M-209: TICOM

Introduction

Many valuable informations were collected. Among them TICOM learnt about German attack methods against M-209. The TM 11-380 1947 version summarises their knowledge to prevent these attacks. Inside TICOM documents, the M-209 was called AM-1 (Amerikanische Maschine 1=American cipher Machine one) and Sigaba, AM-2 (American cipher Machine two).

The documents produced by TICOM were tagged TOP SECRET. Recently, these documents were declassified and many of them can be downloaded on Internet.

The different kinds of document

We know the meaning of the following types:

• DF: ASA translation of a German document.
• I: Interrogation of a POW (written P/W too).
• T: German translations of decoded traffic.

The TICOM documents related to M-209

The two most important documents about M-209 are DF-120 and I-175.

The German cryptographic agencies

• OKW/Chi (OberKommando der Wehrmacht / Chiffrierabteilung).: The cryptologic agency of Wehrmacht (Army, Navy and Air Force).
• OKH/Chi: The cryptologic agency of Army (Heer).
• OKL/Chi: The cryptologic agengy of Air Force (Luftwaffe).
• Chi Stelle: Lutwaffe Signal Intelligence.
• OKM/Chi: The cryptologic agency of Navy (Marine).
• Forschungsamt: Part of OKL and Göring's personnel cipher organization.
• B-Dienst: The Navy (Marine) High Command of OKM/Chi cryptologic agency.
• Abwehr: Military intelligence agency.
• Pers Z: The Foreign Office cryptographic agency.

TICOM DF-105

TICOM DF-114

The break of a key which results of messages "in depth" is described in detail. We assume a probable word in a message. We move the word at each possible position and visualize decryption corresponding to this position in the second message. If the probable word is located at the right place, there is a piece of plain text in the second message at the same position. By using strips of paper, the German accelerate this method. The cryptanalyst Alfred Pokorn created a stuff to print the strips.

Then, the paper presents a method to find an overlap even when a gap exists (and messages do have different indicators). It was a statistical method based on the supposed presence of frequent trigrams appearing in deciphering when messages were superimposed. This method is better than Friedman's IC (Index of Coincidence) or Turing's Bamburismus, but it is only valid against Hagelin Serie C machines. An overlap of only 50 letters from two messages can be sufficient to find a depth. In comparison, it is necessary to have an overlap of several hundred of letters to do the same thing with IC method.

Several special cases are described :

• Messages in depth when messages are almost identical.
• Messages with two identical indicators except regarding the double letter.

The text concludes by stating that the reconstruction of the plaintext is complex because of secure measures adopted by Americans.

Excerpts:

The first use of the machine by the Americans occured in December 1942 in the African theater of war. The messages are recognizable through two 5-letter indicator groups at the beginning of the message of the type AABCD EFGXY, which are repeated at the end of the message.

The first messages in depth, that is, messages with like indicator groups, appeared in January 1943. Since it was a matter of exceptionally long messages of 682 letters, the entry into the entire system succeeded with them. The two messages were linguistically solved and the first internal machine setting found analytically.

When in April and May 1943, the then widely used strip system, known as M-94, was supplanted by this machine, we could read this new traffic currently as long as messages in depth apparead. Thus, messages were solved from the theater of war in Afica, later in Sicily, and Italy, adn also from the Anglo-American invasion army which was waiting in England. Here it was maily a question of practice messages, which, nevertheless, were read currently and which gave valuable hints to Evaluation, so that, by the beginning of the invasion, a rather clear picture of the strenght and composition of the invasion army had been built up. Since the beginning of the invasion messages mainly from Western front and from Italy are geing worked on.

TICOM I-2

The main machine used, and broken was the American Hagelin which was broken only when errors occured, for instance - The same indicators used twice, or repeat of messages as result of wrong wheel setting (oblt. Schubert is the expert on this). Common and regular solution impossible. Hagelin offered us his machine en 1934 but we refused it because mistakes could be mades as the result of which the machine could be broken. The machine was much simpler then.

