The Lorenz Schluesselzusatz SZ40/42

During WWII different types of cipher machines were used as teleprinter attachments. They were given the name "Fish" by the codebreakers. One of these fishes was the Lorenz SZ40/42, named "Tunny".

One of the goals of the codebreakers at Bletchley Park was to break this Tunny machine to decrypt the messages of the German Army. Unfortunately this machine was much stronger than the known Enigma machine.

The Lorenz Shluesselzusatz consists of 12 wheels. The message to be encrypted or decrypted comes in as Baudot teleprinter code. Each bit is either a pulse or the absence of a pulse representing a cross or dot (1 or 0). Each character is decomposed into its five bits which are processed in parallel. Wheels are used to generate a pseudo-random keystream which is XORed with the plaintext bits. Each wheel has pins on it where each pin can represent two states, either a one or a zero. Thus a wheel is a bit sequence.

The Lorenz machine has two sets of wheels, a regularly stepping set called the Chi-Wheels and an irregularly stepping set called the Psi-Wheels. The wheels all have different periods which are relatively prime to obtain the largest possible number of wheel setting combinations. This ensures that the maximum length of a message is the product of the wheel lengths which is for the Chi-Wheels 23 x 26 x 29 x 31 x 41 = 22,041,682. This is long enough to ensure that a message is not encrypted more than once with the same keystream.

The irrugularly stepping Psi-Wheels are controlled by two motor wheels in series. The first motor wheel steps every time and the second motor wheel steps only if the first motor wheel is a one. The Psi-Wheels step only if the second moter wheel is a one.

For the following analysis we denote the generated Psi-Wheel sequence with Psi'. This sequence is different from the wheel sequence since the wheels don't step every time.

The five Chi-Wheels and Psi-Wheels both produce 5-bit teleprinter letters which are XORed onto the incoming teleprinter message as shown in figure 1. Thus applying the theory of additive ciphers gives immediately as the keystream


and the encrypted message is

Figure 1: Lorenz encryption scheme

Encryption Procedure

For the successful encryption and decryption both the sender and receiver had to have the same wheel settings which had to be different for each message. One method for exchanging the wheel settings was sending the letters on the corresponding wheels as an indicator. Here the wheels were wired according to a table such that a given letter determined the wheel position uniquely.

In 1942 this method was discontinued and a QEP book was used instead. This book contained several hundred wheel settings. The operator sent "QEP" and the number of the wheel setting in clear text. After a QEP book was used up it was discarded and a new book was started.

After exchanging the wheel settings the operator entered the message on the keyboard of a teleprinter. The clear text message was passed to the SZ40/42 where the encryption procedure took place. The message passed through the Chi-Wheels and Psi-Wheels. This final encrypted message went on the public line to the receiver where it was processed by the SZ40/42 to strip off the keystream.

The wheel patterns and starting positions of the wheels, which determine the keystream, were changed in a short period of time (daily/monthly).

The task of the codebreakers was to find the structure of the machine, the wheel patterns and the initial wheel positions from encrypted traffic only.
The easiest method possible is the brute-force attack, which consists of trying all possible settings and see whether the resulting message consists of German military language. Since not all characters in this language have the same probabilty one can deduce probabilities for certain characters over a whole range of clear text messages. Thus the brute-force attack can be automated by filtering for certain common characteristic probabilities of the clear text message.

Unfortunately the number of possible combinations is far more then even a modern computer could ever calculate since the number of wheel patterns is


and the number of wheel settings is


giving a total number of combinations of:


This number is far beyond any possibility of trying all settings. Thus better methods had to be found. These are described on the following pages.