Enigma — Volume 5 — The Combinatorics: Why They Thought It Unbreakable

About This Volume

The two volumes before this one took the Enigma apart. We followed a single keystroke through the entry plate, out across three spinning rotors, into the reflector, back through the rotors by a different path, and home to a glowing lamp — and we watched the odometer of wheels step forward so that the next letter would be enciphered by a different machine entirely. We have, in other words, the mechanism. This volume asks the question the mechanism invites: how many distinct ways can the machine be set?

The answer is a genuinely colossal number, and the Germans knew it. It is the number that sat behind their confidence — the arithmetic that let signals officers and U-boat commanders believe, with real sincerity, that no enemy could ever read their traffic. The number is correct. Their confidence was not. This volume is about the gap between those two facts: how a key space of roughly 159 quintillion could be both perfectly real and almost entirely beside the point.

We will first count the space, carefully, showing every multiplication so you can check the arithmetic yourself. Then we will put the result into human perspective, because a number with twenty digits means nothing until you stand it next to something. And then comes the twist that the rest of this series — the volumes on the breaks at Bletchley Park — will spend its time proving: Enigma was not broken by searching this space. It was broken by going around it. That distinction is the most important single lesson the machine has to teach, and it sets up everything that follows.

What We Are Counting

A “setting” — what cryptographers call a key — is the complete list of choices an operator makes before sending a message, following that day’s printed sheet. For the standard three-rotor Wehrmacht Enigma (the Enigma I), the army and air force machine of the late 1930s and the war years, there are four such choices, and we will count each in turn:

1. Which three rotors, in which order (the Walzenlage), chosen from a box of five.
2. The starting position of each rotor (the Grundstellung) — the three letters showing in the windows.
3. The ring setting of each rotor (the Ringstellung) — where the lettered ring sits relative to the internal wiring.
4. The plugboard (the Steckerverbindungen) — which pairs of letters are cross-wired on the front panel.

Multiply the four together and you have the total. The interesting part — the part that foreshadows the whole story of the breaks — is that one of these four turns out to be slipperier to count than it looks, and another one utterly dominates the rest. Let us take them one at a time.

Counting the Rotors: 60 Orders

The operator is issued a set of five rotors, conventionally numbered with Roman numerals I through V, each carrying a different internal scramble of wiring. Three of them go into the machine, left to right, and order matters — putting rotor II in the fast (right-hand) slot produces a completely different cipher from putting it in the slow (left-hand) slot.

So this is a count of ordered selections of 3 from 5:

• 5 choices for the left-hand rotor,
• 4 remaining choices for the middle rotor,
• 3 remaining choices for the right-hand rotor.

$$5 \times 4 \times 3 = 60$$

Sixty possible rotor orders. A small number, and that smallness matters: as later volumes show, sixty is few enough that the codebreakers could, in effect, try them all. (The naval Enigma later widened the box to eight rotors, lifting this term to $8 \times 7 \times 6 = 336$ — still a small, searchable number. That is a Volume 6 story.)

Counting the Starting Positions: 17,576

Each rotor can be turned to any of 26 starting positions before the first key is pressed — the three letters the operator dials into the windows. The three rotors are independent, so the positions multiply:

$$26 \times 26 \times 26 = 26^{3} = 17{,}576$$

Seventeen thousand five hundred and seventy-six starting configurations. Note that this is the term that changes most often in practice: the rotor order and plugboard were typically fixed for a whole day by the key sheet, but a fresh starting position was chosen for each individual message. Hold that thought — it is exactly the habit that the German indicator procedure abused, and that Bletchley exploited (Volume 7).

Counting the Ring Settings: 676, Not 17,576 — and Why It’s Subtle

Now the slippery one. The ring setting rotates the lettered alphabet ring relative to the rotor’s internal wiring core, and it also fixes the position of the notch that triggers the next rotor’s turnover. Naively you would say: three rotors, 26 positions each, another factor of $26^{3} = 17{,}576$. That is wrong, in two separate and instructive ways.

First wrongness — the leftmost ring does nothing. The notch on a rotor exists only to kick the rotor to its left forward by one step. The right-hand rotor’s notch steps the middle rotor; the middle rotor’s notch steps the left-hand rotor. But the left-hand rotor has nothing to its left to step. Its notch fires into empty space. Since the ring setting’s only job beyond rotating the alphabet is to position that notch, the ring setting of the leftmost rotor has no cryptographic effect whatsoever. Only two ring settings genuinely matter:

$$26 \times 26 = 26^{2} = 676$$

Second wrongness — even those 676 mostly overlap with the starting positions. Here is the part that earns this volume its title. Turning the ring and turning the whole rotor do nearly the same thing — both rotate the wiring relative to where the current enters. For the encryption of any given letter, a particular ring setting paired with a particular window letter is cryptographically identical to some other ring/window pair that the starting-position count already includes. The two controls are largely redundant. The ring setting earns genuinely new keys only through the one thing the starting position cannot mimic: it shifts when the rotors step over, by moving the notch relative to the visible letter.

