is the story of Boris Hagelin, a brilliant engineer, and
his famous cipher machines. He is the only inventor and
developer of crypto machines in history to have made a
fortune in that market. Hagelin and Crypto AG were most
respected names in the world of crypto machines and have
dominated the commercial market of cryptology for many
decades, until the firm was liquidated in 2019. Soon
after, disclosed CIA documents revealed that the CIA and
BND joint-purchaised Crypto AG from Boris Hagelin, as
early as 1970, making it the largest ever worldwide
compromise of secure communications for many decades.
The Man and the Firm
Boris Hagelin was
born on July 2nd, 1892 in Adschikent, Russia. His
Swedish father sent him to Sweden, where he
graduated in 1914 as mechanical engineer. His
future was already planned in the Nobel company's
Oilfields, where his father was the manager.
Initially, he specialized in electrical
engineering in order to become supervisor of the
construction of an electric power plant for the
Nobel Company in Baku. After the revolution in
1920 the Nobel family entered into a partnership
with the Standard Oil Company in the US, and
Boris moved to the US to work in their General
engineering Department. After one year he
returned to Sweden.
Nobel asked Boris Hagelin to supervise a small
Swedish company, A.B. Cryptograph, which
manufactured ciphermachines, invented by the
Swedish engineer Arvid Damm. In 1925 he took over
management and started developing new machines.
In 1932 A.B Cryptoteknik replaced the liquidated
A.B. Cryptograph. Hagelin promoted his popular
C-35 cipher machine during the Second World War
in the United States. Adapted for the U.S. Army
under the name M-209, this machine became a huge
success and Hagelin made a fortune.
After WWII Hagelin moved to Zug
in neutral Switzerland and established Crypto AG
in 1952. This relocation was required since
Sweden considered Cryptographic equipment as
weapons, and thus prohibited their export. The
pre-war reputation of mechanical "Hagelin
Cryptos" devices and the need for enciphered
telegraph equipment helped the firm to grow and
laid the foundation for a new generation of
electronic cipher equipment. Boris Hagelin died
in 1983 at the age of 91.
Hagelin B-21 and the First Success
In 1925 the Swedish General
Staff contacted A.B. Cryptograph to design a
machine that would be superior to the German
Enigma. Hagelin developed a prototype for
evaluation called B-21. The B-21 was approved for
the Swedish General Staff and Hagelin also sold
the machine to several other countries. Its
principle was based on Arvid Damm's simplified
rotors, a 5 x 5 grid design. The machine had a
keyboard, 2 rotors of which the stepping was
controlled by two pairs of pin-wheels and a
display with 25 lamps that presented the output
of the en/de-cipherment. The machine was operated
on 110 or 220 volt and the lamp panel was powered
by a battery. Depressing a key would close two
contacts, each contact in one of two groups of
five contacts. The signal then passed through two
rotors to the 25 lamps. Interchangeable leads, in
series with the rotors, could be connected as
This machine was the first to
apply pin-wheels, a feature that was used in many
of its successors. A pin-wheel is a disk with a
number of axial holes in which pins are located.
These pins can be moved either to the left or to
the right side of the disk. On one side, these
pins are inactive, on the other side active. With
each step, the pin-wheel moves one pin position.
Several different pin-wheels with different
numbers of pins without a common factor are used
to obtain a very long key period.
In 1932 the French Army was
interested in the B-21 but asked for two
important modifications. The machine had to be
portable and should be able to print the text.
Hagelin developed the B-211 which could be
operated either with electric power or by hand
with a crank. He replaced the lamp panel with a
type-wheel printing mechanism and the ciphering
circuits were powered by a battery. About 500
B-211 machines were built. In 1940 Hagelin
installed a workshop in Sweden with the profits
of the successful B-211 and A.B. Cryptograph was
renamed in A.B. Ingenieursfirman Cryptoteknik.
Already in 1934 the French
Cipher Bureau asked Hagelin to develop a compact
cipher machine that could also print. Hagelin got
the idea to adapt a calculating mechanism from a
money changer into a small crypto device. The
infamous pin-and-lug machines were born.
The first machine, the C-35,
consisted of a drum with 25 bars, five pin-wheels
(identical to the ones used in the B-21) and an
alphabet-knob/type-wheel with reciprocal alphabet
(type-wheel alphabet reversed to knob alphabet).
By using a reciprocal encryption it was very easy
to switch between enciphering and deciphering.
The text was printed on a small paper ribbon. The
compact device had the size of a small lunch box.
Military personnel could put it in a side pocket
of the uniform.
