French Army C-36: The start of the war () ()

After Germany commenced the invasion of Poland, France and England (Poland allies) declared war on Germany on September 3, 1939. If we put aside the Norwegian campaign, however, each camp remains quietly behind its own defenses: France and England behind the Maginot Line and the Germans behind the Siegfried Line. During this "calm" period (the Phony War, the "drôle de guerre" in French), rearmament accelerates.

The German offensive began on May 10, 1940. After a succession of retreats by the British, French, and Belgian armies, the Germans conquered the north of France. Pétain's government accepted defeat on June 22 and signed an armistice with the Germans. The British Army, which took refuge near Dunkirk, managed to escape to return to England thanks to an improvised armada (Operation Dynamo).

At the start of World War II, the French Army was equipped with a multitude of encryption methods (Ribardeau-Dumas 1976, Bouchaudy 2019).

At the highest level (secretary of war, army and army corps), the B-211 machine reigned supreme.

At the level of the army, the manual diagonal transposition system SD23 [1] (derived from a system that already existed during the 1st World War) served as a replacement and back-up system for the B-211. There was also the superenciphered five-digit RA code.

At the level of the army corps and divisions, a superenciphered four-digit code was used. Version 69 was put into service on March 1, 1939 and replaced code 68. In the small echelons (battalions, regiments), the three-digit FC series code was used.

The SHD archives from the start of the war (1939 until April 1940) never mention the C-36. Conversely, the B-211 or other means of encryption are mentioned several times.

It is certain that the French Army at this time was equipped with the C-36. There was arguably not enough of them for operational use, and the existing ones were in reserve for later deployment.

Footnote:
[1] This system is also called System 1923 D; D for diagonal and 1923 because it was published in 1923. SD meaning “Sans Dictionaire” (Without Dictionary), i.e., it is a manual process that only requires paper and pencil.

Shortly before the Battle of France, the C-36 was put into service. A document from March 1940 specifies this upcoming entry into service (SHD-32N431 1940):

     IIIrd Army - Staff - 2e Bureau [1] - SECRET - QG [2], March 1940. 
     Memorandum
     I - By DM n ° 8.15.802 - CH/EMA dated March 13, 1940, the ministry 
     has decided to put into service:
     1) The C-36 type cipher machine (temporarily in the EM of CA, DI, 
     ID, and AD) [3].
     2) The JD series code for small unit use, which will replace the FC 
     series code currently in service.
     II - The delivery of these machines and codes to the various large 
     army units occupying a sector will be made directly to the 
     headquarters of each army corps by the Bureau du Chiffre of the 
     IIIrd Army.
     III - With regard to the large units in reserve of GQG [4] of army 
     corps or army, the distribution will take place, because of their 
     dispersion, at the Bureau du Chiffre of the IIIrd Army on Saturday 
     March 30, 1940; the addressees of the present note will be good 
     enough to take all necessary measures to send their cipher officer 
     or his replacement on the day indicated to take delivery of the 
     material in question. It is indicated that the weight of the 
     material to be transported does not exceed 20 kg [5].

     Army General CONDE, commanding the 3rd Army, PO [6] the Chief of 
     Staff.

     Addressees: The General Cdt[7] the 21e CA, the General Cdt the 
     6e ID, the General Cdt the 42e ID, the General Cdt the 6e DIC [8], 
     the General Cdt the 20e ID.

World War II has shown that the use of cipher machines represented real progress. Whenever a choice was possible, machines were always used. Accordingly, at Army Group 3 Headquarters, all (or most) of the messages were encrypted using the B-211.

From the end of May, the French Army finds itself in great difficulty. The Bureau du Chiffre fears the compromise of its high-level encryption methods, that is, the RA code and the B-211 machines [1],[2]. The General Staff even fears that the enemy could send false encrypted messages. The emergency system, the SD23, is then used as a replacement (SHD-GR28N51).