TICOM I-31

In the document "European Axis Signal Intelligence in World War II, as revealed by "TICOM" investigations", volume 2, Dr. Huettenhain stated that M-209 depths were found by using "Fasensuchgeraet", a rapid analytic machine, probably the "digraphic weight recoder" described in TICOM I-31. Unfortunately, the complete document is not available and an excerpt has a part obscured by a large white rectangle. in short, it is still classified.

TICOM I-45

TICOM I-46

He first worked in the summer of 1943 on M-209 traffic and stated that unless we made an internal error in the settings or they got messages with the exactly same external indicator, the traffic for all practical purposes is unbreakable.

TICOM I-58

Spring 43. General investigations into 'small technique [TECHNIK]' (Hagelin). 1 example of the BC 38 received from Wa Pruef 7/IV together with the statement that Hagelin was working in America (Dipl. Ing. Voss at STOCKHOLM)...

Summer 43. Works of Dr. Luzius - Dr. Kochendoerffer on the crib problem with the converter 209. First key recovery from a crib. Major Lechner Head of Section In 7.VI. Occasionally conferences with OKW/Chi on BC 38, Enigma, cyper teleprinter (Dr. Stein, Hassenjaeger). Breaking of CROATIAN enigma. Captured specimen of converter 209 from Italy - rougly about August 43.

Winter 43/44. ... Converter 209: column separation [Spaltentrennung].

M209 - B. know of theoretical studies on this from 1942 on, chiefly by SDF LUCIUS. B. himself did some work on it.

BC38 - Swedish Hagelin. (Their spies in Sweden told them the U.S. was adopting a Hagelin idea.)

B. also speaks highly of Sdf LUZIUS' work on M209...

TICOM I-64

Excerpt:
"Can you state how many M-209 keys were broken monthly at OKW/Chi or elsewhere ? Give units and personalities, if recalled, which appeared in the decodes.

B. stated that the operational breaking of 209 was done by the KDRE and he was quite unable to give details. Neither OKW nor OKH worked on it operationally as far as he knew."

TICOM I-76

TICOM I-78

Excerpt:
"The Germans knew that the AMERICAN Government had bought the Hagelin machine which had formerly been offered in vain to the GERMAN Government. An immediate investigation of this procedure was therefore entrusted to Referat PIETSH. Attempts to procure a model of the machine, however, proved unsuccessful. The bulk of material that accumulated grew so big, however, that a special team in the American Referat was entrusted with the investigation of the machine. By careful establishment of addresses and signatures the first inroads into the machine were obtained. Additional assistance was obtained through signals intelligence on the order of battle of the American Army in EUROPE; this enabled specimen messages to be assumed...

With the arrival of American troops in BRITAIN their exercice traffic was continuously read. PW notes in this respect what he has already observed with regard to the M-209, that it is not surprising that traffic is read when mistakes in the use of ciphers were made in every three messages."

TICOM I-109

First Employment of 9 US Army in the AACHEN area, November offensive 1944. The setting up of a new Tactical Air Command and with it the impending employment of a new U.S. Army was known at almost the same time by: ... 2) From decoded M 209 messages, in which the XXIX T.A.C. was named.

M.209 (Small cipher machine). German name for system: AM1 (American 1). The cipher system appeared in American army and air force networks below Army Corps or Command; Speciment message:

       BLKXS RAZLL MACDP XPYUR JMBST YCALN BLKXS RAZLL

Work on the system was done simultaneously in section E at Potsdam-Wildpark and Sigint interpretation station 5 ((NAAST 5)) at St. Germain.

As far as I remember the first messages were decoded in February, 1944, by NAAST 5. They originated from the ground networks of VIII Fighter Command (65th, 66th and 67th wing) and contained statements of an administrative nature, but also tactical indications, sch as the change over to Mustangs etc.

