From ed7ab8b92789111139fb98d23a9bf2249311b6a7 Mon Sep 17 00:00:00 2001
From: n1474335 <n1474335@gmail.com>
Date: Thu, 14 Mar 2019 12:01:55 +0000
Subject: [PATCH] Created Enigma, the Bombe, and Typex (markdown)

---
 Enigma,-the-Bombe,-and-Typex.md | 350 ++++++++++++++++++++++++++++++++
 1 file changed, 350 insertions(+)
 create mode 100644 Enigma,-the-Bombe,-and-Typex.md

diff --git a/Enigma,-the-Bombe,-and-Typex.md b/Enigma,-the-Bombe,-and-Typex.md
new file mode 100644
index 0000000..81c124d
--- /dev/null
+++ b/Enigma,-the-Bombe,-and-Typex.md
@@ -0,0 +1,350 @@
+## How to guides
+
+### How to encrypt/decrypt with Enigma
+
+We'll start with a step-by-step guide to decrypting a known message. You can see the result of
+these steps in CyberChef
+[here](https://gchq.github.io/CyberChef/#recipe=Enigma('3-rotor','','','','BDFHJLCPRTXVZNYEIWGAKMUSQO<W','K','O','AJDKSIRUXBLHWTMCQGZNPYFVOE<F','N','P','ESOVPZJAYQUIRHXLNFTGKDCMWB<K','G','M','AY%20BR%20CU%20DH%20EQ%20FS%20GL%20IP%20JX%20KN%20MO%20TZ%20VW','AH%20CO%20DE%20GZ%20IJ%20KM%20LQ%20NY%20PS%20TW',true)&input=WFRTWU4gV0FFVUcgRVpBTFkgTlJRSU0gQU1MWlggTUZVT0QgQVdYTFkgTFpDVVogUU9RQlEgSkxDUEsgTkREUlcgRg).
+Let's say that our message is as follows:
+
+`XTSYN WAEUG EZALY NRQIM AMLZX MFUOD AWXLY LZCUZ QOQBQ JLCPK NDDRW F`
+
+And that we've been told that a German service Enigma is in use with the following settings:
+
+Rotors `III`, `II`, and `IV`, reflector `B`, ring settings (Ringstellung in German) `KNG`,
+plugboard (Steckerbrett)`AH CO DE GZ IJ KM LQ NY PS TW`, and finally the rotors are set to `OPM`.
+
+Enigma settings are generally given left-to-right. Therefore, you should ensure the 3-rotor Enigma
+is selected in the first dropdown menu, and then use the dropdown menus to put rotor
+`III` in the 1st rotor slot, `II` in the 2nd, and `IV` in the 3rd, and pick
+`O` in the reflector slot. In the ring setting and initial value boxes for the 1st rotor, put `K`
+and `M` respectively, `N` and `P` in the 2nd, and `G` and `M` in the 3rd. Copy the plugboard
+settings `AH CO DE GZ IJ KM LQ NY PS TW` into the plugboard box. Finally, paste the message into
+the input window.
+
+The output window will now read as follows:
+
+`HELLO CYBER CHEFU SERST HISIS ATEST MESSA GEFOR THEDO CUMEN TATIO N`
+
+The Enigma machine doesn't support any special characters, so there's no support for spaces, and
+by default unsupported characters are removed and output is put into the traditional five-character
+groups. (You can turn this off by disabling "strict input".) In some messages you may see X used to
+represent space.
+
+Encrypting with Enigma is exactly the same as decrypting - if you copy the decrypted message back
+into the input box with the same recipe, you'll get the original ciphertext back.
+
+#### Plugboard, rotor and reflector specifications
+
+The plugboard exchanges pairs of letters, and is specified as a space-separated list of those
+pairs. For example, with the plugboard `AB CD`, `A` will be exchanged for `B` and vice versa, `C`
+for `D`, and so forth. Letters that aren't specified are not exchanged, but you can also specify,
+for example, `AA` to note that `A` is not exchanged. A letter cannot be exchanged more than once.
+In standard late-war German military operating practice, ten pairs were used.
