Cyberchef: Bug report: Typex simulator incorrect operation

[Cegroeg]

Summary

• Version: 8.31.4
• Compile time: 21/05/2019 16:00:32 UTC
• User-Agent:
  Mozilla/5.0 (Windows NT 6.1; rv:67.0) Gecko/20100101 Firefox/67.0
• Link to reproduce

There appears to be a problem with the output produced by the Typex simulator.
Using the attached settings the output should be determined only by the reflector values, as all the rotors are mapped 1 to 1, but in fact they are shifted 1 character to the right with lowercase input, and it produces 2 characters on the output with the uppercase input of V,X & Z- clearly not correct!
These same settings on the Enigma simulator produce the correct output.

Example

Input "a" produces "z", when it should be "b". ( As per the reflector mapping)
Input "V" produces "AB" when it should be "U", "X" produces "AF" & Z produces "AE".

[VirtualColossus]

I believe that the TypeX simulator is working correctly!

Firstly, the input & output heads are not wired directly. According to the NARA docs I have, the input head is wired from the keyboard direct a-A, b-B etc. But, the reflector head is wired in reverse, a-A, b-Z, c-Y, d-X, e-W ... z-B. This means the Z character being enciphered stays as Z through the input head, doesn't change in the rotors as your rotors are all wired direct but then comes out through the reflector head to the B connector. The B on your reflector wiring connects to A which goes back through the reflector head, rotors and input head with no change to end up as A.

Your second point ( with 2 chars ) is because the simulator is not just accepting a Z key being pressed but is being clever with your input and automatically adding the extra figure shift required to encode a Z character on Typex. The instructions clearly state that the Z key is used for the fig-shift function with the actual typed Z character above the D key. Imagine if you entered 123 in the input box. There are no physical 1,2 or 3 keys but CyberChef would type the fig shift for you(Z), then enter QWE to be enciphered (neat huh!)

So when you encipher Z, it's assuming you mean fig-shift(Z key) + D. With the first instruction above, the second character D goes like this. D->D (input head & rotors)->X (reflector head)->W (reflector wiring)->E (input head) giving the output AE.

All looks like it's working correctly. Hope that makes some sense!

Feel free to correct me GCHQ if this isn't quite right, but all seems to work out with what I've learned (I'm currently researching to write a TypeX simulator of my own)

... phew, lecture over!

[Cegroeg]

I have been researching TypeX for some time now, and have never seen any mention of reverse wiring between the left rotor and the reflector ( assuming this is what you mean by "reflector head" ). Where did you get this information, and is it publicly available?
I have written a TypeX simulator in C assuming all wiring except the rotors and reflector to be straight through, and the output agrees with a paper version of TypeX, but not with the CyberChef version, which is why I am querying its operation.

As for the second point, there is a difference in output between using uppercase and lowercase characters for the input - surely not correct, as TypeX does not differentiate between uppercase and lowercase.

[VirtualColossus]

The information I have is from NARA docs on 'Investigation of R5W Enigma' (TypeX) - this does seem to match up with the workings of CyberChef which says in src code that wiring is reversed with respect to Enigma.
For 2nd point, my apologies, didn't fully read your entry correctly, you are quite correct - the lower case input does not give the same output, looks like the input of the crypt function in Encrypt mode could do with being forced to uppercase.
May I ask where you got the paper TypeX?

[Cegroeg]

I made the paper TypeX myself. It consists of strips of paper with the characters A-Z down each side, and wiring penciled in. ( Do you have any information on the real rotor wiring? ).

I still can't find any mention of reversed reflector wiring, and cannot even see how it is physically possible to put anything between the left rotor and the reflector, as they appear to be in direct contact with each other in all the photos I have seen. Do you have access to a real TypeX machine to confirm this?

Would it be possible for you to send me a copy of the NARA document you have, or at least an extract of the relevant part, please?

