Mystery Message – Naval Enigma or a Fake That Fooled Us?
WARNING! The message is fake; a fabrication.
The ciphertext message below was received from John Harper and John Borthwick of the Bombe Rebuild Project. After Scharnhorst’s Last Message broke, I asked John Harper if they had any more German naval ciphertext messages, and a few days later John Borthwick sent me the message below.
Here is John Borthwick’s E-Mail accompanying the message:
Hello Frode,
John Harper mentioned that you’re looking for more messages to break. Attached is a copy of a naval message which has been on the copy-holder of the Typex machine which we have on display at BP. It has been there for years as you can see from the different fading of the paper. We know absolutely nothing about it other than it is obviously Naval since it’s in groups of 4 and the indicators are repeated at the end.
Have fun!
Regards,
John
Ciphertext
BP Teleprint
STNX
10-03-43 1031 5088 28 SF283 A236
C DE 36/RTC (0430) 154= NJGH DRFU=
DTHY HYSR CGNH DEJL AVZO SHUN WLKN OPRT
KIDT VHWL APUT DRTW KPWK DUNC AMFR TYWM
OKHY ABGT JNDE RTMO PLCR BTRA UNCE KYNC
WUIN UIOP NGTC RTAZ QPMB RSAB DHIL WBCU
OPBG RTDV WRSN ERTC JKWA YHJI NK
= NJGH DRFU=
ALT 2/7 AMGR
SENT 1200 Z GHKFacsimile of the BP Teleprinter Message (PDF format)
The 2008 Analysis
At first, I assumed it was a German Naval Enigma message. It comes in groups of 4 letters, and the two 4-letter indicator groups repeat at the end. But on closer inspection, I am no longer so sure. First, the indicator groups stand apart from the message. They are not even counted in the number of groups in the message. The last ciphertext group is also incomplete; it has only two letters instead of four. I therefore think that the message needs more research before it can be attacked. One possible origin could be that it is an Abwehr message enciphered on the Enigma-G machine, the so-called Abwehr Enigma. The Abwehr usually transmitted ciphertext in groups of five, but in some cases also used 4-letter groups. The two indicator groups could fit with the indicators used with the Abwehr machine. Or it could be from an Enigma-K machine, which the German Railway, the Abwehr, and other special units used. This machine would also need 4-letter indicators, as the reflector (UKW) was settable. But there are perhaps other possibilities.
At NARA, in RG 457 – The NSA Historical Collection, a document titled “Study of Customary Practices of German Radio Procedure, 1944,” Nr. 1677, CBKJ21, Box 622, describes a message like the one above:
Four-letter messages with a key made up of two groups repeated at the beginning and end of message. This type [of] message, very much used, is a machine cipher, probably Hagelin, and midget submarines are known to be provided with this system.
It is doubtful if this traffic is Hagelin. It is difficult to see where the author of this report got this notion. At this time, early 1943, only the Italian Navy were using the Hagelin machine, the C38m. It is indeed possible that their midget submarine force used this machine for their communications, but it is difficult to understand why this traffic would pass over a German radio circuit. First, after Italy’s surrender in September 1943, the Italian midget submarines of the 10th MAS Flotilla went over to the Germans and came under their command.
If we look more closely at the header of this message, we see it is addressed to STNX, Station X – Bletchley Park. On the line below, the intercept station has written the date and time of intercept: 10 March 1943 at 10:31 Zulu. The next number, 5088, is the intercepted frequency, 5088 kHz. Then comes the number 28, possibly the German radio station’s row number, followed by a serial number allocated by the intercept station to each new message (here, SF283), and finally the intercept series number, A236. In 1944, A236 was the series allocated to German Air Force (GAF) traffic transmitted on 5088 kHz. Whether the same traffic was allocated to this series in 1943 is unknown, but it is very likely. Tony Sale has published a set of such messages on his website, Codes and Ciphers. On the page German Air Force Messages you will find a message with an almost identical first header line if you look at the second message from the top of the page, the message marked 2TL in the second header line. The intercept station header is almost identical, including the intercepted frequency; only the date differs. These messages are apparently enciphered with the GAF Enigma key Jaguar, the key for Luftflotte 3, but this key did not appear before in December 1944.
In the NARA document cited above, there is also the following paragraph:
There is, however, one group of stations having R as the first letter of the call sign which is not organised in the aforementioned sense. These stations are apparently all aviation field stations or D/F stations for the assistance of aircraft and as a result are spread throughout all Europe and operate independently without any link.
This fits well with our understanding that this radio circuit belongs to or passes traffic for the German Air Force.
By studying Ralph Erskin’s notes on Breaking Naval Enigma (Dolphin and Shark) and The _Kenngruppenbuch_ Indicator System, and the Enigma Manuals The Enigma General Procedure and The Enigma – Offizier and Staff Procedure you will get a better feeling for the German Naval Enigma messages.
The Final Straw
As the analysis section shows, questions about this message have long persisted. Is it Naval Enigma, Abwehr, Enigma K, Hagelin or perhaps a manual cipher? And who was the sender, and to whom was it addressed? I think we all found the message puzzling, a mystery as the title says, but few of us doubted its authenticity. Until now.
On 19 September 2026, I received an e-mail from an Austrian named Oliver. Here is what he says:
Hi cryptocellar,
We are working on this from Austria and had a go at the slip that sat on the Typex copy-holder.
My colleagues and I do not think it is a wartime naval message or even German. The heading is almost the same as a teaching intercept Tony Sale published for 2 November 1944: same intercept time, same frequency, same serial SF283, same series A236, same 0430 origin time, even the same ALT 2/7 correction slot. Only the date and the letter groups changed. Sale used those serial numbers again on a made-up March 1943 film page. He was the museum’s first curator, and that paper has been on your machine for years. That is a lot to swallow as two real intercepts twenty months apart.