+
+You can enter your own components, rather than using the standard ones. A rotor is an arbitrary
+mapping between letters - the rotor specification used here is the letters the rotor maps A through
+Z to, so for example with the rotor `ESOVPZJAYQUIRHXLNFTGKDCMWB`, `A` maps to `E`, `B` to `S`, and
+so forth. Each letter must appear exactly once. Additionally, rotors have a defined step point (the
+point or points in the rotor's rotation at which the neighbouring rotor is stepped) - these are
+specified using a `<` followed by the letters at which the step happens.
+
+Reflectors, like the plugboard, exchange pairs of letters, so they are entered the same way.
+However, letters cannot map to themselves.
+
+### How to encrypt/decrypt with Typex
+
+The Typex machine is very similar to Enigma. There are a few important differences from a user
+perspective:
+
+* Five rotors are used.
+* Rotor wirings cores can be inserted into the rotors backwards.
+* The input plugboard (on models which had one) is more complicated, allowing arbitrary letter
+  mappings, which means it functions like, and is entered like, a rotor.
+* There was an additional plugboard which allowed rewiring of the reflector: this is supported by
+  simply editing the specified reflector.
+
+Like Enigma, Typex only supports enciphering/deciphering the letters A-Z. However, the keyboard was
+marked up with a standardised way of representing numbers and symbols using only the letters. You
+can enable emulation of these keyboard modes in the operation configuration. Note that this needs
+to know whether the message is being encrypted or decrypted.
+
+### How to attack Enigma using the Bombe
+
+Let's take the message from the first example, and try and decrypt it without knowing the settings
+in advance. Here's the message again:
+
+`XTSYN WAEUG EZALY NRQIM AMLZX MFUOD AWXLY LZCUZ QOQBQ JLCPK NDDRW F`
+
+Let's assume to start with that we know the rotors used were `III`, `II`, and `IV`, and reflector
+`B`, but that we know no other settings. Put the ciphertext in the input window and the Bombe
+operation in your recipe, and choose the correct rotors and reflector. We need one additional piece
+of information to attack the message: a "crib". This is a section of known plaintext for the
+message. If we know something about what the message is likely to contain, we can guess possible
+cribs.
+
+We can also eliminate some cribs by using the property that Enigma cannot encipher a letter as
+itself. For example, let's say our first guess for a crib is that the message begins with "Hello
+world". If we enter `HELLO WORLD` into the crib box, it will inform us that the crib is invalid,
+as the `W` in `HELLO WORLD` corresponds to a `W` in the ciphertext. (Note that spaces in the input
+and crib are ignored - they're included here for readability.) You can see this in CyberChef
+[here](https://gchq.github.io/CyberChef/#recipe=Bombe('3-rotor','LEYJVCNIXWPBQMDRTAKZGFUHOS','BDFHJLCPRTXVZNYEIWGAKMUSQO<W','AJDKSIRUXBLHWTMCQGZNPYFVOE<F','ESOVPZJAYQUIRHXLNFTGKDCMWB<K','AY%20BR%20CU%20DH%20EQ%20FS%20GL%20IP%20JX%20KN%20MO%20TZ%20VW','HELLO%20WORLD',0,true)&input=WFRTWU4gV0FFVUcgRVpBTFkgTlJRSU0gQU1MWlggTUZVT0QgQVdYTFkgTFpDVVogUU9RQlEgSkxDUEsgTkREUlcgRg)
+
+Let's try "Hello CyberChef" as a crib instead. If we enter `HELLO CYBER CHEF`, the operation
+will run and we'll be presented with some information about the run, followed by a list of stops.
+You can see this
+[here](https://gchq.github.io/CyberChef/#recipe=Bombe('3-rotor','LEYJVCNIXWPBQMDRTAKZGFUHOS','BDFHJLCPRTXVZNYEIWGAKMUSQO<W','AJDKSIRUXBLHWTMCQGZNPYFVOE<F','ESOVPZJAYQUIRHXLNFTGKDCMWB<K','AY%20BR%20CU%20DH%20EQ%20FS%20GL%20IP%20JX%20KN%20MO%20TZ%20VW','HELLO%20CYBER%20CHEF',0,true)&input=WFRTWU4gV0FFVUcgRVpBTFkgTlJRSU0gQU1MWlggTUZVT0QgQVdYTFkgTFpDVVogUU9RQlEgSkxDUEsgTkREUlcgRg).