[VirtualColossus]

Like the paper Enigma, nice? I'm not sure, but I think that the actual rotor wiring is currently still covered by official secrets act, & so not currently available.
It's not between the rotor & reflector, rather how you specify which connector on the reflector is which letter. Actually, looking at the diagram again, I think it's actually the entry head that's reversed (with respect to the letters on the rotors). If you look at a picture of TypeX and assume the top pin of the reflector/entry is A, you can either choose the clockwise direction to be A, B, C, D .. Z or the reverse, anti clockwise which means the pins would be connected (thru the rotors) to the pins A, Z, Y, X .. B on the other side.
Are you on Twitter? If you find me @virtualcolossus and pm me, I'll try and scan a few pages for you. Save having long conversation on this thread!
If you are interested, this is a short video of my sim so far - https://youtu.be/1vIJLgYsAmc

[Cegroeg]

Yes, similar to the paper Enigma.
I'm not on Twitter, and don't really want to be, but can you please scan and send it as an attachment to [email protected]?
I've looked at the source code of CyberChef TypeX and yes, it states that the INPUT wiring from the keyboard is reversed, not the reflector. I didn't know that! so my C++Simulator is probably incorrect (and much simpler than yours - nice graphics!)

[s2224834]

Apologies for not picking up this issue earlier. Thanks for the input @VirtualColossus (also sorry I haven't reviewed your PR yet...).

On multiple characters being produced - yes, this is a consequence of emulating the Typex keyboard functionality for digits and special characters. This is discussed in the documentation, but the simple answer is to set the "Typex keyboard emulation" operation option to None, which drops all handling of special characters and behaves as per the Enigma keyboard.

You're correct that there's apparently a bug in the handling here with lowercase input though; I'll get that fixed.

Real Typex rotors are classified and won't be released, sorry.

On the reversed inputs: yes, this is a question of how the connections between the keys/outputs and the rotors work. Specifically, the difference is in how the plugboard is connected to the input points to the right-hand rotor. There's no inherent concept of "letters" in the mechanics of the rotors, they're just a set of electrical connections to which we apply letters as a convention. On military Enigma the rotor input points are in alphabetical order and a particular handedness, and it makes sense for the conventions for specifying rotor wirings and so on to follow that order. (Digression: If I remember correctly, early commercial Enigmas had them connected in keyboard order instead and the difference on the military version was guessed by Polish cryptanalysts.) On Typex, they're still in alphabetical order, but they're the opposite handedness to Enigma. Typex's rotors still spin in the same direction as Enigma's, so it makes sense to continue to specify Typex rotors in the same way as Enigma's to keep the mechanics consistent between the two and make, for example, configuring Typex to mimic Enigma easier. The result is that it behaves as though there was an additional transformation applied to the plugboard which reverses the letter orders. I don't know if there's a public source for this, but ours comes from analysis of a physical Typex. I believe that Chef's implementation is correct here (although it's hard to be 100% sure as I can't use real rotors!).

[VirtualColossus]

Thanks for the reply & clear up. I wonder if I'm able to ask a question? For the Enigma variant of the Typex 22 used at BP, do you know how it was adjusted to run as an Enigma other than the obv. Enigma rotors as it occurs to me that there are a couple of issues?

As the input head wiring is reversed, did they rewire it, alter the cabling in the ext. plugboard or maybe adjust the rotors to compensate? I assume your TypeX is a standard model 22, is there a model 22 around that is left in Enigma mode that it would be possible to check? (Maybe at BP).

Secondly, when deciphering an Enigma message, any chars Z, X & V in deciphered message would be translated by printer as fig, or or spacers. Did they rewire to bypass these functions on 22 Enigma or I guess they could have just used the manual fig shift override to reset and written in the letter by hand. Sorry for long question, I'd love to know the answer and can't find it anywhere on internet.

[s2224834]

The correction for the input wiring was applied by rewiring the plugboard.

I don't know for sure what was done about the special character handling on the keyboard. My _guess_ would be that the machine was simply set into encipher rather than decipher mode - this would make the deciphered output on the printer correct. (It might mangle the input copy on the other printer - I'm not sure how exactly this was handled.)