The original of every message was sent to Postdam, one copy to the Army. The army got better results. Because of these results the interception of such messages was stepped up considerably, from about 50 -200-300 messages a day, with priority over other tasks.

On the invasion starting, the GAF cryptanalytic section was finally moved to Paris (14/3, formerly W control 3) and close co-operation in cryptanalytical work was established with the army.

After the start of the invasion some interesting messages about the losses of the 101st Airborne Division were decoded; apart from that the decoded messages were of greater value to the Army than to the GAF.

Cryptanalysis was, as far as I remember, made more difficult later by the fact that the individual services groups (armies, commands) no longer used the same cipher setting, so that they had to be worked out separately.

TICOM I-112

U.S. Hagelin Machine (M.209). The first success was achieved in March or April, 1944. On the Wester Front the keys were broken for 6 to 8 days per month but in the Mediterranean cypher discipline was much stronger and keys were broken on only one or two days per month.

A key chart was captured in September or October, 1944.

Although in theory 22 hours should suffice for breaking, the time lag was 8 to 10 days in practice, owing to delays in the reception of raw material.

The breaking of M.209 was soon left to the Army who intercepted most of the traffic. Hagelin traffic was considered of little value as compared with Slidex which was read in bulk. Lt. Zimmerlin (a French prisoner at Tuttlingen) and Sgt. von Metzen were M.209 specialists.

TICOM I-113

This document concerns several subjects. About M-209, We can read: "This (machine) was broken only on depths. His estimate of the traffic per month intercepted was 1,000 messages; in this they would find about 50 cases of depth, and break a total of about 30% of the intercepts."

Dr Hentze said Kdr 5 worked closely with Lutwafe unit located near St GERMAIN:"... These men were trained by him (Feldwebel) and became expert at breaking M-209 and Slidex..."

TICOM I-119

In his reference to the breaking of M.209 keys VOEGELE meant only one key on each of the days concerned. He was interested only in the Air Traffic. He could not remember the names of any units passing the traffic, but though Oblt. HECKER of Referat B2 (Evaluation) might be able to give this information.

The captured key chart remained in force for 26 to 27 days after its capture, i.e. till the end of the month. VOEGELE did not know where the chart was captured, but Oblt. MOOSHACKE in Evaluation Section of 24th KOMP RGT 351 (no longer a P.O.W.), a lawyer in BAD KISSINGEN, would know the units involved.

TICOM I-128

The foremost achievement would therefore probably be the solution of the American machine M209, although it must be borne in mind that this achievement was helped on considerably by the enciphering errors of the enemy.

TICOM I-154

A. One American system on which P/W worked was a polyalphabetic cipher composed of 25 different random alphabets - P/W thought they were probably in the form of sliding strips, ... {I think it was the M-94}. The alphabets had been reconstructed by the time P/W began work in the department, and cryptanalysis of this system consisted merely in determining the arrangement of the strips. P/W could not recall the details of the process but stated that it involved the assomption of a probable word ... This system was discontinued early in 1944, ... Schneider thinks the system was used only up to division.

E. Prisoner's principal work since Jan/Feb 43 was on the M.209 Converter. The strip system messages referred to in paragraph A above contained frequent references to the Converter, about which nothing was known in the early stages. It was noticed that messages sent in this system contained identical first and initial groups. This fact suggested an analogy with the French machine C-36, with which the Germans were already familiar. Machines and instructions were eventually captured but, in the meantime, solution had beed affected. This work was occasionally performed by the AUSSENSTELLEN, who forwarded their results to GRUPPE 6. Only the Paris Aussenstelle (WM. ENGELHARD and OBGEFR. PRITSCHING).

Prisoner believe M.209 used only up to division, should have been used at higher levels in preferences to SLIDE which has less security...

No translation or evaluation were carried out at Gruppe 6. Broken messages were typed and send to Gen. d. N.A. Cooperation between departments of the army under Gen. d. N.A., and with the other services of the Wehrmacht, was virtually non-existent.