+Here you'll notice that it says `Bombe run on menu with 0 loops (2+ desirable).`, and there are a
+large number of stops listed. The menu is built from the crib you've entered, and is a web linking
+ciphertext and plaintext letters. (If you're maths inclined, this is a graph where letters - plain
+or ciphertext - are nodes and states of the Enigma machine are edges.) The machine performs better
+on menus which have loops in them - a letter maps to another to another and eventually returns to
+the first - and additionally on longer menus. However, menus that are too long risk failing because
+the Bombe doesn't simulate the middle rotor stepping, and the longer the menu the more likely this
+is to have happened. Getting a good menu is a mixture of art and luck, and you may have to try a
+number of possible cribs before you get one that will produce useful results.
+
+<img src="https://user-images.githubusercontent.com/22770796/54355102-285ca900-4650-11e9-823a-c001cd2cf99c.png" width=500 alt="Bombe menu diagram">
+
+
+In this case, if we extend our crib by a single character to `HELLO CYBER CHEFU`, we get a loop in
+the menu (that `U` maps to a `Y` in the ciphertext, the `Y` in the second cipher block maps to
+`A`, the `A` in the third ciphertext block maps to `E`, and the `E` in the second crib block maps
+back to `U`). We immediately get a manageable number of results. You can see this
+[here](https://gchq.github.io/CyberChef/#recipe=Bombe('3-rotor','LEYJVCNIXWPBQMDRTAKZGFUHOS','BDFHJLCPRTXVZNYEIWGAKMUSQO<W','AJDKSIRUXBLHWTMCQGZNPYFVOE<F','ESOVPZJAYQUIRHXLNFTGKDCMWB<K','AY%20BR%20CU%20DH%20EQ%20FS%20GL%20IP%20JX%20KN%20MO%20TZ%20VW','HELLO%20CYBER%20CHEFU',0,true)&input=WFRTWU4gV0FFVUcgRVpBTFkgTlJRSU0gQU1MWlggTUZVT0QgQVdYTFkgTFpDVVogUU9RQlEgSkxDUEsgTkREUlcgRg).
+Each result gives a set of rotor initial values and a set of identified plugboard wirings.
+Extending the crib further to `HELLO CYBER CHEFU SER` produces a single result, and it has also
+recovered eight of the ten plugboard wires and identified four of the six letters which are not
+wired. You can see this
+[here](https://gchq.github.io/CyberChef/#recipe=Bombe('3-rotor','LEYJVCNIXWPBQMDRTAKZGFUHOS','BDFHJLCPRTXVZNYEIWGAKMUSQO<W','AJDKSIRUXBLHWTMCQGZNPYFVOE<F','ESOVPZJAYQUIRHXLNFTGKDCMWB<K','AY%20BR%20CU%20DH%20EQ%20FS%20GL%20IP%20JX%20KN%20MO%20TZ%20VW','HELLO%20CYBER%20CHEFU%20SER',0,true)&input=WFRTWU4gV0FFVUcgRVpBTFkgTlJRSU0gQU1MWlggTUZVT0QgQVdYTFkgTFpDVVogUU9RQlEgSkxDUEsgTkREUlcgRg).
+
+We now have two things left to do:
+
+1. Recover the remaining plugboard settings.
+1. Recover the ring settings.
+
+This will need to be done manually.
+
+Set up an Enigma operation with these settings. Leave the ring positions set to `A` for the moment,
+so from top to bottom we have rotor `III` at initial value `E`, rotor `II` at `C`, and rotor `IV`
+at `G`, reflector `B`, and plugboard `DE AH BB CO FF GZ LQ NY PS RR TW UU`.
+
+You can see this
+[here](https://gchq.github.io/CyberChef/#recipe=Enigma('3-rotor','LEYJVCNIXWPBQMDRTAKZGFUHOS','A','A','BDFHJLCPRTXVZNYEIWGAKMUSQO<W','A','E','AJDKSIRUXBLHWTMCQGZNPYFVOE<F','A','C','ESOVPZJAYQUIRHXLNFTGKDCMWB<K','A','G','AY%20BR%20CU%20DH%20EQ%20FS%20GL%20IP%20JX%20KN%20MO%20TZ%20VW','DE%20AH%20BB%20CO%20FF%20GZ%20LQ%20NY%20PS%20RR%20TW%20UU',true)&input=WFRTWU4gV0FFVUcgRVpBTFkgTlJRSU0gQU1MWlggTUZVT0QgQVdYTFkgTFpDVVogUU9RQlEgSkxDUEsgTkREUlcgRg).
