All rights reserved

Table 12: Cipher Rotor Steppings

29

---

An interesting thing to notice about the results from Table 12 is that the range of the values 

is small and only overlap when 2 and 4 rotors step. The ranges for 1 and 3 rotors stepping 

do not overlap. Consequently, this means that we assign a score to each survivor of Phase 1 

without making any assumptions about the index permutation. For each survivor, we 

compute a score based on the number of cipher rotors that stepped for each known plaintext 

letter. Then, in the secondary phase, we can test the highest scoring survivor, then the 

second highest, and so on. This method would trim away unlikely paths in Phase 1, 

reducing the number of survivors that are sent to Phase 2. The merging of paths in Phase 1 

creates a slight complication since different number of rotors can be stepped to reach the 

merge position. A solution to this would be to take the maximum probability of the paths 

that merge. 

Assuming we have sufficient known plaintext, we have shown that the work factor for the 

secondary phase for each survivor of Phase 1 is around 2

43

. This amount of work is feasible 

for today’s technology, although the actual attack is not trivial to implement. The primary 

phase has a similar work factor and is feasible for today’s technology. However, in the 

attack described here, the number of survivors from Phase 1 is large, which makes cost of 

the attack quite high.