|
|
|
|
|
|
|
Hagelin USA Pin-wheel C-443 → BC-38 → ← C-37
Pin-and-lug cipher machine
M-209 was a light-weight portable
pin-and-lug
cipher machine,
developed at the beginning of World War II
by Boris Hagelin
of AB Cryptoteknik
in Stockholm (Sweden), and manufactured
by Smith & Corona in Syracuse (New York, USA).
The machine is designated CSP-1500 by the US Navy and is the
US military variant of the C-38,
which in turn is an improved version
of the C-36
and C-37.
A compatible motorised version – with keyboard – is known as
BC-38
(later: BC-543).
During WWII, the M-209 was known by German cryptanalysts as AM-1
(American Machine #1).
|
The machine measures 178 x 140 x 83 mm – about the size of a lunch box –
and weights 2700 grams. It has six adjustable cipher wheels
with movable lugs, that protrude the top lid.
The wheels, pins and lugs are used to set the initial state of
the machine, also known as the key.
The machine does not require electricity.
Text is entered letter-by-letter, by setting the alphabet ring at the left
to the desired input letter and turning the black knob at the right by
one full revolution. The output letter is then printed on a narrow paper strip
by the printer at the left side.
|
|
|
|
The cryptographic strength of the machine was reasonable
for its time, but was not perfect.
As of early 1943, it was assumed that German codebreakers
were able to break an M-209 message in less than 4 hours. 1
Nevertheless, it was considered sufficiently secure for tactical messages
which, due to their nature, would be meaningless after several hours.
This is why the M-209 was later also used in the Korean War.
The M-209 was succeeded in 1952 by the C-52
and CX-52.
|
-
Although the Germans occasionally succeeded in breaking an M-209
intercept in about 4 hours, it generally took much longer
than that, and was only possible if messages had been received
in depth. 2
It typically took them several days or even weeks. More...
-
In depth means that two or more messages have been intercepted that
were created on the same key (which means identical internal and
external settings of the machine).
|
|
Approx. 140,000 M-209 machines were built.
Although Hagelin would generally build his own machines, the M-209 was
produced in the US by LC Smith & Co, in Syracuse, New York ( USA),
under licence 1 from Hagelin [1].
Three different versions of the M-209 are known:
|
|
Apart from some manufacturing differences — described in more detail
by Nick Gessler
[2] —
these machines are all compatible.
After WWII, Hagelin produced improved versions of the M-209 design,
such as the C-443
and C-446,
and later the C-52
and the much improved CX-52.
|
-
In has since become known, from documents released by the NSA in 2014 [7],
that Hagelin had sold the patent rights of the M-209 to the US Army at the
beginning of WWII.
As part of the deal, Hagelin's company had obtained a
royalty-free reproduction right of the machine.
More...
|
The image on the right shows a typical M-209-A machine,
built by LC Smith Corona Typewriters Inc.,
under licence from the US Army.
Acdording to the serial number plate, it was supplied
by the Hagelin Cryptograph Company in New Milford, Connecticut ( USA).
The name Smith Corona is present inside the cover.
More pictures of this machine are available below.
|
|
|
The M-209B is identical to the M-209A, except for some minor production
differences. In most cases these are simplifications in manufacturing,
described in more detail by
Nick Gessler
[2].
The image on the right shows a typical M-209-B unit in mint condition.
It came complete with the original canvas carrying bag,
the instruction booklet,
all accessories
and an empty paper reel.
The name of the manufacturer, Smith Corona,
is printed on the inside of the cover.
|
|
|
|
|
Bag
|
|
M-209
|
|
Tools
|
|
Book
|
|
Capsule
|
|
Cage
|
|
Manual
|
|
Clips
|
|
The M-209 was usually stowed in the canvas bag shown in the image on the
right
It has several comparments for holding the machine, a pencil,
a message book, spare paper reels and the instruction booklet.
A long canvas strap was supplied to allow the bag to be attached
to a soldier's webbing. In addition: a short canvas strap was supplied
for fitting the machine to a soldier's knee.
|
|
|
The actual M-209 cipher machine was housed in a metal olive drab green
enclosure. It was manufactured by Smith & Corona after the technical
drawing that were provided by Hagelin.
Over the years, small manufacturing changes were made,
but these had no effect on the operation or compatibility of the machine.