+You will immediately notice that the output is not the same as the decryption preview from the
+Bombe operation! Only the first three characters - `HEL` - decrypt correctly. This is because the
+middle rotor stepping was ignored by the Bombe. You can correct this by adjusting the ring position
+and initial value on the right-hand rotor in sync. They are currently `A` and `G` respectively.
+Advance both by one to `B` and `H`, and you'll find that now only the first two characters decrypt
+correctly.
+
+Keep trying settings until most of the message is legible. You won't be able to get the whole
+message correct, but for example at `F` and `L`, which you can see
+[here](https://gchq.github.io/CyberChef/#recipe=Enigma('3-rotor','LEYJVCNIXWPBQMDRTAKZGFUHOS','A','A','BDFHJLCPRTXVZNYEIWGAKMUSQO<W','A','E','AJDKSIRUXBLHWTMCQGZNPYFVOE<F','A','C','ESOVPZJAYQUIRHXLNFTGKDCMWB<K','F','L','AY%20BR%20CU%20DH%20EQ%20FS%20GL%20IP%20JX%20KN%20MO%20TZ%20VW','DE%20AH%20BB%20CO%20FF%20GZ%20LQ%20NY%20PS%20RR%20TW%20UU',true)&input=WFRTWU4gV0FFVUcgRVpBTFkgTlJRSU0gQU1MWlggTUZVT0QgQVdYTFkgTFpDVVogUU9RQlEgSkxDUEsgTkREUlcgRg),
+our message now looks like:
+
+`HELLO CYBER CHEFU SERTC HVSJS QTEST KESSA GEFOR THEDO VUKEB TKMZM T`
+
+At this point we can recover the remaining plugboard settings. The only letters which are not known
+in the plugboard are `J K V X M I`, of which two will be unconnected and two pairs connected. By
+inspecting the ciphertext and partially decrypted plaintext and trying pairs, we find that
+connecting `IJ` and `KM` results, as you can see
+[here](https://gchq.github.io/CyberChef/#recipe=Enigma('3-rotor','LEYJVCNIXWPBQMDRTAKZGFUHOS','A','A','BDFHJLCPRTXVZNYEIWGAKMUSQO<W','A','E','AJDKSIRUXBLHWTMCQGZNPYFVOE<F','A','C','ESOVPZJAYQUIRHXLNFTGKDCMWB<K','F','L','AY%20BR%20CU%20DH%20EQ%20FS%20GL%20IP%20JX%20KN%20MO%20TZ%20VW','DE%20AH%20BB%20CO%20FF%20GZ%20LQ%20NY%20PS%20RR%20TW%20UU%20IJ%20KM',true)&input=WFRTWU4gV0FFVUcgRVpBTFkgTlJRSU0gQU1MWlggTUZVT0QgQVdYTFkgTFpDVVogUU9RQlEgSkxDUEsgTkREUlcgRg),
+in:
+
+`HELLO CYBER CHEFU SERST HISIS ATEST MESSA GEFOR THEDO CUMEO TMKZK T`
+
+This is looking pretty good. We can now fine tune our ring settings. Adjusting the right-hand rotor to
+`G` and `M` gives, as you can see
+[here](https://gchq.github.io/CyberChef/#recipe=Enigma('3-rotor','LEYJVCNIXWPBQMDRTAKZGFUHOS','A','A','BDFHJLCPRTXVZNYEIWGAKMUSQO<W','A','E','AJDKSIRUXBLHWTMCQGZNPYFVOE<F','A','C','ESOVPZJAYQUIRHXLNFTGKDCMWB<K','G','M','AY%20BR%20CU%20DH%20EQ%20FS%20GL%20IP%20JX%20KN%20MO%20TZ%20VW','DE%20AH%20BB%20CO%20FF%20GZ%20LQ%20NY%20PS%20RR%20TW%20UU%20IJ%20KM',true)&input=WFRTWU4gV0FFVUcgRVpBTFkgTlJRSU0gQU1MWlggTUZVT0QgQVdYTFkgTFpDVVogUU9RQlEgSkxDUEsgTkREUlcgRg),
+
+`HELLO CYBER CHEFU SERST HISIS ATEST MESSA GEFOR THEDO CUMEN WMKZK T`
+
+which is the best we can get with only adjustments to the first rotor. You now need to adjust the
+second rotor. Here, you'll find that anything from `D` and `F` to `Z` and `B` gives the correct
+decryption, for example