     Translation of an encrypted telegram that arrived at Army Group 
     No.3 on May 21, 1940.
     Sender: ANNIBAL [3] - For Bureau du Chiffre:
     ... Telegrams transmitted by radio to the GQG and presenting a 
     particular secret will be encrypted in the diagonal 1923 system 
     with the key "Commandant JOUBERT des OUCHES" and is 26 letters 
     long, ID register 18 or 92 [4]. 
     ... Make telegrams of a maximum of 40 groups. Acknowledge receipt 
     of this telegram in the agreed system.

    IIIrd Army - 2e Bureau - EM ... - Bureau du Chiffre - N°xxx [1]
    - PC [2], April 1, 1940
    General Chaulard provisionally commanding the 6th DIC to Mr. 
    Colonel Commander IDC/6.
    SENDING SLIP
    - The cipher machine type C-36 N ° 5634 to 35 ... 2 (copies).
    Each machine includes two n ° 601-1 mechanically cut keys, an 
    ink pads can, an oil can, a pair of tweezers and two spare paper 
    rolls (in addition to the roller in place).
    - A carrying strap .... 2 (copies).
    - The instructions for the use of the machine [3] - N° 13311 CH/EMA 
    of January 19, 1937 ... 2 (copies).
    - Secret notice N ° 5. 15169 CH/EMA of February 21, 1940 concerning
    the internal secret elements of the machine, the message key and 
    message drafting, copy N° 159 ... 1 (copy).
    - Instruction N ° 15470 CH / EMA of February 21, 1940 relating to 
    the commissioning of C-36 cipher machines. Copy N° 159 ... 1 (copy).

    The date of commissioning the type C-36 cipher machine will be 
    indicated later, as well as the positions to be given to the internal 
    secret elements of the machine. The C-36 machine will be the normal 
    process of encryption for the IDC/6 with the DIC and ADC. Code 69 and 
    the 1923 D transposition system should be considered back-up procedures.

    For its relations with the divisional engineering and infantry 
    regiments and artillery, which so far have no cipher machine, the IDC 
    will continue to use Code 69 as the normal encryption method.

    The attention of the officer in charge of the Bureau du Chiffre and 
    his replacement will be particularly drawn to instruction n ° 15470 
    CH/ ... on Chapter III of this instruction (retention of secrecy).

One of the documents specifies that the C-36 number encryption technique is described in a separate manual: Note 32344 CH/FP dated April 29 (SHD-32N431 1940). One would have thought that the encryption of numbers would simply be included in the instructions for use.

The following document corresponds to an inventory of C-36s in a division in June 1940 (SHD-32N431 1940):

     IInd Army - 2e Bureau - ... SECRET - PC, June 1, 1940 ...
     INVENTORY OF CIPHER MACHINES (Type C-36)
     Number 	Holders
     N° 5-632 	EM - DIC
     N° 5-633	d°
     N° 5-634 	IDC/6 (EM)
     N° 5-635 	d°
     N° 5-636 	ADC/6 (EM)
     N° 5-637 	d°

     All machines including 2 n ° 601 mechanically cut keys, 1 ink pad can,
     1 oil can, 1 pair of tweezers, and 2 spare paper tapes are in perfect 
     working order.
     Major General CARLES commanding the 6° DIC PO the Chief of Staff.

Footnotes:

• [1] The number is illegible.
• [2] PC: “Poste de commandement”: Command Post (CP).
• [3] The machine's manual could not be found in the SHD archives. If any readers have this document and chose to publish it, I would be extremely happy.
• [4] We recall that 30 machines were planned per division.

Before encrypting a message, the operator mainly modifies it to shorten it. This operation is called drafting (in French, “démarquage”).

The drafting of a C-36 message is described in a document of which the following is an excerpt (SHD-1P136 1942):

     Note on the use of abbreviations for establishing encryption using 
     the C.36 cipher machine - N ° S 2120 CH / FT - April 15, 1940 - 
     GQG – 2e Bureau – Bureau du Chiffre ...
     Some abbreviations should be known by heart:

     BTN Bataillon (Battalion)  PRA Praticable (Practicable)
     CAV Cavalerie (Cavalry)    RAS Rien à signaler (Nothing to signal)
     DIR Direction (Direction)  RCN Reconnaître (Recognize)
     ENI Ennemi (Enemy)	        REN Renseigner sur (Inquire about)
     ESC Escadron (Squadron)	RGT Régiment (Regiment)
     GAU Gauche (Left)          RIV Rivière (River)
     HEU Heure (Hour)           ROU Route (Route)
     KLM Kilomètre (Kilometer)  SIG Signaler (Report)
     MET Mètre (Meter)          SOR Sortie (Output)
     MIT Mitrailleuse           STA Station (Station)
         (Machine gun)          TEN Tenir (Resist)         
     NID Nid de résistance      TRL Transversale (Transversal)
         (Resistance nest)      ULT Ultérieurement (Subsequently)
     OFI Officier (Officer)     VIL Village (Village)	
     PAT Patrouille (Patrol)
     PEL Peloton  (Platoon)	
     ...
     It is also advisable to use the usual abbreviations, such as
     CIE Compagnie (Company)
     OCT Octobre (October)
     ST Saint (Saint) ...
     Example: 
     For the day of December 12, the cavalry corps requests a credit 
     for 10 hours movement on the AMIENS SAINT-JUST-LE-GRAND route.

     CORPS CAV DEMANDE POUR 12 DEC CREDIT MOV DIX HEU SUR ITI AMIENS 
     ST JUST LE GD

     CAUTION: "The desire to summarize must not, however lead to a 
     waste of time nor to composing incomprehensible texts" ...

     VII - A good working method will entail the instructions from 
     the beginning indicating the words and expressions used with 
     the machine C-36 in red pencil on the condensation notebook ... 

The SHD archives contain several key delivery slips. Here is an example (SHD-32N431 1940):

     IIIrd Army - General Staff – 2e Bureau - N° 96/2/CH - SECRET - QG, 
     April 20, 1940.

     The General of the Army CONDE, Commander of the IIIrd Army to the 
     General Commandant the 6° DIC (Staff 2 ° Office – Bureau du chiffre).

     SENDING SLIP

     1° / Table "A" N ° 97/2 CH dated April 18, 1940, relating to the 
     internal secret elements of the C-36 cipher machine valid in the area 
     of the IIIrd Army from April 22, 1940 at midnight …... 3 (copies)

     2° / Table "B" N ° 98/2 CH dated April 18, 1940, relating to the 
     starting key of the C-36 cipher machine valid in the area of the IIIrd 
     Army from April 22, 1940 at zero hour ...... 3 (copies)

     3° / Exercise telegram N ° 99/2 CH dated April 18, 1940 intended to 
     verify the keying of the cipher machine C-36 ...... 3 (copies)

     A duplicate of this slip is to be returned as a matter of urgency to the 
     Bureau du Chiffre of the IIIrd Army as an acknowledgment of receipt.

     Observations: Documents to be distributed to the owners of the C-36 
     cipher machine. It remains understood that these Tables A and B must 
     be used exclusively in the area of the IIIrd Army. The unit that holds 
     them must incinerate them when it passes into the zone of another army 
     or in the zone dependent on the GQG; in this case, new tables will be 
     given to it by the large unit to which it will report ...

In one of the ARCSI bulletins (ARCSI 1978), an extremely interesting document dated May 7, 1940 was uncovered. It was a letter from a cipher officer (his name does not appear) criticizing the indicator method used in 1940 for cipher machines. To conclude, the officer proposed a new method. However, in his review, he almost completely described the current method. Let us give the floor to this officer:

     ... You have received my suggestions in such a welcoming manner that I 
     take the liberty of submitting another to you. It concerns substitution 
     alphabets for machines. Currently, the columns are the same for the 
     alphabets of the B 211 and C 36. Only the column headings change. 
     Therefore, the key groups for the two machines correspond, that is, they 
     give a key possible for use with both machines (these two keys are also 
     different from each other).

     Now, in fact, it happens that the armies, sending a telegram circular to 
     the CA and DI who are dependent on them, use the C 36 machine for this 
     purpose. The CA cipher clerk receiving this telegram is therefore obliged 
     to
     1°/ take out the large machine documents
     2°/ take out its key
     3°/ put it on the machine
     4°/ try a few groups
     Then, faced with a failure, repeat the same process with the small 
     machine, thus, representing a waste of time, which seems unnecessary and 
     can easily be avoided.

