Wheel Breaking

Before any wheel-setting for a message could be done in order to decrypt it, first the patterns on the various wheels of the Lorenz machine had to be known. These patterns were changed infrequently enough that once they were known, they could be used to decrypt several messages. Thus the process of wheel-breaking--discovering wheel patterns--was very important to the decryption process.

Depth Attacks

The first method used to break wheels of the Lorenz machine came from depth attacks. When two messages were sent with the same wheel settings, the original messages could be extracted by adding the two copies together and doing some clever guessing. Then the keystream used could be deduced from the decrypted messages. Using knowledge of the structure of the machine--mostly regarding the periodicity of the χ wheels and the stop and go nature of the ψ wheels--the patterns on each of the wheels could be deduced. This process usually involved some clever guess-work by the cryptanalysts. However, this relied on the German teleprinter operators making a mistake (i.e. sending two messages with one key), so it was not very consistent. Luckily Bill Tutte, the man who discovered the structure of the Lorenz machine along with the double-delta attack against it, came up with a fairly mechanical method to discover wheel patterns.

Rectangling

Bill Tutte's technique was known as rectangling because it involved writing out an encrypted message in a rectangular table. It was based on the same principles as Tutte's double-delta attack. The fundamental point was that the sum Δ Z₁ ⊕ Δ Z₂ ⊕ Δ χ₁ ⊕ Δ χ₂ would be zero more than half the time. The idea of the attack was to draw a rectangle with dimensions equal to the first and second χ wheels (i.e. 41 x 31). Then a cryptanalyst would write out the bits of Δ Z₁ ⊕ Δ Z₂ in the rectangle in the following manner:

1. The first bit would be written at location (1,1), the first row and first column.
2. Each subsequent bit would be written in the next row and next column so that the bits ran down the diagonal.
3. When the bottom or right side of the rectangle was reached, the bits would wrap back around at the top or left side respectively.
4. This process would continue until the entire stream of Δ Z₁ ⊕ Δ Z₂ had been written out.

The result of this is that the bits of the double-delta stream would appear in diagonal stripes down the rectangle. If the message was long enough, many squares on the rectangle would contain several different bits. The point of all this is that, since Δ Z₁ ⊕ Δ Z₂ ⊕ Δ χ₁ ⊕ Δ χ₂ is zero more often than not, each square of the rectangle would be a weak approximation of the correct value of Δ χ₁ ⊕ Δ χ₂. By choosing a square's value to be the number of ones minus the number of zeros in that square, a good guess at Δ χ₁ ⊕ Δ χ₂ could be made. Under this system, a high positive value in a square would imply that it is more likely to be a one and a very negative value would imply that it is more likely to be a zero. Once this is completed there is another process used to separate Δ χ₁ and Δ χ₂. This went as follows:

1. A row would be chosen which was especially likely to be correct i.e. all the numbers had a large absolute value.
2. A few cells in that row would be chosen which had higher absolute values than any others.
3. A one would be written along the edge of the table below each cell which had a high positive value and a zero if it had a low negative value.
4. These were assumed to be a good initial guess at Δ χ₂.
5. Now for each row take the cells under which ones or zeros were written in step 3.
6. If there is a one on the edge of the table below a cell negate the value in that cell.
7. After this has been done for all rows, add up all the values in a given row.
8. If this is positive write one at the edge next to the table, if negative write zero.

At the end of this process the entire left edge of the table would have a pattern of ones and zeros next to it that was a good guess at Δ χ₁. Repeating this process using the left edge to guess the values of the bottom edge would give a better estimate for Δ χ₂. The repeating of each of these over and over would cause the wheel patterns to converge to a very good approximation of the real patterns.

At first, rectangling was done by hand, but later on special programs for the Colossus were designed to accelerate the process. This was possible because rectangling had much in common--algorithmically speaking--with the double-delta attack for which Colossus had been designed.