To encipher a letter the
operator turned the alphabet knob to the desired
letter and turned the handle at the right side of
the machine. The type-wheel, fixed to the
alphabet knob, then turned a number of steps,
depending on the settings of the machine. The
enciphered letter was printed on the paper ribbon
or the operator could read off the reciprocal
alphabet on the knob. The wheel-pins were set
each day according to a key sheet. Before each
enciphering of a new message, the operator would
set a new start position of the 5 pin-wheels on
movable slide-bars on the drum contain fixed
lugs. When the drum is revolved with the handle
outside the machine, the different lugs pass 5
cams that are under control of the pins on the
five pin-wheels. If a pin is active, the cam of
that wheel will push a passing lug to the left.
The slide-bar on which that lug is fixed will
also move to the left and comes out of the drum
as a small teeth. The left side of the drum will
therefore act as a gear wheel with a variable
number of teeth, engaging the type wheel. The
number of tooth, and thus the displacement of the
type wheel, depends on the settings of the lugs
The 5 wheels
had 17, 19, 21, 23 and 25 pins. Since these
numbers have no common factor the same wheel
setting would only occur once every 3,900,225
steps. On top of this, there were theoretically
10E29 different possibilities to set the many
pins on the wheels.
An improved version with
protective casing and another lug arrangement,
and later on with movable lugs on the drum, was
designated C-36 and. Its successor, the C-38, had
six pinwheels. The lugs on this machine could
slide on the drum bars in one of 5 active or an
inactive position. This improvement, together
with the larger wheel period, provided a very
large key space. Another version, designated
BC-543, was fitted with a keyboard.
In 1940 Hagelin went to the USA
to promote his C Type machines which resulted in
the largest sale ever of crypto machines. The US
military selected his C-38 as tactical ciphering
device and designated it as M-209. By the end of
the Second World War over 140,000 of these small
M-209 machines were produced in the US. A
simulator of the M-209 can be downloaded on this page.
The C-52 and CX-52
Although the C-36 and C-38 were
ideal for tactical purposes they were
insufficient for the enciphering of high level
message traffic that could resist extensive
cryptanalysis. An improved version would open the
door to the market of high level military and
diplomatic encryption. Hagelin went back to the
drawing table to improve his C Machines.
Several improvements were
introduced in the C-52 model. The rotation of the
pin-wheels became irregular. Whether a wheel
moved or not on a given cycle depended on the pin
positions of the previous wheels. For the 6 wheel
model there was now the choice between 12
pin-wheels, with 25, 26, 29, 31, 34, 37, 38, 41,
42, 43, 46 and 47 pins. The number of slide-bars
was increased to 32. A second type wheel was
added to print both plain and ciphered text at
the same time on a split paper ribbon and it was
possible to set a relative position between the
primary and secondary type wheel. Also, a type
wheel with letters that could be rearranged
became available. The later CX-52 model has 6
pinwheels with 47 pins each and a more flexible
pinwheel advancing system as the C-52, resulting
in a complex and higly irregular wheel movement.
Instead of developing a version
with fixed keyboard like the BC-543 machine, the
C-52 could be fitted with a separate keyboard
attachment, called B-52 which included the
electric motor to drive the drum of the C-52. The
configuration with keyboard was designated BC-52.
The very popular C-52, CX-52 and BC-52 were sold
all over the world. More technical details on the
52 model on this page.
You can download a BC-52 simulator on this page.
The CX-52 RT has a tape reader
to use of one-time tapes. Another development,
based on the 52 series was the PEB machine
designed to make enciphering easier for telex
traffic. This was a combination of an adapted
BC-52 model, called BC-621, connected to the
PEB-61 tape punch and reader.
On demand of the French
Gendarmerie, a small pocket device was developed
with the name CD-55. Two years later, the CD-57
was manufactured. Input and output consisted of a
ring with an alphabet and a rotatable disk
inside. The alphabet was displaced by pressing a
levergrip with the thumb. The displacement
depended on the setup of 6 small pin-wheels,
similar to those used in the C Type machines.
About 12,000 of these pocket models were sold to
different countries. The CD-57 RT is has an
option to use one-time tapes (random five bit
Hagelin goes On-line
After abandoning the TMX
all-in-one Ciphering Teleprinter prototype,
Hagelin decided in 1948 to develop the Telecrypto
Machine, an on-line crypto device, connected
between a standard teleprinter and the line,
which could encipher and decipher the telex
signals in real-time.
The first machine was designated T-52
and had 6 fixed pin-wheels and a drum with 2 x 12
slide-bars, similar to the C-36 model. The T-52 was
produced in series between 1953 and 1954. Its successor,
the T-55 used 6 interchangeable pin-wheels and a drum
with 22 slide-bars, similar to the C-52 series. The T-55
had a tape reader that could be used to perform a
superencipherment. This was a combination of the normal
enciphering with a random one-time-tape. The T-55 was in
production until 1956.
