It comes as no surprise that George Lasry found two very powerful hill climbing attacks on the M-209. He published them in a Cryptologia paper. He will present his results and new findings about M-209 cryptanalysis and related machines at the European Historical Ciphers Coloquium in Bratislava. With his new methods George solved all challenges from Wayne G. Barker’s book and 39 out of 40 of the challenges published by Jean-Francois Bouchaudy.


Unsolved: Bonus 22

The only M-209 challenges George hasn’t solved so far is Jean-Francois Bouchaudy’s Bonus challenge #22.


Bonus #22 is a series of messages, two of which are in depth (i.e. encrypted with same key settings). Find which messages are in depth is the first step to solve solve all the traffic.

Can a reader solve the Bonus #22 challenge? To do so requires some expertise in codebreaking. However, it is certainly possible. After all, 39 challenges of a similar kind have been solved before.

Further reading: New improvements in Enigma cryptanalysis


Subscribe to Blog via Email

Enter your email address to subscribe to this blog and receive notifications of new posts by email.

1 / 2

Kommentare (11)

  1. #1 George Lasry
    12. März 2017

    If anyone is interested, I will be happy to share the two papers. I strongly recommend to try the challenges on the site, not just the very tough bonus 22. There is a rich variety of difficulty levels, and of the methods that can be used. I found this site and the challenges a great way to learn about the M-209 and the Hagelins in general.

  2. #2 George Lasry
    12. März 2017

    From the security point of view, the M-209 is both weaker and stronger than the Enigma.
    1) Because of the additive nature, it is easy to solve messages in depth (unlike Enigma).
    2) But it is also stronger than Enigma in several ways:
    – If you know about 10-20 letters of plain text, you can find Enigma keys (with a Turing Bombe/Bombe simulator). With M-209, you would need at least 50-75 guessed or known letters.
    – There are today ciphertext-only methods to break Enigma messages, with less than 100 letters, and recently, with even much less (~30). For M-209 ciphertexts, you would need at least 500 to 2500 letters, depending on the method.

  3. #3 Norbert
    14. März 2017

    I am afraid, I cannot keep pace. Still fiddling around with the ADFGVX messages. But I have a question to George: Wasn’t the Schlüsselgerät 41 (SG-41) very similar to the Hagelin devices?
    If the Köhler messages are not encrypted by an Enigma variant, there is a certain probability that a SG-41 was used. Do you have statical methods at your disposal to determine if the Köhler messages were encrypted by a Hagelin-like machine with a fixed daily pin/lug setting (in depth)?

  4. #4 Norbert
    14. März 2017


  5. #5 George Lasry
    14. März 2017

    Norbert, Klaus

    Is there any documentation on the SG-41, other than the general descriptions I could find on the internet.

    In particular, was this an purely additive machine, in which case I could try to apply some statistical methods to detect whether the Kohler messages are in depth (great idea, Norbert, thx).


  6. #6 Norbert
    14. März 2017

    @George: Interesting pictures and an English transcript of a Klaus Schmeh article reagarding SG-41 at

    Anyway, in the full article of Klaus Schmeh a former Abwehr employee is quoted that they used the SG-41 very rarely.

  7. #7 Klaus Schmeh
    14. März 2017
  8. #8 George Lasry
    14. März 2017

    I also found this

    based on the story, it does not seem likely that those machines were used by the Abwehr or by agents.

  9. #9 Thomas
    14. März 2017


    In the NSA historic publication “German Cipher Machines of WWII” it sais in the chapter “Schlüsselgerät 41” (page 29): “About 1,000 machines had been constructed, and they were distributed to the Abwehr, which began using them in 1944.”

  10. #10 George Lasry
    14. März 2017

    Thanks for this very important information, Thomas. In this case this is worth a trial, to see if those messages might be in depth.

  11. #11 Rafael Pascual
    Problem 12 and Bonus 22 M-209 Challenge solved.
    21. August 2019

    Good morning,
    as you can see, it’s been a while since I also solved problem 12 and bonus 22 “The longest day” of the M-209 challenge of J.F. Bouchaudy
    I used my own method designed for this, which can resolve messages in encrypted text only of at least 580 characters