As far as we knowm the machines are designated M-209, M-209A and M-209B.
|
|
|
Each machine came with a set of maintenance tools and spares, that were
stowed inside the metal cover. Apart from the paper reel, the cover holds
a pair of tweezers, a screwdriver, an oil tube
( marked 'O') and a tube with
spare ink rollers ( marked 'I').
Inside the lid of the oil tube is a needle that can be used to apply
oil to the mechanism. If it is empty, use a synthetic motor oil, like
15W40, as a replacement. Never use WD-50. 1
|
|
|
-
Although WD-40 is sold as a lubricant, it is fact a water displacer (WD)
that will cause the moving parts of the machine to bind when it is not
operated frequently.
|
This small message book was used for writing down encrypted or
decrypted messages. It is small enough to be stowed inside one of
the pockets of the canvas carrying bag.
Carbon paper is used to create a duplicate when writing down a
message. The duplicate page is thinner than the primary one, so that
it can be fitted inside a pigeon capsule more easily. Note that the
duplicate pages of the M-210A book are thinner that those of an
M-210 book.
|
|
|
Once a message was encrypted, it could be handed to a radio operator
for subsequent transmission via
morse code or telegraphy.
Alternatively, the thin duplicate of the message could be folded
down to fit a small capsule that could be attached to the leg of a pigeon.
Note that the duplicate pages of an M-210A book are slightly thinner
than those of a standard M-210 book, making them more suitable for transport
in a pigeon capsule.
|
|
|
During WWII, British pilots took one or two pigeons in the cockpit on each
flight, so that they were able to send an (encrypted) message home after a
crash. The message was then folded and stored in a capsule and attached to the
leg of the pigeon, which was then released.
The carton box shown in the image on the right was used, probably during the
Vietnam War, as a cheap and lightweight alternative for a wooden pigeon cage.
|
|
|
The M-209 came with a small booklet with operating instructions, that
can be fitted in one of the pockets of the canvas carring bag. The
original TM 11-380 manual was issued in 1942, and provides operating
and maintenance instructions.
A more elaborate version was issued just after WWII, in May 1947.
The image on the right shows both versions.
➤ Download 1942 instruction manual
|
|
|
The four black steel clips, shown in the image on the right,
were supplied with each machine. They were used to attach a piece of
plaintext to the edge of the metal cover, so that the operator did
not have to hold it in his hand, whilst encrypting.
In practice, only one or two clips were used. The others were
supplied as spares.
|
|
|
When encrypting (or decrypting) a message, the output letter is printed
onto a narrow paper strip. A suitable paper roll should be installed inside
the cover (behind a metal retainer) and fed into the printer at the left.
Two types of paper were available: regular paper (shown here) and
pre-gummed paper. By using a moisturiser, the gummed paper could be glued
directly to a message form, in the same way as an old telegram.
|
|
|
Two different canvas straps were available for carrying the canvas
storage bag, or for attaching it to a soldier's webbing:
a short one,
that can be used for carrying the bag in the hand,
and a long one,
that allows it to be hung from the shoulder.
In some cases, both straps were provided and attached at the same
time, as shown in the image on the right. Furthermore, an adjustable
strap could be used to fit the machine on the operator's upper leg,
so that it can be operated from within a driving vehicle.
|
|
|
|
The following stamps and markings may be found on M-209 machines:
|
SC Source Control SCD Source Control Drawing (or Source Control Document) CACH Manufacturer's code for Smith-Corona (the US manufacturer)
|
In 1935, the US Army was looking for a device
that could replace the aging M-94,
a hand cipher that had been around since
the days of Thomas Jefferson.
The M-94 pocket cipher
was easy to break, and the US Army wanted something more
secure, that was suitable for tactical messages.
For a long time, Boris Hagelin
had been trying to sell his cipher machines to the United States.
He visited the US in 1937 and again in 1939, demonstrating his
C-36
to William (Bill) Friedman,
the cryptographer of the
Signals Intelligence Service (SIS)
of the US Army. Friedman liked Hagelin, but disliked the machine.
Although it was theoretically unbreakable, it could be setup in such a way
that it became weak and readable.
So, Hagelin returned to Sweden to improve the machine.
In April 1940, Germany invaded Norway, whilst the improved machine
wasn't ready yet. Fearing for the future in Sweden, Hagelin persuaded
the Swedish Government to make him an official courier, and left the
country with his wife Annie, trying to make his way to the United States.
