Why does the term "CILLY" begin at the start of every message in "The Imitation Game"?

Question

In the movie The Imitation Game, Alan Turing has a Eureka moment when he learns from a woman that one particular German begins every message that he sends out with the term "CILLY".

From what I understand, the significant of this moment is that Turing realizes that every coded message sent by the Germans contains several words that appear in many messages; namely "weather" in some, and "Heil Hitler" in surely almost all.

But why does this one German person that this woman is listening in on through a radio tower send out every message by beginning with the word "CILLY"? And the messages that he sends out all coded in Enigma, I presume?

And also, immediately after, Turing remarks that the Germans are instructed to use five random letters at the start of every message. I guess this is intended to make it harder to crack Enigma?

Answer 1

This isn’t that well explained in the movie. It’s mentioned that every message was supposed to start with a few random letters, but the movie doesn’t explain why. The movie also makes it seem like every Enigma message was encrypted with a key that the Germans changed every day. That’s not entirely right, if they would have done it that way, it would mean that each day there were quite a lot of messages that were encrypted with the exact same key. For a code breaker, the more text you have that is encrypted with the same key, the easier it becomes to find patterns that reveal something about the key.

The Germans actually used a system that came down to using two keys. There was one key that all the Enigma operators knew and which was changed every day, hence the day key. But the day key wasn’t directly used to encrypt a message. The day key was only used to encrypt a second key, the message key. The operator was supposed to simply make up a random message key for every message. The day key was then used to encrypt the message key, and the message key was used to encrypt the message. The complete encrypted message would consist of two parts: the encrypted message key, and the encrypted content part of the message. (Hence the movie’s mention that every encrypted message would start with a few random letters.) Decrypting the message would mean using the day key to decrypt the message key, and then using the message key to decrypt the content part. This way, there would be a lot less text encrypted with the same key, and the randomness of the message keys would make it harder to find patterns. At least in theory.

In practice, the Enigma operators would sometimes fail to use random message keys, instead using the same message key multiple times. Thus on a given day, there might be multiple pieces of encrypted text that would start with the same letters, being multiple uses of the same message key encrypted with the day key. As for the term “cilly”, I’ll quote Simon Singh, who is also the source for most of the above explanation: (I tried to summarize the above without getting into an explanation of an Enigma machine’s operations, more detail is given in Singh’s book)

Once they had mastered the Polish techniques, the Bletchley cryptanalysts began to invent their own shortcuts for finding the Enigma keys. For example, they cottoned on to the fact that the German Enigma operators would occasionally choose obvious message keys. For each message, the operator was supposed to select a different message key, three letters chosen at random. However, in the heat of battle, rather than straining their imaginations to pick a random key, the overworked operators would sometimes pick three consecutive letters from the Enigma keyboard, such as QWE or BNM. These predictable message keys became known as cillies. Another type of cilly was the repeated use of the same message key, perhaps the initials of the operator’s girlfriend — indeed, one such set of initials, C.I.L., may have been the origin of the term. Before cracking Enigma the hard way, it became routine for the cryptanalysts to try out the cillies, and their hunches would sometimes pay off.

Cillies were not weaknesses of the Enigma machine, rather they were weaknesses in the way the machine was being used.

Source: The Code Book: The Science of Secrecy from Ancient Egypt to Quantum Cryptography — Simon Singh

Answer 2

The story about every message beginning with Cilly is a simple one - it's suspected it's the name of the German operator's girlfriend. This is the relevant exchange from the film:

Turing: Wh-Why do you think your German counterpart has a girlfriend?
Helen: It's just a stupid joke; don't worry.
Turing: No, no, no, no. Tell me.
Helen: Well, each of his messages begins with the same five letters: C-I-L-L-Y. So I suspect that Cilly must be the name of his amore.
Turing: But that's impossible. The Germans are instructed to use five random letters at the start of every message.
Helen: Well, this bloke doesn't.

Using this knowledge, the film depicts Turing having a eureka moment as he realises his machine doesn't have to search through every possible setting - instead, it can search for words that they know will be in the message.

Take the operator sending out the messages beginning with Cilly. Sure, they're still encrypted. But Turing has a device that cracks encryption. Rather than making it depict every possible logical combination of letters, he would be able to set it so that only messages that had the first five letters of 'Cilly' were display.

Turing and the group realise that the 6AM weather reports almost always sign off with 'Heil Hitler'. Using this knowledge, they are able to only scan messages where the machine produces that output at the end of the message, allowing them to decode the messages much more quickly (the film depicts it in a matter of minutes). This means they've got the ability to crack the code long before it is changed daily - i.e. success!

As for your final comment - yes, that was intended to make the code much, much harder to crack.

Answer 3

As several people have mentioned The Imitation Game is, though fun, historically, er, challenged.

