Devlog #10

This one is two small things instead of one big thing — share links, and a challenge mode built from real 1941 intercepts — plus an embarrassing amount of time spent not writing code. Most of it still isn’t properly wired in, but the hours happened, so here’s the honest checkpoint.

Share links

The whole machine state — rotors, reflector, rings, start position, plugboard — plus a message now fits in the URL hash, like #I.II.III.B:TOU:HOU:ABCDXZ:HELLOWORLD. Opening the link configures the machine and runs the message through it, so the person on the other end watches their lampboard spell out the plaintext. “I encrypted this, try reading it” finally works as a link.

My first version of the format forgot the reflector. Anyone opening those links would have gotten confident garbage, and I only noticed while writing the parser. It costs four characters in the URL.

Real intercepts, verified

I didn’t want to invent fake historical messages, so I went looking for real ones — and that hunt ate the first chunk of the day. Ended up at Ostwald and Weierud’s Cryptologia paper (2017)(https://cryptocellar.org), which lists 13 authentic Wehrmacht messages from 1941, transcribed from the actual message forms, with keys recovered by modern cryptanalysis. I picked six — from a three-word “morning report canceled” up to an SS tank division complaining that two other divisions are blocking its road.

Each form starts with a 5-letter group that looks like ciphertext but isn’t — it’s the Kenngruppe, a network discriminant. The paper warns you to skip it before decrypting, and for once I read the instructions first. All six decrypt on the site’s engine to exactly the plaintext on the forms.

The cracker only spoke English

The crack mode scored decryptions by English letter frequencies. These messages are German. Added a German frequency table and scored by whichever language fits better.

Still not enough for the short ones. I ran a parameter sweep over the scoring weights and the 18-to-76-letter intercepts never rank first under any combination. That’s not a bug, it’s information theory — and it’s exactly why Bletchley Park needed cribs instead of brute force. So the panel is honest about it: only the 214-letter intercept gets a “Crack positions” button (it recovers the real start position, SDV, in about half a second), and the short ones say why they’re decrypt-only.

Where the hours actually went

Reading a cryptology paper instead of writing components. Rewriting the challenge card layout more than once. Re-running the sweep every time I changed my mind about the scoring. The code diff is small; the day was not. The remaining wiring is still in progress.

Next up

Crib-based cracking, the known-plaintext attack. That’s what actually breaks the short ones, and it’s the historically accurate method