On 10 May 1940, following a distressful journey through war-torn Europe,
they finally reached Italy, where they boarded the Conte de Savoia;
the last ship that would sail to the United States.
In his luggage were two dismantled
C-36/C-38 machines
and the engineering drawings. After several days, they safely arrived
in New York, and Hagelin setup an office in Connecticut.
The rest is history. Hagelin finished the design and
sold the rights to the US Government for no less than US$ 8,614,790
using a French banker – James Paulding – and an American Wall Street
broker – Stuart Hedden – as feduciaries. 1 The new machine,
designated M-290,
would become the workhorse of the US Army.
By the end of the war, no less then 140,000 had been built
at Smith & Corona in Syracuse (New York).
It made Hagelin the first crypto millionaire in the world.
He retained a royalty-free reproduction right, and would later sell
a civil variant as the C-38.
➤ The Gentleman's Agreement
➤ Operation RUBICON
|
 |
-
Hagelin wanted the royalties to be described as 'capital gains'
which were not taxed in Sweden. Instead he payed 25% income tax
in the US [8]. His gross proceeds were US$ 2.8 million (netting at
US$ 1.8 million). Pauling received US$ 430,000
and Hedden US$ 140,000. Smith & Corona made a profit of
US$ 5 million.
|
In 1942, there was a debate between the US Army cryptologists at Arlington
Hall (Virginia, USA), and the British Government Code & Cipher School
(GC&CS, now: GCHQ) at Bletchley Park ( BP)
in the United Kingdom ( UK).
The British had been reading Italian Hagelin traffic, and feared that the
Italians would eventually be ably to read American Hagelin traffic.
The Americans chose to ignore it, and kept using the machines. According
to them, the effort to break it was impractically high.
It proved however, that American cryptologist
William Friedman, had been
right all along. He liked the Hagelin machines and had found them
to be theoretically unbreakable, but knew that they could be setup
in such a way that they became weak and vulnerable to cryptanalytic attacks
[8]. British and American codebreakers were able to read the Hagelins
from both enemies and allies.
After the war it became clear that the
Germans were able to read 10% of the American Hagelin traffic: 6%
from cryptanalysis, and 4% from captured keys. But due to the amount of
work involved in breaking, the delay between intercept and decrypt
was usually 7 to 10 days; too long to be usefull for tactical messages
like the ones sent by the US Army.
Apparently, the Japanese also understood many of the principles of Hagelin
exploitation, but hardly broke Hagelin traffic [8].
For high-level messages, the Americans used a rotor machine —
SIGABA — which was similar to Enigma, but
much much more advanced. As far as we know,
SIGABA was never compromised.
|
Immediately after WWII, in 1947, the NSA started the
development of a cryptanalytic machine
named WARLOCK I
— also known as AFSAF-D79
and CXNK —
that was able to solve the Hagelin C-38/M-209 much faster than
with hand methods.
The machine became operational in 1951 and was used to read the
traffic from many countries that were using M-209 or C-38 machines.
The US had 'accidentally' released large batches of M-209 machines
on the surplus market for as little as US$ 15 and even US$ 2 [8].
Many of these were purchased by South American countries.
|
| |
WARLOCK I - tailored for solving Hagelin C-38
|
Note that WARLOCK I could also be used against
similarly operating Hagelin machines, such as the C-38,
BC-38, BC-543, C-443, C-446
and probably also the C-52 (but not the CX-52).
In [3], Dennis Richie describes how he collaborated in the 1970s with
Jim Reeds and Bob Morris, on a ciphertext-only attack on the M-209.
It allowed them to solve messages of 2000-2500 characters.
After discussions with the NSA, it was decided not to publish the details
of their investigations at the time, as the principle was applicable to
machines that were still in use.
|
The document below was used as a training manual for Dutch cryptanalists,
probably during the 1970s.
It describes the Hagelin M-209 and the C-446A in great
detail and also discusses the machine's cryptanalysis and methods for its attack.
The document is in Dutch and was released for publication
by the Dutch school for Military Intelligence (DIVI) in 2011 [5].
➤ Download description and cryptanalysis of M-209 (Dutch)
|
A detailed description of the cryptanalysis of the M-209 is available from
Jean-François Bouchaudy
[6]. During his
M-209 challenge in 2012,
he discovered that a single message of less than 400 characters still
can't be broken today, not even with super computers.
