Pin-and-lug cipher machine with irregular stepping
CX-52 was a mechanical
pin-and-lug cipher machine,
developed around 1952 by the Swede
and manufactured first by
AB Cryptoteknik in Stockholm (Sweden)
and later by Crypto AG in Zug (Switzerland).
It was intended as a replacement for earlier machines, like
the C-446 and
CX-52 has an irregular movement of the cipher wheels,
and is considered the more secure version of the C-52.
At the time, CX-52 was virtually unbreakable by the NSA.
Compared to earlier designs, it offers several improvements.
It has six interchangeable cipher wheels that can be
by pulling out the main spindle from the right side. All wheels
have a different number of divisions, or steps, or segments, which ideally
should be coprimes.
The wheels were normally black, as shown in the image on the right.
In some cases, users had six additional wheels,
which were usually white.
Of the total set of 12 wheels, six were placed in the machine
– subject to the current KEY – whilst the remaining six were
stowed in a metal container.
The machine was available in a civil (grey) and military (green) variant,
which were functionally identical. When used properly, the CX-52 was highly
secure and very difficult to break by the US
National Security Agency (NSA).
It was possible however, to set it up in such a way that it had a
short cycle (period), in which case it was easy to break.
This was fixed in the CX-52M,
which was modified by NSA
cryptomathematician Peter Jenks, to always produce a long cycle,
albeit one that was predictable by NSA. It looked safe from the outside,
but was in fact weaker than before .
For customers who did not move from the CX-52 to the CX-52M,
were available to learn them how to make 'proper' (secure)
use of the machine.
By supplying different manuals to different customers, this too
became a way of manipulating the strength in favour of the NSA.
For use in base stations, the CX-52 could be expanded with a
B-52 or B-62 keyboard unit, in which case the function of the
advance lever was taken over by a motor. This greatly improved the
throughput of the machine. The combination of CX-52 and a B-52/B-62
was known as BCX-52.
The machine was also available in a
Random-Tape (RT) version (shown above),
in which case the cipher wheels had been replaced by a
5-level tape reader.
As these machines are based on the
One-Time Tape (OTT) principle, they are
theoretically unbreakable. For this reason they were only advertised and sold
to friendly nations 1 like NATO countries, Switzerland and Sweden. This was
part of a secret deal between Hagelin
and NSA, today known as
The Gentleman's Agreement
Despite a slow start – mainly caused by the implementation of the
The Gentleman's Agreement –
the machine became very popular. By the mid-1950s, it was already used by
50 countries .
In 1970, the CX-52 was succeeded by the
Nevertheless, many of them were kept as
backups during the Cold War,
well into the 1980s — in Belgium even well into the 1990s. 2
As NSA refused to tell Hagelin which countries were on their target
list, Hagelin assumed he could also sell these machines to South
American countries, like Argentina and Brasil.
When in 1960, the CIA Licencing Agreement came into effect,
Hagelin learned that this was not the case .
During the Cold War, mechanical cipher machines were kept as backups,
as they are less prone to an electromagnetic pulse (EMP), and would
therefore survive a nuclear attack.
The diagram below provides a quick overview of the many controls and
settings of the CX-52. Note that many versions and variants exist, and
that not all controls are available on all versions. The machine is shown
here with it cover open, revealing the six removable cipher wheels (at
the front) and the revolving cage with sideways movable (sliding)
bars behind them. At the front left is a strip printer with a
settable letter wheel at the top. It is used as the input/output device.
Setting the cryptographic KEY, involves setting the pins on each of the
wheels, and inserting the selected wheels in the machine in a given order,
as instructed by the (daily) KEY sheet. Next, the MODE selector at the left
side is set to C – for ciphering – or D for deciphering.
A message is enciphered letter-by-letter, by setting the letter selection
disc at the front left to the input letter,
and operating the advance lever at the right.
The input and output letter is then printed on the paper strip at the left.
A built-in rotating knife, automatically
cuts the paper strip in two halves.
➤ Operating principle
Standard (initial) version of the machine. Very secure when used properly,
and extremely difficult to break by NSA at the time. It defeated the
existing methods for solving Hagelin ciphers. NSA tried to
persuade Hagelin not to sell these machines to denied countries,
but refused to share the denied-list with him, as NSA didn't want
to reveal its targets .
It was possible to setup this machine in such as way that it produced a short
cycle, as a result of which it became easier to break. Unwitting
users could easily select a weak key. For this reason, the CX-52
was never adopted for use by the US Army and by NATO.
This version was marketed by Crypto AG as the improved – more secure –
version of the CX-52, which always produced a long cycle (period).
The modification was developed by Peter Jenks at NSA.
