All rights reserved

3. Attacks On SIGABA

3.1 Previous Work

There have been two previous attempts to attack SIGABA. The first attempt is described in 

[4]. In this attack, John J. G. Savard and Richard S. Pekelney describe an attack that 

requires no known plaintext. Their attack relies only on intercepted ciphertext messages 

and does not rely on knowing the plaintext beforehand. For their attack, the plaintext is 

recovered using Kerchoffs superimposition, which is described in [10].  The attack attempts 

to reconstruct nearly complete cipher alphabets produced by the cipher rotors. By looking 

at the different alphabets that are reconstructed, they can find cases of rotor steppings. Once 

the wirings of the cipher rotors are reconstructed, they have the stepping motions of the 

cipher rotors, which they mention can be used to attack the control rotors. This attack 

requires a large amount of intercepted messages. The authors estimate that ten to fifteen 

messages sent during the same day using the same key would be needed. This is highly 

improbable. In their description, there was no mention of the expected work factor for this 

attack.

The other attack on SIGABA is from Michael Lee [10]. In Lee’s attack, he first examines 

attacking simpler versions of SIGABA that only have one, two, and three cipher rotors. The 

attack on a single rotor version of SIGABA recovered the rotor wiring. In the attack on the 

two and three rotor versions of SIGABA, he assumes that the wiring of the rotors is known. 

The attack will recover the plaintext, the order of the rotors, and their initial positions. No 

attacks are described for a four or five rotor SIGABA machine, though the estimated time 

needed for attacking a four or five rotor machine using the attack on a three rotor machine 

are extrapolated.