➤ Detailed cryptanalysis (off-site)
|
An excellent simulator with superb graphics is available from Dirk
Rijmenants in Belgium. It is fully compatible with the real thing and can be
downloaded directly from his website.
It runs on Windows 98/ME/2000/XP/Vista and Windows 7.
Under emulation it also runs on Linux (WINE) and Mac (Parallels Desktop).
➤ Download (off-site)
|
|
|
A fully operational 3-dimensional M-209 simulator was created in 2024 by
Martin Gillow of Virtual Colossus
fame. There is no need to install anything
on your computer, as it runs entirely in the browser.
Use your mouse to watch the machine from every angle, open the lid,
rotate the rotors, select an input letter and rotate the encryption knob.
Full instructions are on the website.
➤ Run Virtual M-209 (off-site)
|
|
|
A command-line M-209 simulator was made by Mark Blair and can be downloaded here.
It is written in C++ and runs on UNIX/Mac.
➤ Download (off-site)
|
Device Portable mechanical cipher machine Purpose Encryption of tactical military traffic Class Pin-and-lug (pin-wheel) Manufacturer Smith & Corona, (Syracuse, New York, USA) Country USA Inventor Boris Hagelin Period WWII Predecessor C-38, C-36 Successor C-443, C-446 Pin-wheels 6 Segments 17, 19, 21, 23, 25, 26 Period 101,405,850 Lock Push-button Operation Knob Lugs Movable Colour Green wrinkle paint Alphabet Latin, 26 characters (A-Z) Dimensions 180 × 140 × 80 mm Weight 2.7 kg Quantity ~ 140,000
|
1 × Can, ink pad 1 × Can, oil 1 × Case, carrying, canvas 4 × Clip, message 2 × Message book M-210 1 × Screwdriver 2 × Tape, paper, 3/8" wide, 1 use 1 sp 2 × Technical Manual, TM 11-380 1 × Tweezers, 4-5/16" long
|
- War Department, Technical Manual, Converter M-209
Part of David Stroud Collection. Scanned by Nick Spark.
TM 11-380. 27 April 1942.
- Original WWII M-209 checklist
US Signals Corps, 3 September 1945.
- SMID, C-446A en M-209 Beschrijving en Analyse
Descryption and analysis of the Hagelin C-446A and M-209 (Dutch).
Dutch Department of Defence, Military Intelligence School.
|
- Hans Stadlin, 100 Jahre Boris Hagelin 1982-1992 (German)
Crypto AG. Crypto Hauszeitung Nr. 11. Jubilieumausgabe September 1992.
- Nick Gessler, Differences between M-209 models
Details useful in identifying the various models and subtypes.
- Dennis Richie, Dabbling in the Cryptographic World - A Story
Date unknown. Updated 5 May 2000. Retrieved November 2011.
- Klaus Schmeh, Breaking M-209 during WWII (German)
Als Deutscher Code-Knacker im Zweiten Weltkrieg.
Klaus Schmeh. 23 September 2004.
- SMID, C-446A en M-209 Beschrijving en Analyse
Description and analysis of the Hagelin C-446A and M-209 (Dutch).
Dutch Department of Defence, Military Intelligence School.
- Jean-François Bouchaudy, M-209 Cryptanalysis
Retrieved July 2016.
- Collection of M-209 patent and license agreements
A66684. Declassified by NSA on 11 June 2014 (EO 13526).
➤ More on this subject
- CIA Historian, MINERVA, a History
Internal CIA publication TOP SECRET, 2005-2008. pp. 8-9.
➤ See: Crypto Museum, Operation RUBICON
|
- M-209 on Wikipedia
- M-209 on Jerry Proc's crypto pages
- Dirk Rijmenants, M-209 simulator for Windows
- Jean-François Bouchaudy, The cipher machine M-209
|
- C-38, the civil version
- C-37, the predecessor
- C-36, another predecessor
- C-443, the successor
- BC-38, keyboard version
- The Gentleman's Agreement (NSA-Hagelin)
- About Crypto AG (the company)
- About Boris Hagelin (the inventor)
- Other Hagelin cipher machines
- Other US cipher machines
|
|
|
|
Any links shown in red are currently unavailable.
If you like the information on this website, why not make a donation?
Crypto Museum. Created: Wednesday 05 August 2009. Last changed: Thursday, 06 June 2024 - 15:42 CET.
|
|
|
|
|