Prototypes and rare models
Hagelin did research on various
types of mechanical encryptions and developed
several different prototypes. One special version
of the C Machine was the C-36 with Autokey, which
had a second drum, connected via gears to the
indicating disk. The device never came into
production because of the problems, inherent to
the Autokey system, to recover the message when
an error during transmission occurred.
The TMX-53 was a ciphering
teleprinter but its development was stopped as
Crypto AG could not compete with major
teleprinter firms. Instead, Crypto AG focused on
the Telecrypto Machine which could be connected
to standard teleprinter machines.
An advanced electromechanical
cipher machine was developed and designated
HX-63. The HX-63 had 9 rotors with 41 circuits of
which the surplus wires were looped back on the
outside (somewhat similar to the KL-7 ADONIS).
All circuits could be rearranged and the rotors
performed irregular movements like the C-52
series. All this provided an incredible key space
of 10600. Manufacture of the HX-63 was
abandoned due to the development of fully
electronic cipher machines.
The CBI-53 was a random number
generator with a printer, which used 40 type
wheels and mixing chambers which held 26 steel
balls of which one ball was a bit larger than the
other 25 balls. After mixing, the balls were run
into a tube until the thick ball blocked the
tube. The number of balls in the tube was
measured and determined the rotation of the type
Crypto AG kept playing a
leading role in the development of new crypto
systems after the transition from mechanical and
electromechanical machines to fully electronic
crypto equipment. In the 1970s, they developed
the H-460 and H-4605 text encryption machines,
the HC-500 CRYPTOMATIC series with the text
encryption machines HC-550, HC-570, HC-580 and
the HC-520 pocket device. In the 1980s came the
HC-5205 Electronic Message Unit for use with
radio and the HC-5700 Message Workstation.
Digitalization and the Internet
brought new possibilities and challenges in the
early 1990s. Crypto AG developed a range of
network solutions such as the PSTN encrypted
HC-2203 phone, HC-4221 fax encryption, the secure
IP VPN Crypto Mobile Client HC-7835, Crypto
Desktop HC-9300 and HA-2500 encrypted VoIP
They also developed various
fixed and mobile military encryption system.
Encrypted military IP Networks for HF, VHF and
UHF, and secure satellite messaging systems, the
SECOS radio series, MultiCom HC-2650 radio
encryption and HC-2605 Terminal, the Crypto Field
Terminal all-in-one messaging system and much
The renowned Switzerland based crypto
firm, a world leader on commercial crypto equipment
throughout the Cold War, with customers in more than 120
countries, came under suspicion in the 1992 Hans Bühler
case. Iran, one of the many countries using Crypto AG
equipment, became suspicious after some of their secret
communications had leaked. Bühler, a salesman for Crypto
AG, was arrested in Iran, imprisoned and interrogated for
nine months. This was only the tip of the iceberg.
In 2014, declassified NSA documents showed
a close cooperation between Boris Hagelin, founder of
Hagelin Cryptos (later Crypto AG) and his close friend
William Friedman. Friedman, a brilliant U.S.
cryptologist, already had a career from SIS over AFSA to
chief cryptologist for NSA (National Security Agency).
Their 1950's gentlemen's agreement ensured that Boris
Hagelin would sell to "questionable states"
only crypto machines of which the message could be
decrypted by NSA. The Gentlemen's Agreement seemed to
extend into the 1990's, as the Hans Bühler case showed.
This cooperation between Crypto AG and NSA was pretty big
news in the cryptologic world.
Journalists from German television ZDF
and American newspaper The Washington Post uncovered
the last pieces of the puzzle in 2020. The CIA and the
BND (Bundesnachrichtendienst, West-German Federal
Intelligence Service) joint-purchased and took full
control over Crypto AG already in 1970. This enabled the
CIA, in coorperation with NSA, to develop unnoticeable
weakened crypto equipment, sell these worldwide and
eavesdrop on the compromised communications of many
countries for decades. Eventually, this intelligence
coup, called operation RUBICON, reached such proportions
that BND decided to pull out in 1993, making CIA the sole
owner of Crypto AG. The documents revealed that they not
only sold weakened machines to "questionable
states" but also to several NATO allies.
In 2019, just before CIA and BND
ownership and operation RUBICON came to light, Crypto AG
was liquidated and its assets temporarily transferred to
The Crypto Group (TCG), later renamed into TCG Legacy AG.
Two companies independently acquired part of the TCG
assets. CyOne Security AG, lead by three members of the
Crypto AG board, took over the Swiss part and has the
Swiss government as only customer. Crypto International
Group AB from Sweden took over the international branch
and also acquired the brand name Crypto AG. The owner of
Crypto International stated that they are a completely
different company, until recently unaware of links
between Grypto AG, CIA and BND. He plans to change the