This is why the famous headline figure for Enigma — the one we are building toward — conventionally folds the ring settings out rather than blindly multiplying by 676. Multiplying by 676 anyway would count the same machine behaviour hundreds of times over. The honest grand total counts rotor order, starting position, and plugboard, and treats the ring as a complication of timing rather than an independent dial. We will state the figure both ways so nothing is hidden.

Counting the Plugboard: 150,738,274,937,250

And now the giant. The plugboard (Steckerbrett) on the front of the machine lets the operator connect pairs of letters with patch cables; a cable between, say, A and J swaps those two letters both on the way into the rotors and on the way out. The Wehrmacht standard was ten cables, connecting twenty of the twenty-six letters and leaving six unplugged.

How many ways can ten cables be placed? This is the most demanding count of the four, so we will build the formula in words first, then write it down.

Start with all 26 letters. We need to choose which 20 of them get plugged — equivalently, which 6 are left alone — and then pair up the chosen 20 into ten cables. The cleanest way to count it:

• There are $26!$ ways to arrange all 26 letters in a row.
• The 6 unplugged letters can be arranged among themselves in $6!$ ways without changing which letters are unplugged — so we divide by $6!$.
• The 10 cables can be listed in any order ($10!$ orderings) without changing the actual wiring — so we divide by $10!$.
• Within each cable, the two ends are interchangeable (a cable A–J is the same as J–A): that is a factor of $2$ per cable, $2^{10}$ across ten cables — so we divide by $2^{10}$.

Putting the four pieces together:

$$\frac{26!}{6! \times 10! \times 2^{10}} = 150{,}738{,}274{,}937{,}250$$

About 150.7 trillion ways to wire the plugboard — from a panel of ten humble patch cables. This single term is more than two hundred thousand times larger than the other three multiplied together. The plugboard dominates the key space, and it does so by design: it was the cheap, retrofittable addition that took a commercial cipher machine and made it, the Germans believed, a fortress.

A curiosity worth noting: ten cables is not even the maximum. The plugboard count peaks at eleven cables (leaving four letters unplugged) and then declines, because past the peak you are increasingly constrained by how few free letters remain. Ten was chosen as good practice, not as the theoretical optimum — but ten is the historical standard, and ten is what gives the canonical number.

Multiplying It All Out: 158,962,555,217,826,360,000

Now we assemble the headline figure. We multiply the rotor order, the starting positions, and the plugboard — the three terms that contribute independent, non-redundant key material:

Factor	Count
Rotor order (3 of 5)	60
Starting positions ($26^3$)	17,576
Plugboard (10 cables)	150,738,274,937,250

Step by step:

$$60 \times 17{,}576 = 1{,}054{,}560$$

$$1{,}054{,}560 \times 150{,}738{,}274{,}937{,}250 = 158{,}962{,}555{,}217{,}826{,}360{,}000$$

That is the canonical number, reproduced in countless references and in the U.S. National Security Agency’s own monograph on the cryptographic mathematics of Enigma:

$$\boxed{158{,}962{,}555{,}217{,}826{,}360{,}000 \approx 1.59 \times 10^{20}}$$

About 159 quintillion settings — or, in the language of modern cryptography, a key of roughly 67 bits ($\log_2$ of the total is just under 67).

Where did the ring settings go? As we said, the headline figure folds them out as largely redundant. If you nonetheless insist on treating the two effective ring settings as a fully independent dial and multiply by $26^2 = 676$, the count balloons to roughly $1.07 \times 10^{23}$ — but that number double-counts machine states that behave identically, which is why serious sources quote the 159-quintillion figure instead. Either way, the headline does not change in spirit, and one observation survives untouched: strip out the plugboard and the rest collapses to about a billion ($60 \times 17{,}576 \times 676 \approx 7.1 \times 10^{8}$). The plugboard is carrying essentially the entire weight of the number. Remember that — it will matter enormously when we reach the breaks.

Standing Next to 10²⁰

Twenty-digit numbers do not register as quantities; they register as a blur of zeros. To feel why the Germans were confident, you have to put $1.59 \times 10^{20}$ beside something physical.

• Seconds since the Big Bang. The universe is about 13.8 billion years old, which is roughly $4.3 \times 10^{17}$ seconds. The Enigma key space is about 370 times larger than the number of seconds that have elapsed in the entire history of the universe. If you had started checking one key per second at the birth of time, you would today be less than a third of one percent of the way through.

• Grains of sand. A widely cited estimate puts the number of sand grains on all the beaches and deserts of Earth at around $7.5 \times 10^{18}$. The Enigma key space is about twenty times that — more keys than there are grains of sand on the planet.

• Brute force, at impossible speed. Suppose you had a machine that could test a billion keys every second — wildly beyond anything that existed in 1940. Dividing, $1.59 \times 10^{20} / 10^{9} = 1.59 \times 10^{11}$ seconds, which is about 5,000 years. Even a modern processor at a trillion trials per second would chew on the full space for roughly five years. With 1940s electromechanical technology, an exhaustive search was not merely impractical; it was not on the same continent as practical.