In reality, the cycle was predictable, and allowed NSA to break it
This is the most secure version of the CX-52, in which the cipher wheels
are replaced by a 5-level reader for punched paper tape. It is also
known as the RT/CX or
It was only advertised and sold to friendly nations,
such as the NATO countries, Switzerland and Sweden.
When used properly, this machine is theoretically
unbreakable, as it is based on the
One-Time Pad (OTP) system.
In 1960, Hagelin sold a large batch of CX-52/RT machines to Brasil,
but this met with fierce opposition from NSA/CIA, as Brasil was on the
proscribed list (the list of countries to which secure machine had to
be denied) — which Hagelin didn't have. Hagelin acted immediately and
persuaded the Brasilians to swap the
RT-machines for the (exploitable) CX-52-M-27.
He also stopped advertising the RT-model below the Mexican border
According to the
The Gentleman's Agreement —
it controlled which machines could be sold to whom —
Hagelin had secretly designated a range of version and variant
numbers, which were not printed on the machine's label. He identified the
CX-52 as a Class-2 machine, which was more advanced than the
C-52 — a Class-1 machine. The following secret designators are known:
This model is supplied with Standard A slide bars, which
produce irregular or varying angular displacements of the key wheels,
each wheel advancing 0, 1, 2, 3, 4 or 5 steps on each operation.
It was supplied with pin-wheels 29, 31, 37, 41, 43 and 47.
This is the default and most secure version of the machine.
This model is supplied with Standard B slide bars, which
produce regular or fixed anglular displacements of the key wheels,
all advancing the same number of steps, but the number of steps may
be any one from 1 to 32.
It was supplied with pin-wheels 29, 31, 37, 41, 42 and 47.
It is weaker than the a-variant.
This model is supplied with Standard C slide bars, which makes it
backwards compatible with the older types of C-machines,
such as the M-209, the
C-446 and a certain version of the
It was supplied with pin-wheels 25, 26, 46, 42, 38 and 34, which had to
be installed in that order. It is the weakest of the models.
This is basicially a CX-52a, that is enhanced with the so-called
Complementary feature (German: Komplementär),
also known as the Hüttenhain feature. 1
This is a CX-52b, enhanced with the Hüttenhain feature. 1
This variant was built by HELL
(under licence from Hagelin) for the German and
Austrian market, for which HELL had an exclusive contract.
It is the only version that was approved by
Dr. Erich Hüttenhain 1
for use by the German Bundeswehr (Army), where it was known as the
CX-52c with Hüttenhain feature. 1
This is a 10-digit numbers-only variant of the CX-52.
These machines can be of the a, b or c type and can optionally have the
complementary feature. For example: CX-52ak/10.
This is a 30 character version of the CX-52, 2 suitable for alternative
languages – like Arabic and Russian – but also for users who required
This is the Random Tape variant of the machine,
also known as One-Time Tape (OTT).
It is the most secure version of the CX-52 and was only offered to friendly
The basic version of the machine was sold in a grey painted
enclosure. It is also known as the civil version, although the
military version was identical (apart from the colour).
Note that there are many versions and variants of this machine,
with different locks, print heads, reconfigurable letter selection
discs and with or without certain features. The version shown here
does not have the F/V selector at its left side.
The image on the right shows a military version of the CX-52.
It is identical to the standard (civil) version,
but it painted in a military green colour.
The case is locked by means of a cross-lock-and-key, whereas the civil
version has a regular cylinder lock. The version shown here has
an F/V selector at the left side (towards the rear) which is missing
from the civil version shown above.
This version support 30 character alphabets, such as Arabic and Russian,
but also extended Latin alphabets. The one shown here has the standard
26 letters of the Latin alphabet (A-Z) plus four additional markup symbols.
The machine can easily be converted for another language, by swapping the
letter ring at the front left and the double head.
➤ More information
One-Time Tape version
By far the most secure model of the CX-52 was the
Random Tape (RT) version, commonly known as CX-52/RT or RT/CX.
It a One-Time Tape (OTT) machine, or
mixer, that is based
on the principle of the One-Time Pad (OTP).
When used correctly, OTT machines are unbreakable.
This version was only advertised and sold to friendly nations,
such as all NATO countries, Switzerland, Sweden and very few others.
The image on the right shows a modified CX-52, of which part of
the body has been removed, so that the inner mechanics are
This item was found on eBay in 2009, and was probably made for
instruction purposes, or just for fun. The machine has been repainted
in blue hamerite, and the edges of the cut-out sections have been
highlighted in red.
In the mid-1950s, the
German company HELL was contracted by the
German Army — Bundeswehr — to build this CX-52 clone.