A few other things sit badly with German Navy practice. They counted the indicator groups in the length, and they filled the last group out to four letters. This slip does neither. The last group is just NK. In the middle of the “cipher” there is also UIOP, four keys in a row on a typewriter.
We tried it as German Enigma and as ordinary English. Nothing readable came out. I would treat it as a display or teaching slip until someone looks at the paper.
Do you still have the original? A photo of the stock, or any note that it was put there for the exhibit, would settle it.
Thanks, Oliver
Oliver repeats many of my observations in the analysis section, but he also adds other observations such as the 26th ciphertext group being UIOP. UIOP is just a nice walk along the upper keyboard row. The teaching intercept for 2 November 1944 that Oliver mentions, published by Tony Sale, is indeed a genuine Y-station intercept sent to Bletchley Park. But the mystery message with the = NJGH DRFU= indicator now seems to be a message that Tony Sale made up to use in the file “Enigma” based on a book of the same name by Robert Harris.
Since the original analysis, I now have access to more detailed sources, one of which is The Sixta History. Here we find the following:
1) Luftflotte 3’s Six Stars
Up to D day, however, the network was fairly stable. It consisted of stars controlled by Luftflotte 3.
Star A was formed of operational staffs, to which were subordinated all aircraft in the west. These included Fliegerkorps IX, Fliegerkorps X, Jagdkorps I, Jagdkorps II, Fliegerdiv. 2, and Fliegerfuehrer West. All operational orders and results passed on this star. Star B served the Luftgau, and hence was concerned with administrative orders. Stations on the star included Feldluftgau Belgien-Nordfrankreich and Feldluftgau West Frankreich as well as units requiring temporary communications with Luftflotte 3 but not obviously concerned with administration (e.g. AOK 7). Star C was largely a reproduction of Star B and was officially to be used when telephone lines were out of order. In fact, however, it was used as an overflow star passing traffic which would normally have passed on Star B, had it not been temporarily overburdened. Star D served the same function in relation to Star A. Star E was introduced on June 12th, and will be dealt with more fully later. Star F was always referred to as the recce star. Fliegerdiv. 2 was its most important subscriber, and the usual traffic was 3/Fig. Only in exceptional circumstances did it pass E traffic. Star G was the supply star. Subscribers varied from the Luftgau to transport aircraft (IV T.G.4.) and operational staffs (e.g. Fliegerkorps IX, Jagdkorps II and Fliegerdiv. 2). The callsign serials in use on each star were A236, A143, A145, A146, A144, A235 and A147. These were essentially Luftflotte 3 serials and were used by this authority until the callsign encoding system was introduced.
From this we find that A236 is the callsign serial ID for Star A of Luftflotte 3. I think we can exclude that Naval Enigma messages were ever sent on this network. Intercommunication between the Luftwaffe and the Kriegsmarine, which was common in the coastal areas and in the Mediterranean, used the Enigma M machines in the Wehrmacht mode where only the five Wehrmacht rotors were used and where the messages used the normal Wehrmacht format with 5-letter cipher groups.
I have therefore come to the conclusion, alas late, that this message is a fabrication, initially created to make the “Enigma” film script as close to reality as possible. However, when these artefacts are made using old teleprinters or typewriters and aged paper, the result can easily pass for a genuine message. This is especially true when we don’t have access to the “original”, but only a photographic copy. As a historian, I should like to issue a warning to future museum curators or film producers that they should take care when fabricating objects of historical value for museum display or for use in films or on stage to mark the object as fake and, if possible, have the objects destroyed when they no longer have any use.
Notes
There are statements in the 2008 Analysis that are in contradiction with the new text in the Final Straw section. This is intentional in that we feel it is better to leave the 2008 Analysis as it was to show what we thought about the mystery message then. Even within the 2008 Analysis section, there are apparent contradictions, such as the sentence: These messages are apparently enciphered with the GAF Enigma key Jaguar, the key for Luftflotte 3, but this key did not appear before in December 1944. This sounds strange, given that the message is supposed to be from 10 March 1943. However, it was one of the oddities we observed in 2008, but which we, with the knowledge we had then, could not decide if it was a decisive factor in accepting the message as authentic or not.
The A236 ID should also have set off alarm bells, but in 2008 it was not entirely clear what it referred to. We thought it indicated a set of frequencies intercepted by the Y-station. The sources we had at the time gave A236 as an intercept series ID, which we found linked to GAF traffic; however, we had no information to show whether this serial also carried Naval traffic. Now we know that A236 and the other IDs A143, A145, A146, A144, A235, and A147 carried traffic only for the Luftflotte 3 stars.
In retrospect, it now appears almost unbelievable that we did not detect that the message was fake in 2008. However, it seems this idea never occurred to us. We never even considered that somebody at BP would fabricate such a message.
Acknowledgments
I should like to thank the Bombe Rebuild Team who, as always, is very supportive when I ask for help. In this case, I would like to particularly thank John Harper and John Borthwick, who sent me the copy of the BP teleprint with the mystery message. And a special thanks to Oliver, who made me have another look at this message.
Further Information
For more information about our codebreaking projects, see our Web Portal: Breaking German Wehrmacht Ciphers.
Updated: 21 September 2026 at 14:30 UTC
| Back to Crypto Cellar Research | Licensed under CC BY-NC-SA 4.0 Frode Weierud, Crypto Cellar Research © 2026 |
Breaking German Wehrmacht Ciphers |