     What were we looking for by endowing the two systems with similar 
     characteristics? To furnish the telegrams deriving from the two machines 
     with an identical appearance. But there is a danger. Due to the 
     multiplicity of telegrams and commissioning the small machine FOR ALL 
     armies, in the key groups, a letter from the first key group will have 
     three possible letters corresponding to the second group, which will 
     always be the same. Hence, if an enemy cryptanalyst is unable to 
     comprehend the letters chosen by the operator, he can, at least,
     - Recognize the location of the two key groups,
     - Reconstitute the replacement alphabets for all armies ...

From this letter, we can deduce a number of things. First, a B-211 or C-36 key is valid for a single army. Second, that only the CAs are equipped with B-211s but not the divisions. Third, that the C-36 equip the EM of armies, CAs, and divisions. We can also deduce that the indicator is made up of two groups (10 letters). The message key derives from a base group, which is a group of five letters that is encrypted the first time with a first substitution alphabet, which gives the first indicator group. The second group is only used for checking; it is the same group encrypted with a second substitution alphabet. As the base group is composed of only five letters, it corresponds directly to a C-36 message key but not to a B-211 key, whose key must indicate the position of the four wheels and the two half-rotors, that is, six letters unless one identical letter configures several wheels or half-rotor. The officer's description tells us that the situation is actually worse: Each letter of the group from which we deduce the key is associated with three letters in the substitution alphabet. Consequently, there are only 10 possible letters (26 ~ 3 x 10) for each letter of the key group. This greatly reduces the key space. For example, for the C-36 we can imagine that for a key table we have ABCDEKLMNO as the column head (i.e., the letters of the key group). A message key should only use these letters, for example, NDKLE.

Fortunately, in the archives of the SHD, an unexpected discovery occurred: A complete set of keys for the B-211 dated October 25, 1941, which included an example of packaging (SHD-1P136 1942). This example of a key made it possible to confirm the preceding deductions: There was indeed a basic group of five letters, which was encrypted twice by using a first substitution alphabet for the first indicator group and a second substitution alphabet for the second indicator group. The letters of the substitution alphabets were distributed in 10 columns of two or three letters. The letters ABCDEFGHIK (for the B-211) acted as column heads. The first and last letters of the base group corresponded to the (inverted) position of the two half-rotors. Finally, the last four letters of the basic group corresponded to the position of the four key wheels. Thus, the first letter has two uses: to position a key wheel and the second half-rotor. Remember that the position of the key wheels, which have between 17 and 23 sectors, is marked with a letter between A and Y (J and W being omitted) [1]. In conclusion, not all the possible message keys can be chosen. We also learned that the two indicator groups were the first two groups of the cryptogram.

These documents make it possible to completely reconstitute the indicator method used until June 1940, however, they did not state whether this method still applied to the C-36 after this period. Table 3 presents an example reconstructed from the authentic key table from October 1941.

For a message encrypted in B-211, suppose the message key is HDBACH (position of the half-rotors: HD; position of the four key wheels: BACH), the base group becomes DBACH, which is encrypted with the two substitute alphabets, and we obtain, for example, the following indicator: GAUOK JZAGR (or NFVBJ HUNCL … ). These two groups are added at the beginning of the cryptogram.

The letter from the young officer of May 1940 specifies that the column heads are different in the case of the C-36. Suppose the heads are ABCDEKLMNO for the C-36 for a specific key table. The NDKLE message key becomes (with the same alphabets) SGZLQ MHTEX (or XNHIM ZJDKP … ). As in the case of the B-211, this method of masking the message key does not allow the use of any key for the C-36 because there are only 10 column heads. In the preceding example, the key FPQGQ cannot be used.

