The C-38 / M-209 cipher machine

Introduction
Cryptographic principle of the C-38 and M-209
Preparing the C-38 for cipher work
C simulation of the C-38

Introduction

After Swedish cryptologist Yves Gyldén had examined the predecessor C-35/C-36, he suggested a number of cryptographically sane improvements to mr Boris Hagelin, the inventor. The resulting machine was christened C-38 and adopted for use by the Swedish armed forces.

Boris Hagelin, ca 1980

Later, in April 1940, when Hagelin heard about the German invasion of Denmark and Norway, he decided to try and sell the new machine to the U.S.A. With the aid of the Swedish Foreign Office, he was able to smuggle two machines via diplomatic pouch to the United States where it was adopted under the name M-209.

Cryptographic principle of the C-38 and M-209

The C-38/M-209 is heavily based on the earlier C-35/C-36 models, but with a number of improvements. The reader is recommended to read the page on the C-35/C-36 to better understand the following explanation.

The improvements suggested by Yves Gyldén consisted of having six pin wheels instead of five, movable lugs on the bars of the cage (the C-35/C-36 had fixed lugs), and an increased number of bars in the cage. There is also the possibility to offset the used alphabet by a fixed number of steps, which, cryptographically, has the effect of adding a constant number to the key produced by the machine.

The M-209 is virtually the same machine as the C-38, the only difference being, that the M-209 has got a cage with 27 bars, whereas the C-38 has a 29-bar cage. This means, that you can set up a C-38 to emulate an M-209, but the opposite is not possible for certain keys.

The use of larger number of bars on the cage has the effect of allowing several wheel patterns to result in the same displacement of the alphabet, thus introducing problems for the would be cryptanalyst.

The circular entry knob

On the left side of the machine there is a circular knob bearing the alphabet engraved around it's circumference. This knob is turned until the desired letter to be processed is shown against a benchmark.
The knob itself can be set against a second benchmark - the offset (on the C-38, my M-209 doesn't seem to have this facility), with the aid of a second, engraved alphabet. This displaces the input alphabet, relative the output, cipher alphabet, when the knob is set at any other position than 'A'.

	Engraved input alphabet: ABCDEFGHIJKLMNOPQRSTUVWXYZ
	Offset alphabet = 'A'  : ABCDEFGHIJKLMNOPQRSTUVWXYZ
	Cipher alphabet        : ZYXWVUTSRQPONMLKJIHGFEDCBA

	Engraved input alphabet: ABCDEFGHIJKLMNOPQRSTUVWXYZ
	Offset alphabet = 'B'  : BCDEFGHIJKLMNOPQRSTUVWXYZA
	Cipher alphabet        : YXWVUTSRQPONMLKJIHGFEDCBAZ

        etc.

The pin wheels

The six pin wheels of the C-38 have the following individual periods: 26 25, 23, 21, 19 and 17.
Around the circumference of the pin wheels the following sequences of letters are engraved:

Pinwheel I or "26 wheel": ABCDEFGHIJKLMNOPQRSTUVWXYZ Pinwheel II or "25 wheel": ABCDEFGHIJKLMNOPQRSTUVXYZ Pinwheel III or "23 wheel": ABCDEFGHIJKLMNOPQRSTUVX Pinwheel IV or "21 wheel": ABCDEFGHIJKLMNOPQRSTU Pinwheel V or "19 wheel": ABCDEFGHIJKLMNOPQRS Pinwheel VI or "17 wheel": ABCDEFGHIJKLMNOPQ

Part of the six wheels protude through the casing of the machine, where there is a benchmark against which the six wheels can be set (each wheel can be rotated individually). This setting forms part of the outer key, or message key.
At each position on the wheels having a letter, there is a small pin. This pin can be pushed to the right (active position - one) or to the left (inactive position - zero). The pattern of active versus inactive pins forms the first part of the inner key setting.
Care must be taken when choosing the pin patterns. Roughly half of the pins on an individual wheel should be set in active position. Long stretches of the same type of pin setting should be avoided (e.g. a pattern on wheel 17 looking like this would be a bad choice: 00000011111111001), and one WWII operations instruction even forbids longer stretches than four of the same symbol.