+[here](https://gchq.github.io/CyberChef/#recipe=Enigma('3-rotor','LEYJVCNIXWPBQMDRTAKZGFUHOS','A','A','BDFHJLCPRTXVZNYEIWGAKMUSQO<W','A','E','AJDKSIRUXBLHWTMCQGZNPYFVOE<F','D','F','ESOVPZJAYQUIRHXLNFTGKDCMWB<K','G','M','AY%20BR%20CU%20DH%20EQ%20FS%20GL%20IP%20JX%20KN%20MO%20TZ%20VW','DE%20AH%20BB%20CO%20FF%20GZ%20LQ%20NY%20PS%20RR%20TW%20UU%20IJ%20KM',true)&input=WFRTWU4gV0FFVUcgRVpBTFkgTlJRSU0gQU1MWlggTUZVT0QgQVdYTFkgTFpDVVogUU9RQlEgSkxDUEsgTkREUlcgRg).
+It's not possible to determine the exact original settings from only this message. In practice,
+for the real Enigma and real Bombe, this step was achieved via methods that exploited the Enigma
+network operating procedures, but this is beyond the scope of this document.
+
+#### What if I don't know the rotors?
+
+You'll need the "Multiple Bombe" operation for this. You can define a set of rotors to choose
+from - the standard WW2 German military Enigma configurations are provided or you can define your
+own - and it'll run the Bombe against every possible combination. This will take up to a few hours
+for an attack against every possible configuration of the four-rotor Naval Enigma! You should run
+a single Bombe first to make sure your menu is good before attempting a multi-Bombe run.
+
+You can see an example of using the Multiple Bombe operation to attack the above example message
+without knowing the rotor order in advance
+[here](https://gchq.github.io/CyberChef/#recipe=Multiple_Bombe('German%20Service%20Enigma%20(First%20-%203%20rotor)','EKMFLGDQVZNTOWYHXUSPAIBRCJ<R%5CnAJDKSIRUXBLHWTMCQGZNPYFVOE<F%5CnBDFHJLCPRTXVZNYEIWGAKMUSQO<W%5CnESOVPZJAYQUIRHXLNFTGKDCMWB<K%5CnVZBRGITYUPSDNHLXAWMJQOFECK<A','','AY%20BR%20CU%20DH%20EQ%20FS%20GL%20IP%20JX%20KN%20MO%20TZ%20VW','HELLO%20CYBER%20CHEFU%20SER',0,true)&input=WFRTWU4gV0FFVUcgRVpBTFkgTlJRSU0gQU1MWlggTUZVT0QgQVdYTFkgTFpDVVogUU9RQlEgSkxDUEsgTkREUlcgRg).
+
+#### What if I get far too many stops?
+
+Use a longer or different crib. Try to find one that produces loops in the menu.
+
+#### What if I get no stops, or only incorrect stops?
+
+Are you sure your crib is correct? Try alternative cribs.
+
+#### What if I know my crib is right, but I still don't get any stops?
+
+The middle rotor has probably stepped during the encipherment of your crib. Try a shorter or
+different crib.
+
+## How things work
+
+### How Enigma works
+
+We won't go into the full history of Enigma and all its variants here, but as a brief overview of
+how the machine works:
+
+Enigma uses a series of letter-\>letter conversions to produce ciphertext from plaintext. It
+is symmetric, such that the same series of operations on the ciphertext recovers the original
+plaintext.
+
+The bulk of the conversions are implemented in "rotors", which are just an arbitrary mapping from
+the letters A-Z to the same letters in a different order. Additionally, to enforce the symmetry, a
+reflector is used, which is a symmetric paired mapping of letters (that is, if a given reflector
+maps X to Y, the converse is also true). These are combined such that a letter is mapped through
+three different rotors, the reflector, and then back through the same three rotors in reverse.