The Enigma machine had a Daily Key, shared by a "cryptonet" - ie a group of users using the same Key - say an Army Group. So the basics - wheel order, ring setting and plug settings were common to lots of signals units. The Key was sent out on monthly paper sheets, containing the Keys for each day of that month. So, with the Daily Key, you've got the right plugs plugged in right, you've selected the right wheels and put them on the spindle in the right order, and you've put the ring clips in the right position on each wheel. (The ring clip has the effect of rotating the internal wiring of each wheel, so the clip mathematically converts each wheel into 26 different (though related) wheels. And so that makes the puzzle harder.

But none of that tells you, the German Signalman, where to start each wheel on the spindle. You the German Signalman get to pick the starting position yourself, for every message. So you spin each wheel to a starting position of your choice, say position L for the left wheel, F for the middle wheel and T for the right wheel; and then you encrypt your message.

Problem is, the German Signalman on the receiving end, while he's got the Daily Key, and so can set up wheels, ring clips and plugs right, doesn't know what starting position you chose. So you, the sender, have to tell him. And you do that by picking three letters at random, say AYB (the Grundstellung) and flipping the three wheels to those starting positions - ie so those letters show up in the little panel on the front, after you've closed the machine. Then you tap in the starting position that you just used for the message you just encrypted - ie LFT - and encrypt LFT on your machine. Suppose it comes out PPS.

Now when you send your message, you put AYB PPS into the heading right up where you're mentioning your call sign and the time of the message etc, and how many letters it has, BEFORE you get to the actual encrypted message. The mug at the far end twiddles his spindle to AYB, types in PPS and out pops LFT. Cos Enigma is reciprocal.

So he knows the real meat of your encrypted message was encrypted with a starting position of LFT. So the receiver can then decrypt the message by flipping his spindles to LFT and then tapping away at your enciphered message using the Daily Key, based on the correct starting position.

So the starting position, or as it was called - Message Setting - is the position you start the machine from (ie which letters are showing in the panel) when you start encrypting - or start decrypting - a particular message. And you send that to your chum ENCRYPTED so he can work it out but the enemy can't. Good scheme.

But it loses a lot of its power if the sender picks non random message settings. If he's lazy and just picks ABC, or XYZ, that makes the enemy's job much easier, as they have a fair shot at guessing the message setting, which gives them a leg up towards solving the Daily Key. Especially if the enemy notes which German Signals troops seem to be dopiest and have bad habits picking message settings.

And one thing the enemy (ie Bletchley Park) spotted was that some German Signals troops used abbreviated versions of girls names for Message Settings - presumably their wives or girlfriends. Like MAR for Marthe, or DOR for Doris, or .....CIL for Cilli. Cilli is one of several pet variants of the German version of Cecilia. Obviously one particularly lazy, or perhaps infatuated, German Signalman was in the habit of often using CIL as his message setting and Bletchley Park noticed, and presumably couldn't resist the pun of using "cilli" as the generic term for guessable message settings caused by German operator laziness.

The film is quite wrong to suggest that five letter CILLI was ever used by a lazy German or spotted by BP. It would only ever have been CIL. Three letters for the three letter Message Setting.

The film is probably confusing this with the five letter group that was used to send the 'discriminant" - which is the fancy name for the flag to the receiver as to which (of several possible) Daily Keys was being used. The discriminant was also three letters (printed on the Key Sheet) but it was (badly) hidden within a five letter group. eg if the discriminant was WVM, the first five letter group of the actual message might be, for example BNMVW. ie the sender would put two random letters up front and then put the discriminant in any order as the last three letters. This held up Bletchley Park by about a minute maximum, as you might imagine. And nothing whatever to do with cillies.

Contra what some people have said above each message (each day, in each cryptonet) was encrypted using the same Daily Key. The Message Setting was simply the three letter starting position selected by the sender for each message, it wasn't a whole separate Key. So once BP had cracked the Daily Key for that cryptonet, they could decrypt EVERY message sent (and intercepted) on that cryptonet - because like the German receivers, once BP had the Daily Key, it took a matter of seconds to work out the Message Setting, ie the starting position, for each message.

Answer 4

in my opinion the operator's message is not an encrypted one he is sending normal Morse code message that is irrelevant (from the war point of view e.g. for civilian transaction market value for coffee ...). and this guy's message always begin with the same letter pretty normal thing as of dear/sir/madam/regards. But for the code breaking team this is a new feedback that assuming there will be words that for sure will be in the message (and when the check the previous decrypted messages they found “weather” and “heil” and “Hitler”). this means they machine gonna only search for those words to get the enigma setting. so Turing only take the concept that there will be a repetition in everyday message, not the other way. if the message of the guy was encrypted it will never be always Cilly.