So the confidence was not stupid. By the only measure the Germans were looking at — the raw size of the haystack — Enigma was, in fact, unsearchable. Their mistake was believing that the size of the haystack was the only measure that mattered.

The Twist: The Number Was Real, and It Was the Wrong Thing to Trust

Here is the pivot on which this entire series turns. Bletchley Park never searched the 159-quintillion space. Not once. They did not build a machine to grind through quintillions of keys, and they did not need to. They broke Enigma by attacking everything except the raw key count — by finding the places where the real-world system leaked structure the abstract number ignored. Five such leaks, each developed in its own later volume:

• Procedural weakness — the doubled indicator. To tell the receiver which starting position he had chosen, the sender enciphered those three letters twice at the head of the message. That repetition imposed a hidden relationship across the six enciphered letters, and Polish mathematicians — Marian Rejewski above all — turned it into an equation that cracked open the rotor wiring and the daily settings. The plugboard’s 150 trillion combinations were irrelevant to that attack, because the doubled indicator betrayed the rotors directly. (Volume 7.)

• Cribs — guessable plaintext. German messages were stuffed with predictable text: weather reports in fixed formats, the word WETTER, ranks and salutations, the nightly Heil Hitler, and U-boat position reports. If you can guess a stretch of plaintext, you no longer face $10^{20}$ blind possibilities — you have a known input/output pair to test settings against. (Volume 10.)

• No letter enciphers to itself. The reflector that made Enigma self-reciprocal also guaranteed that no letter is ever encrypted as itself. This single property let a codebreaker slide a guessed crib along the ciphertext and instantly reject every position where a letter lined up with itself — eliminating the vast majority of placements before any real work began. It is a gift the abstract key count cannot see, because it is a property of the machine’s structure, not of its settings. (Volume 10.)

• Operator habits — the “cillies.” Tired, hurried, undisciplined operators chose message keys that were anything but random: the letters Q-W-E-R-T from the keyboard, a girlfriend’s initials, the same setting twice in a row, A-A-A. Bletchley named these predictable choices cillies (after a recurring “CIL”), and each one shrank the haystack from quintillions to a shortlist a human could check. (Volume 13 develops operator failures.)

• Captured material. Key sheets, bigram tables, and intact machines pulled from sinking U-boats and seized weather ships handed the codebreakers the answer directly, and — just as importantly — let them confirm and bootstrap their analytic methods. A captured key sheet renders the entire $10^{20}$ moot for as long as it is valid. (Volume 11.)

Notice the common thread. Every one of these attacks routes around the key space rather than through it. The plugboard’s 150 trillion settings — the term that dominates the whole count — was reduced to a sideshow: the Turing–Welchman Bombe was specifically engineered to make deductions that hold regardless of the plugboard wiring, peeling the dominant term off the problem entirely. The Germans had built their confidence on the one factor their enemy had learned to ignore.

Kerckhoffs’s Principle, Violated in Spirit

In 1883 the Dutch cryptographer Auguste Kerckhoffs laid down the principle that still governs the field: a cryptographic system must remain secure even if everything about it except the key is public knowledge. Security lives in the secrecy of the key, never in the secrecy of the machine. Assume your adversary has the blueprints, owns a working copy, and knows your procedures down to the last detail — and design so that it does not matter.

The Germans got the letter of this right and the spirit of it catastrophically wrong. The Enigma machine itself was no great secret — commercial versions had been sold openly in the 1920s, and copies fell into Allied and Polish hands repeatedly. What was supposed to be secret was the daily key. So far, so Kerckhoffs. But the Germans then leaned their entire faith on the complexity of the machine — that intoxicating $10^{20}$ — and let their operational discipline rot: doubled indicators, predictable message keys, stereotyped message texts, key sheets that could be captured, procedures that survived unchanged long enough to be reverse-engineered. They trusted the size of the key space to forgive every sin of usage. It would not. A system is only as strong as the discipline of the people turning its dials, and the dials were being turned by exhausted men at three in the morning who reached for Q-W-E-R-T. (Volume 13 returns to Kerckhoffs in full.)

The Takeaway: Necessary, Not Sufficient

A large key space is necessary. A cipher with only a thousand possible settings can be searched on a coffee break, and no amount of operational discipline will save it. Enigma needed its quintillions, and on that count it delivered.

But a large key space is not sufficient, and this is the durable lesson — as true for a modern protocol as for a 1940s rotor machine. Real attackers do not march dutifully through the front door of your key space counting to $10^{20}$. They look for the doubled indicator, the guessable crib, the structural property that eliminates half the candidates for free, the tired operator, the captured sheet. They go around the number. The Germans counted to 159 quintillion, found it unimaginably large, and concluded that they were safe. They had counted correctly and concluded wrongly — and the volumes that follow are the long, brilliant, human story of exactly how wrongly.

Next — Volume 6: The Military Enigmas.