At the time, Germany was not allowed to develop its own encryption
devices, but building them under licence from a foreign developer
The machine was designated H-54.
It has has several improvements over
the original CX-52, including one that was developed by
Dr. Erich Hüttenhain,
the head of the
German cipher authority ZfCh
(and former head of OKW-Chi).
➤ More information
Over the years, many mechanical Hagelin cipher machines like the CX-52,
found their way to the Netherlands, where they were used by the Army,
the Air Force, the Navy and the Foreign Office.
In later years, when mechanical cipher machines had been replaced by
electronic ones, it became common practice to give former crypto-users
or decision makers, a silver-painted Hagelin cipher machine as a retirement
present. The one shown here was given as a farewell present to the (then)
head of the Dutch cipher authority.
B-52, B-62, B-621
The basic CX-52 is a fully mechanical device, that requires a text to
be encrypted letter-by-letter. As this is a very time-consuming task,
it was possible to use a special motor-drive with keyboard, that had
a bay for the CX-52.
The expansion, or B-unit, was mainly used in base stations
and command centres. The design faced many mechanical and electrical
problems, as a result of which there are many production variants,
designated B-52, B-62, B-621, etc.
The combination CX-52/B-52 was known as BCX-52.
Each CX-52 was supplied with six (usually black) cipher wheels, that
had 25, 26, 29, 31, 34 and 37 divisions, although other combinations
were supplied as well. It could be
extended with six further (usually white) cipher wheels,
with 38, 41, 42, 43, 46 and 47 divisions respectively.
The additional wheels were stored in a slimline metal container, such
as the one shown in the image on the right.
Maintenance tools and spares
Each CX-52 came with a set of maintenance tools and spares, such
as oil, spare lugs (tabs), spare ink rollers, screwdrivers, tweezers, etc.,
that were stowed inside the dust cover.
Depending on the exact model and variant, some tools may have been omitted.
Each CX-52 came with a blue printed manual in three languages.
Note however, that there were different manuals for each variant,
customer and/or country, and that some manuals may have been rigged,
to prevent the machine from being used properly (i.e. make it breakable).
In addition, there was a wide range of service manuals, parts lists,
application notes, leaflets, brochures, etc., some of which are available from
the Documentation section below.
➤ CX-52 documentation
The CX-52 is basically a polyalphabetic substitution cipher, based on the
Beaufort Cipher. It is very similar to the
Vigenère Cipher, but with the second alphabet in
reversed order. At the heart of the machine is a pseudo-random number
generator (PRNG), which comprises a revolving drum (cage) with 32
sideways movable bars (slide bars), and six cipher wheels (pin-wheels).
It has a twin-head printer which acts as input/output device.
After selecting the input letter, the handle is operated to set the
PRNG in motion. This causes an angular displacement of the print head.
The precise operation of the CX-52 and the many different variants and
configurations in which it was available, are clearly described in a paper
of 2021 by Bart Wessel . This paper also explains the details between the
CX-52 and the simpler C-52. Before going into details about
the inner operation of the machine, it is worth explaining a few terms, using
the image below as a guide.
The terminology is often confusing as Hagelin used different expressions over
the years, and today's collectors and curators tend to use different ones
altogether. The most important parts – highlighted in red in the image above –
are listed here, with the known alternatives in brackets:
Print head(typewheel unit) (alphabet unit) (print wheels)
Journal platecomplete assembly with pin-wheel (4) and guide arm (3)
Guide armsenses the presence of an active pin on the pin-wheel
Pin-wheel(key wheel) (keywheel) (pin disk)
Drum(cage) (bar drum)
Bar(slide bar) (sideways movable bar)
Cam(tooth) cams are used to control wheel stepping and print head rotation
Lug(bar lug) lugs are configurable and control displacement of the bars
Locking bar(top cradle) locks the guide arms when operating the machine
At the front of the machine are 6 removable cipher wheels (pin-wheels),
that can be installed in any possible order. Some machines came with an
extra set of 6 wheels, so that users could select 6 from the total set
of 12 wheels.
Each wheel has a different number of divisions, or faces, which ideally
do not share a common factor to ensure the maximum possible
cipher period. Depending on the model, a selection of 6 wheels
was supplied with the machine, taken from the full set:
25 26 29 31 34 37 38 41 42 43 46 47
Each cipher wheel is protruded by a number of configurable pins, that is
equal to the number of divisions of that wheel.
When seen from the front,
these pins can be shifted to the left (to make them inactive)
or to the right (active).
These states are also known as '0' (inactive) and '1' (active).