For each letter to be enciphered, the six pin wheels each move one step. In doing so, the pattern of the active and inactive pins occuring at the benchmark position will change and give rise to a series of six zeroes and ones (64 individual patterns), having a period of 26x25x23x21x19x17, or 101,405,850.

The cage and lugs

Behind the six pinwheels is the cage. It is composed of two circular endplates holding 29 (27 in the M-209) horizontal bars.
On each bar, two movable lugs are positioned. These can be moved to occupy six active (corresponding to the six wheels), and two inactive positions. The pattern comprises the second part of the inner key setting.
The pins of the pinwheels, when in active position on a specific pinwheel, displaces the bars of the cage to the left when encountering a lug set in the position corresponding to the pinwheel. Part of such a bar will protude slightly, and act as a tooth on a cog wheel, displacing the circular knob one step.
If, for instance, five bars protude and the letter at the input benchmark on the knob is 'R' (no offset used), the following occurs:

        Benchmark              : -----------------v--------
	Engraved input alphabet: ABCDEFGHIJKLMNOPQRSTUVWXYZ
	Offset alphabet = 'A'  : ABCDEFGHIJKLMNOPQRSTUVWXYZ
	Cipher alphabet        : ZYXWVUTSRQPONMLKJIHGFEDCBA


        The knob turns 5 steps.
        -----------------------
        Benchmark              : -----------------v--------
	Engraved input alphabet: VWXYZABCDEFGHIJKLMNOPQRSTU
	Offset alphabet = 'A'  : VWXYZABCDEFGHIJKLMNOPQRSTU
	Cipher alphabet        : EDCBAZYXWVUTSRQPONMLKJIHGF
        Output                 : -----------------^--------

Thus 'R' is turned into 'N'.

Lug patterns

The lug patterns can't be chosen randomly if security is to be achieved. The patterns must be chosen in such a way that all numbers from 0 to 25 can be formed by the 64 possible pin patterns. Here's an example of a "good" choice of lug pattern:

                    Bar numbers
            00000000011111111112222222222
            12345678901234567890123456789
        P 1 X                              (1 active lug)
        o 0        XXXXXXXXXXXXXXXXXXXXXX  (inactive lugs)
        s 2  XX                            (2 active lugs)
        i 3    XXXX                        (4 active lugs)
        t 4        XXXXXXXX                (8 active lugs)
        i 5                XXXXXXX         (7 active lugs)
        o 0 XXXXXXX                        (inactive lugs)
        n 6                       XXXXXXX  (7 active lugs)

With no active pins on the pin wheels read, no - of course - lugs will be sensed and no bars will protude to displace the circular knob. With an active pin on wheel 1, one lug will be sensed and the corresponding bar (bar 01) will be displaced and act as a tooth, displacing the circular knob one step. An active pin on wheel 2 only, will result in two bars (02 & 03) being displaced. If the pins on both wheel 1 and 2 are active, three bars (01, 02, 03) will be displaced etc.

As can be seen from the number of active lugs chosen in the above pattern, all numbers between 0 and 25 can be formed by one or more wheel pin-patterns. The first four lug patterns are capable of forming all numbers from 0 to 15, since they are a series of power of two numbers (1, 2, 4, and 8). Lug patterns 5 and 6 will by them selves add a displacement of 7, thus pushing up the series 0..15 to 7..22; adding patterns 5 and 6 will push up the series to 14..29.
This means a displacement of 15 can be achieved by the following pin patterns being read:

        111100 (1+2+4+8 = 15)
        000110 (8+7     = 15) 
        000101 (8+7     = 15)
        100011 (1+7+7   = 15)

If wheels 3, 4, 5, and 6 all have active pins in the reading position, 26 bars will be displaced (wheel 3 has four lugs, wheel 4 has eight, wheel 5 & 6 seven each, 4+8+7+7=26), which will have the same effect as if no bars would have been displaced (turning the knob 26 steps will bring it around one whole revolution to the original starting position). A cryptanalyst knowing that a certain letter has been displaced zero steps, will be in the dark as to what pin pattern caused the displacement since both patterns 000000 and 001111 will give that effect.
Similary an observed displacement of 1 could have an underlying pin pattern leading to a displacement of 27 or 1; 2 could come from a pin pattern leading to a displacement of 28 or 2; and 3 resulting from 29 or 3 - this is the effect of having an increased number of bars in the cage.