TICOM I-175

This document contains an interview of Alfred Pokorn. The method using strips of paper is described (as in DF-120).
The reconstruction of internal setting is presented in brief (similar of the Morris' method).
The reconstruction of the absolute setting is presented too. this method requires to solve a second message using a probable word.

Excerpts:

The Cipher can be broken in four cases only:

1. When there are two different messages available, ciphered by one signal net, on the same day, and with and indentical starting position of all wheels - same external indicator - so that internal and setting are identical.

   This may be subsequent messages of one station, or a message and the answer thereon, the operator of the 2nd message or the answer turning back the converter to the starting position of the 1st message and neglecting to change the external setting, for the 2nd message or the answer.

2. When there are two indentical messages available, ciphered by one signal net, on the same day, and with an identical starting position of 4 or 5 wheels only, but with the same external indicator, so that internal settings are identical and external settings differ slightly.

   This results by an error in the setting of the wheels to starting position, the typing of the single letter e.g. RSQRFJ and the operator turning the wheels to RSORFJ, in the 1st message. The 2nd message is a correct repetition of the 1st, with identical external indicator.

3. When there are two identical messages available, ciphered by one signal net, on the same day, and with an identical initial position of the wheels, but with a starting position deplaced by one or two letters (or pins) equally on all wheels.

   This results by printing another single letter, than the two first letters of the external indicator, for changing the initial wheel position to the starting position, in the 1st message. The 2nd message is correct repetition of the 1st, with identical external indicator. If the correct single letter differs from that used for ciphering message I, by one letter of the alphabet (e.g. M and N), the starting position of both messages will also differ by one letter - or pin position on all wheels. Same for two (and more) letters, so long as no letters are printed, that could not be turned on on the respective wheel.

4. When an original key-list is captured.

TICOM I-200

TICOM I-202

{note of author: Fritz Menzer created several cipher machines, among them, the SG-41 based on Hagelin C-38 but with no regular stepping.}

TICOM I-205

Marquart spoke briefly of the solution of the M-209 by errors in encypherment and messages in depth which enabled them to work out the periods and pin settings. He said that they never had a captured machine, nor did they ever get cribs on which to work.

He had not head of any other American machine, and did not recognise the term "big American machine"...

Hollerith Machinery: The only cryptanalytic aids at their disposal were Hollerith machines which were used for finding repeats, depths, etc.

From 1941 to 1944 Marquart was in charge of a series of course in elementary cryptanalysis which were given to all newcomers. The length of the course was six weeks or in urgent cases four to five weeks. The course dealt with the elementary principles of susbstitution and transposition, recyphered and unrecyphered codes, conversion tables, additives, etc. Most of the text books at their disposal were of French origin and included Baudoin, Cartier and Geviège {in fact Givierge}. They also possessed a copy of Yardley's Black Chamber.

TICOM I-211

The first break was achieved as the result of a message which was subsequently re-sent with the same indicators but slightly paraphrased, so that the words in the text were slid against each other; their task of diagnosis was also made easier in this case, because, contrary to the instructions which laid down 250 letters as the maximum length of a message, this message was over 700 letters long.

They began by guessing a word in the first text, and then trying it out on the second text, utilising the fact that the slide between the two cypher letters whould be the same as between the clear letters. In this way, they could read the text, and work out the cycle and behaviour of the wheels, which enabled them to derive the relative setting.

He said, about solving M-209 with two messages in-depth: "With practice, they were able to break the relative setting given a minimum of 35 letters of text, although normally they required 60-70 letters. It took then about two hours to derive the absolute setting, after they had broken the initial messages."

About recovery of the absolute setting, the document indicates: "The solution of the absolute setting, which would enable them to read the remaining messages on the day's key, was a more intricate process, and he was unable to recall details, beyond the fact it was always possible."

