Lorenz Cipher

A classical, poly-alphabetic, stream cipher that uses linear feedback shift registers. Encrypts a Baudot-coded plaintext bit stream into 5 ciphertext bit streams. Each bit is masked by a fresh keystream bit, so ciphertext symbol frequencies are flattened.

Implemented by the Lorenz machine, an electromechanical inline cipher attachment built by C. Lorenz AG for the German Army high command in World War 2. It sat between a teleprinter and the transmission line, enciphering each character as it was typed and deciphering at the far end. The Allies called the machine and its traffic Tunny.

Baudot Code

A fixed-width (5 bits) character encoding, invented by Émile Baudot in 1870 for printing telegraphs.

Fixed width is the key property. The receiver slices the bit stream every 5 bits to find character boundaries, unlike the variable-length symbols of Morse code. This is why the Lorenz machine treats plaintext as a clean stream of 5-bit units.

A 5-bit code spans only $2^5 = 32$ symbols, too few for letters, digits, punctuation, and control codes. 2 of the 32 codes are mode switches rather than characters.

• Letters shift
  Following codes are read as letters.
• Figures shift
  Following codes are read as digits and symbols.

The machine holds the current mode. The same 5-bit pattern means different characters in the 2 modes, so the effective alphabet is about 60 symbols.

Encryption

Each 5-bit Baudot code is XOR-ed with a 5-bit random sequence, generated by 12 pin wheels in 3 groups:

• 5 $\chi$ registers, lengths 41, 31, 29, 26, 23.
• 5 $\psi$ registers, lengths 43, 47, 51, 53, 59.
• 2 $\mu$ registers, lengths 61, 37.

Pin Wheels

Each wheel has 1 pin per position around its length. Each pin is fixed to $0$ or $1$. At each tick a wheel outputs the bit at its current position, then advances by 1 position, wrapping at its length.

$\chi_i$ pairs with $\psi_i$ for each of the 5 Baudot bit positions, giving 5 parallel lanes.

$\chi$ wheels advance every tick, unconditionally. $\psi$ wheels advance only when gated by the $\mu$ wheels, so their motion is irregular. This is the same clock-control design choice used to disrupt fixed sequence alignment.

At each clock tick $t$:

• $K = (\chi_i \oplus \psi_i)$ for $i = 1, \dots, 5$.
• $t \leftarrow t + 1$, and the $\chi$ registers advance.
• $\mu^{(1)}$ advances every tick, and conditionally triggers $\mu^{(2)}$ to advance.
• $\mu^{(2)}$ conditionally triggers the $\psi$ registers to advance.
• Output $K$.

Key Space

Each wheel pin is independently set to $0$ or $1$. The 12 wheel patterns therefore give:

Register settings can be rotated on different schedules to behave like session keys, e.g. $\mu$ registers changed daily, $\chi$ registers monthly, $\psi$ registers quarterly.

Decryption

The receiver starts the 12 registers from the shared settings and runs the same clocking, producing the identical keystream $K$. XOR is its own inverse, so XOR-ing each 5-bit ciphertext code with $K$ returns the plaintext code.

Attacking

The keystream is fully determined once the register settings are fixed, so 2 messages sent in depth, under the same settings, break the cipher.

• XOR the 2 ciphertexts. The keystream cancels, leaving $P_1 \oplus P_2$, the XOR of the 2 plaintexts.
• Slide known language fragments against $P_1 \oplus P_2$ to separate the 2 plaintexts, then XOR either plaintext with its ciphertext to recover the keystream.
• Statistical tests on the ciphertext bits can expose the $\chi$ wheel lengths and starting positions without a depth, because the stalled $\psi$ wheels leave $\chi$ structure in the keystream.

Worked Example

One Baudot character A, code $11000$, with keystream bits $01101$ for this tick.