Overlaps

When the two lugs on a bar are both placed in active positions, an overlap results. Here's an example of a lug pattern showing overlaps:

                    Bar numbers
            00000000011111111112222222222
            12345678901234567890123456789
        P 1 X                              (1 active lug, 1 overlap)
        o 0     XXXXXXXXXXXX XXXXXXXXXXXX  (inactive lugs)
        s 2 XXX                            (3 active lugs, 1 overlap)
        i 3   XX                           (2 active lugs, 2 overlaps)
        t 4    XXXXX                       (5 active lugs, 1 overlap)
        i 5         XXXXXXXXX              (9 active lugs, 1 overlap)
        o 0  X                             (inactive lugs)
        n 6                 XXXXXXXXXXXXX  (13 active lugs, 1 overlap)

Overlaps make cryptanalysis harder. For instance, when wheel 2 has got an active pin where wheel 3 hasn't, a displacement of 3 is added (to the other displacements, if any). If wheel 3 has got an active pin where wheel 2 hasn't, 2 is added. But if wheels 2 and 3 both have active pins, due to the overlap only 4 is added, not 5!
With the above lug pattern, an observed displacement of 3 can have several origins: pin patterns 110000, 010000, 010111. On the other hand a displacement of 9 can only be the effect of pin pattern 000010.

Output

Finally the cipher (or plaintext) letter is printed on a paper strip.
A knob may be set in position 'E' or 'D'. When set in position 'E' for 'encrypt' the text is output in five letter groups. When set in position 'D' for 'decrypt' the text is output normally, save for one rare letter (usually 'Z', but in some machines it is 'K' or 'W'; these two are rare in e.g. French and Italian, whereas 'Z' isn't) which will print as a blank. When encrypting, this otherwise rare letter can be substituted for space if desired, making the plaintext print with the word boundaries preserved when the cryptogram is decrypted at the receiving end.

Preparing the C-38 for cipher work

First, the inner key setting must be entered. As seen above this consists of the pin patterns on the six pin wheels, and the lug pattern of the cage.
Below is a sample key sheet giving such an inner key setting, used for training purposes by the Swedish Armed Forces in past times.
The headings say in English: Left lug in position: Bar number: Right hand lug in position: Pins in right hand position on wheels:

Note the ten five-letter groups at the bottom. These are used to check that the inner key has been entered correctly. When encrypting a series of A's with each of the pin wheels set to 'A', this string of 50 letters should result, or a mistake was made when the key was entered.

Once the inner key setting is done (this setting is usually in effect for 24 hours or more) an outer key setting is to be chosen for each message to be processed. This outer key setting consists of six letters chosen e.g. randomly by the operator or taken from a prepared list. The six pin wheels are aligned to these six letters against a benchmark.
If the circular knob is of the type which can be offset, a second part of the outer key setting may be this offset, in the form of one extra letter.

Now the circular knob is turned until it shows the first plaintext letter against a benchmark and a crank to the right side of the machine is pulled (in the Swedish version; the American version has a handle you turn). This steps the six pin wheels one step forward and then turns the cage. In some cases the lugs on the cage come in contact with an active pin, which will displace the bar holding those lugs to the left. As the cage turns, any such displaced bar will step the circular knob one step. When the crank reaches it's final level, a paper strip will press against a type wheel on the circular knob, thus printing the result.

The six (or seven) letters are now either left as they are (unwise), or - if crypto regulations says so - further processed, e.g. by encrypting them with the machine itself, before being appended to the message. If so, it is (or rather was) usual to have a daily outer key - kept secret - at which to set the machine for encryption/decryption of the real outer key setting.
If the outer key setting was instead taken from a prepared list, each setting could have e.g. a number, and this number would be appended to the final message to communicate to the receiver which outer key setting to use when decrypting.

C simulation of the C-38 to download

I have provided a working program (Windows/DOS) as well as the source code in C, which you can download here:
C simulation - C38.ZIP