This was the only method of solution known to them. They could never solve traffic unless they had a depth. The work was done entirely by hand, except that the indicators were sorted by Hollerith. He was unable to say what percentage of keys were read, but thought that it might be about 10%. The only occasion when traffic could be read currently was when they captured some keys in advance in Italy, which continued to be used. There was a theoretical method of solution on one message given at least 1000 letters in a message, but this had never occured and he did not remember the details.

TICOM IF-107

Before describing his work on the Converter M-209 "G" advised us that a French Hagelin machine had been originally broken in 1940. He called this machine the C-36, and advises that it had fixed lugs (which he called cams) and that the kicks were always 1, 2, 4, 8 and 10. He stated, however, that the internal settings (which he called constellations) were changed only every few months. Solution was effected through the fact that nearly all messages started with "Refer". The original solution was accomplished from the beginnings of about 50 messages. He also advises that when the internal settings were changed the new traffic was sent to Berlin by courier and that Berlin was usually able to effect the solution within 48 hours.

"G" advises that the M-209 was not broken while he was in Berlin. The first break occurred in the Autumn of 1943. However, in June 1943 an M-209 key list for the month of June was captured in Sicily. The capture was not apparently reported because traffic was sent and read on the captured keys during the entire month of June.

The work of "G's" unit on M-209 traffic consisted entirely of breaking through depths. "G" knew that the M-209 internal settings were changed daily and that a number of keys were in use at the same time. His unit received 200-250 messages per day. "G" believes that the M-209 traffic is unbreakable except from depths. As far as "G" knows no solution was ever accomplished by the Germans from near depths, from stereotyped beginnings, or in any other way. He advises that in May 1944 they found depths on nine different days and were able to break eight of these days. He remembers specifically that discriminants PY and NC were broken. He was asked as to whether any work was done on messages whose indicators agreed except for index letter or except for one of the other six indicator letters, and replied that these messages were attacked on the theory that they were in truth depth and an error had been made in transmitting the indicator of one of them. He stated that the checking indicator at the end was not really a check because their intercept operators knew that there must be a check and consequently always forced an agreement in their intercepts. He was under the impression that the indicators were taken from lists and that there was a check off system and this accounted for their theory that approximately identical indicators did represent a true depth. The belief in a check-off system arose from the number of depths observed. It was thought, of course, that a depth resulted from a careless failure to check off.

"G" knew of the capture of some M-209 machines and some instruction booklets. He states that he recalled that the instructions provides that one wheel must have a kick of one, on wheel a kick of two and one wheel a kick of three or four and that all kicks must be possible. However, he states that he was not in Berlin at the time of arrival of the captured instruction book and consequently was a little vague as to the details of the instructions.

"G's" work consisted of reading the depth and reconstructing the pin and lug settings from the key derived. He realized that this obtained only relative pin setting; apparently others worked on trying to obtain the absolute values of the pin settings. He did not know how this was done except that he knew that "ZPARENZ" was used in some manner in other messages after relative settings had been recovered to try to get the absolute settings. He advises that they always watched for a retransmission following a report of a message being indecipherable. Traffic analysis personnel was helpful in this regard. He knows of two cases in which a message was repeated with one wheel different and states that this helped in recovering the absolute settings.

Copies of all intercepts were sent to Berlin and apparently the cryptanalysts at Berlin Headquarters competed with those in the field in an effort to obtain solutions as rapidly as possible.

"G" advises that 60 elements of key were about the minimum necessary for reconstruction of pin and lug settings. He stated that it was possible with about 40 elements but very difficult. The technique of resolving key was the obvious one of writing out the key on all wheel periods and looking for the high kick wheels first. "G" called these "the big wheels". He advises that reconstruction of internal settings was much more difficult when the number of overlaps was heavy. He remembered two cases where key was derived from staggers rather than from ordinary depths. He states that he and his associates often wondered why the slide (which he described but did not designate by that name) had been eliminated from the original machine.

