  ['SI', 'QN']
========> Initial Hyptothesis:  SJ
Incoherence, hyp, new:  SJ KP
Deductions:  ['SJ']
========> Initial Hyptothesis:  SK
Incoherence, hyp, new:  SK KS
...

Most hypotheses fail because an inconsistency arises.

A successful hypothesis

========> Initial Hyptothesis:  SL
Deductions:  ['SL', 'QO', 'YG', 'HX', 'TH', 'PV', 'WY', 'IN', 'CK', 
'ZB', 'VZ', 'RI', 'NQ', 'JU', 'FP', 'UW', 'XS', 'KM', 'DF', 'GA', 
'OJ', 'LR', 'BE']

When a plausible solution occurs, we do not get the error message indicating that an inconsistency has occurred. On the other hand, dozens of deductions are displayed.

If we have used enough data and there is no turnover problem, we get enough deductions to reconstruct the wiring of the fast rotor.

In our case, we can put our deductions together and get part of t he wiring: THXSLRINQOJUWYGA, DFPVZBE, KM, C. Since we did not get the AD, EC, EK, and MT pairs in our deductions, we could not reconstruct the entire wiring of the fast rotor.

Notes:

I did not automate this part of the algorithm, because it is more fun to do it manually than automatically.
Since we did not obtain the pair AD, we understand that we could not use the initial hypothesis AB.
If you want to display the details of the software's reasoning, you must use the Debug option (-d).

References

Books and articles

Dilly, The Man Who Brake Enigmas, by Mavis Batey, Dialogue Editor, 2009. Appendix 2 : Rodding, Appendix 3: Buttoning-up. These two appendices were written by Frank Carter.

Internet links

The Enigma Collection, Editor: Frode Weierud.
Buttoning-up, by Frank Carter (link).