+
+To avoid Enigma being a simple [Caesar cipher](https://wikipedia.org/wiki/Caesar_cipher), the
+rotors rotate (or "step") between enciphering letters, changing the effective mappings. The right
+rotor steps on every letter, and additionally defines a letter (or
+later, letters) at which the adjacent (middle) rotor will be stepped. Likewise, the middle rotor
+defines a point at which the left rotor steps. (A mechanical issue known as the
+double-stepping anomaly means that the middle rotor actually steps twice when the left hand rotor
+steps.)
+
+The German military Enigma adds a plugboard, which is a configurable pair mapping of letters
+(similar to the reflector, but not requiring that every letter is exchanged) applied before the
+first rotor (and thus also after passing through all the rotors and the reflector).
+
+It also adds a ring setting, which allows the stepping point to be adjusted.
+
+Later in the war, the Naval Enigma added a fourth rotor. This rotor does not step during
+operation. (The fourth rotor is thinner than the others, and fits alongside a thin reflector,
+meaning this rotor is not interchangeable with the others on a real Enigma.)
+
+There were a number of other variants and additions to Enigma which are not currently supported
+here, as well as different Enigma networks using the same basic hardware but different rotors
+(which are supported by supplying your own rotor configurations).
+
+### How Typex works
+
+Typex is a clone of Enigma, with a few changes implemented to improve security. It uses five rotors
+rather than three, and the _rightmost_ two are static. Each rotor has more stepping points.
+Additionally, the rotor design is slightly different: the wiring for each rotor is in a removable
+core, which sits in a rotor housing that has the ring setting and stepping notches. This means each
+rotor has the same stepping points, and the rotor cores can be inserted backwards, effectively
+doubling the number of rotor choices.
+
+Later models (from the Mark 22, which is the variant we simulate here) added two plugboards: an
+input plugboard, which allowed arbitrary letter mappings
+(rather than just pair switches) and thus functioned similarly to a configurable extra static
+rotor, and a reflector plugboard, which allowed rewiring the reflector.
+
+### How the Bombe works
+
+The Bombe is a mechanism for efficiently testing and discarding possible rotor positions, given
+some ciphertext and known plaintext. It exploits the symmetry of Enigma and the reciprocal
+(pairwise) nature of the plugboard to do this regardless of the plugboard settings. Effectively,
+the machine makes a series of guesses about the rotor positions and plugboard settings and for
+each guess it checks to see if there are any contradictions (e.g. if it finds that, with its
+guessed settings, the letter `A` would need to be connected to both `B` and `C` on the plugboard,
+that's impossible, and these settings cannot be right). This is implemented via careful connection
+of electrical wires through a group of simulated Enigma machines.
+
+A full explanation of the Bombe's operation is beyond the scope of this document - you can read
+the source code, and the authors also recommend Graham Ellsbury's
+[Bombe explanation](http://www.ellsbury.com/bombe1.htm), which is very clearly diagrammed.
+
+## Implementation in CyberChef
+
+### Enigma/Typex
+
+Enigma and Typex were implemented from documentation of their functionality.
+
+Enigma rotor and reflector settings are from GCHQ's documentation of known Enigma wirings. We
+currently simulate all basic versions of the German Service Enigma; most other versions should be
+possible by manually entering the rotor wirings. There are a few models of Enigma, or attachments
+for the Service Enigma, which we don't currently simulate. The operation was tested against some
+of GCHQ's working examples of Enigma machines. Output should be letter-for-letter identical to a
+real German Service Enigma. Note that some Enigma models used numbered rather than lettered
+rotors - we've chosen to stick with the easier-to-use lettered rotors.
+
+There were a number of different Typex versions over the years. We implement the Mark 22, which is
+backwards compatible with some (but not completely with all, as some early variants supported case
+sensitivity) older Typex models. GCHQ also has a partially working Mark 22 Typex. This was used to
+test the plugboards and mechanics of the machine. Typex rotor settings were changed regularly, and
+none have ever been published, so a test against real rotors was not possible. An example set of
+rotors have been randomly generated for use in the Typex operation. Some additional information on
+the internal functionality was provided by the Bombe Rebuild Project.