Table 3: Example of two substitution alphabets used with the 1940 indicator system

     -------------------------------
     : A: B: C: D: E: F: G: H: I: K: column heads B-211
     : -: -: -: -: -: -: -: -: -: -:
     : A: B: C: D: E: K: L: M: N: O: column heads C-36
     : -: -: -: -: -: -: -: -: -: -
     : U: A: O: G: Q: C: L: K: R: W:
     : V: F: B: N: D: H: I: J: S: T: 1st substitution alphabet
     :  : P:  : E: M: Z:  : Y: X:  :
     : -: -: -: -: -: -: -: -: -: -:
     : A: Z: G: J: X: T: E: R: P: Q:
     : N: U: C: H: P: D: K: L: M: O: 2nd substitution alphabet
     : Y: V: I:  : F: S:  : W: Z:  :
     -------------------------------

Footnote:
[1] In fact, the reality is more complex given that the key implied the position of four rotors because it entailed a modified B-211.

Frequently, there are memos about security. For example, the note of May 15, 1940 from the Bureau du Chiffre of the 6th DIC (SHD-32N431 1940):

     May 15, 1940 - Security note - ... In particular with regard to C36 
     machines, information concerning the packaging, and a fortiori, 
     relating to the making of the keys, should never be placed in the 
     cover of the devices.

Another document (SHD-GR28N51 1940) reminds the cipher clerk never to part with their C.36:

     Army Group N ° 3 - General Staff – 2e Bureau – Bureau du Chiffre 
     - Translation of a ciphered telegram received at GR/3 on May 28, 1940 
     at 4:40 p.m. - Sender: ARCOLE ... 
     For the cipher officer: Subject: Security. It was reported that in 
     some large units C.36 machines had been lost as a result of devices 
     being left during transport in baggage vans. This way of doing things 
     is absolutely to be avoided. C.36 machines are fitted with straps 
     allowing users to carry them on the shoulder strap. In any case, 
     their owners must not part with them. Telegram sent to interested 
     Army and Army Groups.

     C.36 Cryptographs will be repaired:
     - In the first degree through the care of their holders.
     - In the second degree by the care of General Cdt of the Tunisian Fronts.
     Subsequent instructions will fix the authorized first degree repairs. 
     In order to constitute a repair workshop in the first degree, the 
     commanders of large units as owners of the C.36 machines to whom this 
     note is addressed will each designate a qualified non-commissioned 
     officer or master corporal, radio precision mechanic, or watchmaker 
     preferably. The officers in question will be instructed during an 
     internship at the secondary level workshop …

A typed message (SHD-GR28N51 1940) dated late May 1940 certainly contained a message encrypted in C-36. Indeed, the decryption tape was glued to the back of the message and contained numbers coded in letters.

     Message N° 238/I. Sender: ARLESIENNE. Addressee: Army group n° 3, 
     1st Bureau. May 31, 1940, 3.35 p.m.
     Repetition of telegram no.30-21. Losses of May 29: Officers: 3, 
     Men: 146. Information concerning only CANADIANS, DAPHNIS, DAVOUST, 
     and FALCONNET.

     REPEAT k DU k WQH k JO k PER k WFW k MAI k OFI k WE kk HOM k WGRN k 
     REN k CONCERNING k ONLY k CANADIAN k DAPHNISLDAVOUT k FALCONET k NO 
     k WPQZ k SUR WO k

Remarks:

• The letter "k" was used to highlight spaces.
• The code name ARLESIENNE corresponds (cf. previous paragraphs) to the 10th Army.
• The code names CANADIAN, DAPHNIS, DAVOUT, and FALCONET correspond respectively to the 13th Metropolitan Infantry Division, the 5th Colonial Division, the 7th Colonial Division, and the 2nd Light Cavalry Division (DLC).
• The numbers are easily decipherable if we accept a slide of 23: WQH JO = 30 21, WFW = 83, WE = 8, WGRN = 740, WPQZ on WO = 236/1
• The shape of the characters corresponds to the C-36.

Several TICOM documents point to the failure of the German cryptanalysts. A priori no message encrypted by the C-36 was decrypted by them during this period. Several elements explain this failure. First, the late entry of the machine into service. Then, the almost exclusive use of wire telegraphy in the period preceding the German breakthrough. Finally, the brevity of the campaign starting in May 1940: German cryptanalysts did not have time to develop methods for attacks following the capture of machines or secret documents.