"G" advises that usually it took about two days to solve a depth and reconstruct the internal settings. Then it usually took two more days to derive the absolute settings. As a result of this and delays in obtaining intercepts it was usally at least a week before a day's traffic was fully out.

"G" advises that Doctor Rinow, who was a Sergeant and a Mathematician, worked on the reconstruction of the M-209. Apparently he and Luzius and Steinberg determined the nature of the machine prior to its capture. "G" advises that the M-209 keys from the 82nd and 101st Airborne Divisions were captured in Normandy. These covered June 6, 7, 8, 9, 10 and 11. They were received by "G's" unit on June 9 from General Rundsted's Headquarters at St. Germain. The capture was evidently not reported because the keys continued to be used and all traffic was read. "G" remembers one message in which General Taylor asked someone in London to send word to the U.S. advising that certains persons, whose names were listed, were safe.

"G" suggested that the U.S. procedure for reporting captures of keys be tightened up. He seemed to feel that we were more lax in this regard than the Germans, and that this was a very grave menace to our cryptographic security.

"G" was under the impression that more M-209 traffic was being read than we imagined, this being due mainly to errors and breaches of security rather that the system itself. He felt, however, considering American traffic as a whole, that they were probably less successful that we anticipated.

CONCLUSIONS: "G" speaks excellent English and most of his information was very precise and clear. He had difficulty in finding words for some of the technical German cryptographic terms. There were, of course, a number of inaccuracies in his story. For example, he always called the M-209, the M-305. He was asked where he got that number from and said that he thought he had read it in a decode but that it might have been some other number.

He was fully cooperative and answered all questions freely and with apparent honesty. He explained that his cooperation was motived by his belief that Germany had no chance of winning the war and that the sooner it was over the better.

TICOM NR3946-M209

In this document, we learn that M-209 key lists (for one month) were captured in June 1943 in Sicily. During Normandy invasion, the key lists from 6th to 11th June were captured too.

HW 40-89

...MUENTZ stated that these key-sheets referred to the M.209 keys which were captured several times in 1943 during the Italian campaign...

He was certain that the only captured machines in his department were M.209 and was unaware that any others were held by other departments. He admitted, however, in this connection that he had no liaison with OKH and the Lufwaffe other than on M.209 problems and felt sure that very little interchange of ideas and successes over took place. He had never heard of OKW/Chi, but stated very emphatically that OKH was the department considered most expert on machine work.

Other documents

"Signal Intelligence Service of the Army High Command" paper refers to other TICOM documents which talk about M-209: I-80, I-142, I-144, IF-153.

The first volume of "European Axis Signal Intelligence ... " (Vol 1: Synopsis) lists all TICOM documents related to M-209:
I-5, I-6, I-22, I-23, I-31, I-35, I-48, I-50, I-60, I-80, I-83, I-92, I-93, I-95, I-142, I-144, I-147, IF-127

The author was unable to obtain any of these documents.

References

• TICOM Archive – Secret Intelligence in Nazi Germany [Top Secret Ultra] TICOM
• Christos Triantafyllopoulos's blog - The American M-209 cipher machine
  Remark : The Chistos's blog contains a great quantity of valuable informations about cryptography history. M-209
• GOOGLE
  Remark : most of documents quoted in the TICOM Archive site (DF-120, …) are in fact stored at Google. docs.google.com
• TICOM: Determination of the Absolute Setting of the AM-1 (M-209) by Using Two Messages with Different Indicators DF-105
• How successful were Hitler’s Codebreakers ?, by John Jackson
• TICOM: Volume IV : Signal Intelligence Service of the Army High Command.
• European Axis Signal Intelligence in World War II as Revealed by 'TICOM' Investigations and by Other Prisoner of War Interrogations and Captured Material, Principally German. Index (9 volumes, M-209 is quoted in the volumes 2,3,4,5).
• TICOM and the Search for OKW/Chi, by Randy Rezabek, Cryptologia, Volume 37, Number 2, 2013