+
+### The Bombe
+
+The Bombe was likewise implemented on the basis of documentation of the attack and the machine. The
+Bombe Rebuild Project at the National Museum of Computing answered a number of technical questions
+about the machine and its operating procedures, and helped test our results against their working
+hardware Bombe, for which the authors would like to extend our thanks.
+
+Constructing menus from cribs in a manner that most efficiently used the Bombe hardware was another
+difficult step of operating the real Bombes. We have chosen to generate the menu automatically from
+the provided crib, ignore some hardware constraints of the real Bombe (e.g. making best use of the
+number of available Enigmas in the Bombe hardware; we simply simulate as many as are necessary),
+and accept that occasionally the menu selected automatically may not always be the optimal choice.
+This should be rare, and we felt that manual menu creation would be hard to build an interface for,
+and would add extra barriers to users experimenting with the Bombe.
+
+The output of the real Bombe is optimised for manual verification using the checking machine, and
+additionally has some quirks (the rotor wirings are rotated by, depending on the rotor, between one
+and three steps compared to the Enigma rotors). Therefore, the output given is the _ring position_,
+and a correction depending on the rotor needs to be applied to the _initial value_, setting it to
+`W` for rotor V, `X` for rotor IV, and `Y` for all other rotors. We felt that this would require
+too much explanation in CyberChef, so the output of CyberChef's Bombe operation is the initial
+value for each rotor, with the ring positions set to `A`, required to decrypt the ciphertext starting
+at the beginning of the crib. The actual stops are the same. This would not have caused problems at
+Bletchley Park, as operators working with the Bombe would never have dealt with a real or simulated
+Enigma, and vice versa.
+
+By default the checking machine is run automatically and stops which fail silently discarded. This
+can be disabled in the operation configuration, which will cause it to output all stops from the
+actual Bombe hardware instead. (In this case you only get one stecker pair, rather than the set
+identified by the checking machine.)
+
+#### Optimisation
+
+A three-rotor Bombe run (which tests 17,576 rotor positions and takes about 15-20 minutes on
+original Turing Bombe hardware) completes in about a fifth of a second in our tests. A four-rotor
+Bombe run takes about 5 seconds to try all 456,976 states. This also took about 20 minutes on the
+four-rotor US Navy Bombe (which rotates about 30 times faster than the Turing Bombe!). CyberChef
+operations run single-threaded in browser JavaScript.
+
+We have tried to remain fairly faithful to the implementation of the real Bombe, rather than
+a from-scratch implementation of the underlying attack. There is one small deviation from "correct"
+behaviour: the real Bombe spins the slow rotor on a real Enigma fastest. We instead spin the fast
+rotor on an Enigma fastest. This means that all the other rotors in the entire Bombe are in the
+same state for the 26 steps of the fast rotor and then step forward: this means we can compute
+the 13 possible routes through the lower two/three rotors and reflector (symmetry means there are
+only 13 routes) once every 26 ticks and then save them. This does not affect where the machine stops,
+but it does affect the order in which those stops are generated.
+
+The fast rotors repeat each others' states: in the 26 steps of the fast rotor between steps of the
+middle rotor, each of the scramblers in the complete Bombe will occupy each state once. This means
+we can once again store each state when we hit them and reuse them when the other scramblers rotate
+through the same states.
+
+Note also that it is not necessary to complete the energisation of all wires: as soon as 26 wires
+in the test register are lit, the state is invalid and processing can be aborted.
+
+The above simplifications reduce the runtime of the simulation by an order of magnitude.
+
+If you have a large attack to run on a multiprocessor system - for example, the complete M4 Naval
+Enigma, which features 1344 possible choices of rotor and reflector configuration, each of which
+takes about 5 seconds - you can open multiple CyberChef tabs and have each run a subset of the
+work. For example, on a system with four or more processors, open four tabs with identical Multiple
+Bombe recipes, and set each tab to a different combination of 4th rotor and reflector (as there are
+two options for each). Leave the full set of eight primary rotors in each tab. This should complete
+the entire run in about half an hour on a sufficiently powerful system.
\ No newline at end of file