For this reason, a cipher wheel is also known as a pin-wheel. It is mounted
onto a vertical metal journal plate and can be rotated freely. Each segment is
numbered on the front face and the right side from 01 onwards. The total number
of divisions is imprinted on the right side of the wheel and on both sides of
the journal plate. A large cog-wheel is attached to the left side of the
pin-wheel. It is driven by a small cog-wheel, that in
turn can be driven by the cams of the slide bars.
Aside the small cog-wheel is a
spring-loaded locking pawl, that prevents the
pin-wheel from stepping when it is not actively driven by the small cog-wheel.
Like the small cog-wheel, it is controlled by the cams of the slide bars,
but never simultaneously with the cog-wheel, as that would cause the machine
to block. The spring-loaded guide arm – at the right side of the pin-wheel –
has a sensing tip
that can slip into the space of an inactive pin.
At the start of each cipherment cycle, the positions of all guide arms are
locked by the U-shaped locking bar.
Towards the rear of the machine is a revolving cylindrical drum (cage) with
32 sideways movable bars. When operating the machine with the advance lever at
the right, the drum makes one full revolution. Each bar has a series of cams
(teeth) along one of its sides. In addition, most bars have
notches on both sides to accomodate removable lugs. The cams control the
stepping of the pin-wheels, whilst the lugs and the guide arms control the
sideways displacement of the bar.
At the left end of each bar are two cams that control the stepping of the
print head. When the bar is displaced (i.e. fully to the left), the leftmost
cam extends from the drum. The drawing above shows the fictive bar number 77,
on which all features are present. 1 Read this bar as follows:
This drawing shows the space that is taken by each of the six wheels in red.
The darker red vertical lines represent the six support discs inside the drum.
It is now possible to identify the cam types, identified by Hagelin as A,
B, C and 0. The printer cams at the left are known as K.
The diagram above shows each cam, when ignoring the notches for the lugs and
limiting their size to the space of a single wheel. There are four different
cam types. Depending on the position of the slide bar – displaced or
non-displaced – the cams have the following functions:
Cam AAdvance the pin-wheel only when the bar is displaced
Cam BAdvance the pin-wheel only when the bar is not displaced
Cam CAlways advance the pin-wheel
Cam 0Never advance the pin-wheel
Cam KAdvance the print head when the bar is displaced
Each bar has a different combination of cams and is identified by a number
that is imprinted anywhere on one of its faces. Although most bars can be
fitted with lugs, there are bars that are not luggable, such as bar number
16 in the diagram below. Such bars have no notches for the lugs, and can
therefore never be displaced (and hence never cause the print head to advance).
The regular bars discussed above, all have a so-called K-cam at the left end.
This K-cam causes the print head to make a single step when the bar is displaced
(i.e. shifted to the left). According to Bart Wessel in , there are
two further bar types: one that never causes the printer to advance (the K-cam
is missing), and one that has an inverted effect (K̅). The latter
advances the print head when it is not displaced. It has a single tooth
positioned in between the two regular ones:
➤ Overview of all known bars
Note that bar 77 is a fictive bar, on which all combinations of cams are
present. This bar does not exist in real life. It is also used as an example
in Bart Wessels paper .
The drawing below shows how the pin-wheels – and indirectly the print head –
are advanced. The image shows bar 77 at several positions during the rotation
of the drum 1 as seen from the top of the machine. At the bottom are the
six pin-wheels, of which the small advancing cog-wheel is shown in red, and the
locking pawl (that prevents the wheel from advancing) is shown in blue.
When the bar arrives at the front of the machine, its cams interact either with
the (red) cog-wheel or with the (blue) locking pawl (never both).
The image shows the situation
when the bar is not displaced. Move the mouse over the image to see the effect
of the cams on the displaced bar.
Slide bar with cams — move the mouse over the image to see the bar displacement
A bar is displaced when it has a lug that is engaged by a guide arm
that is locked in place by the locking bar.
In the image above, the guide arm of the rightmost pin-wheel is shown,
in unlocked position. 2 Move the mouse over the image to see
what happens when the guide is locked and engages with the lug.
The bar in the above example shows the effect of all four possible cam types –
identified by Hagelin as 0, A, B, and C – on a displaced and non-
Note that bar 77 is a fictive bar, on which all combinations of cams are
present. This bar does not exist in real life. It is also used as an example
in Bart Wessels paper .
The guide arms of the other pin-wheels are omitted for clarity.
At the left side of the machine is a printer which acts as the
input/output device. It has a double print head, of which the leftmost
letter ring contains the alphabet in the regular order, whilst the
rightmost ring holds the alphabet in reversed order. When ciphering,
the input letter is selected with a knob on the left. It is turned
until the dial at the front points to the desired input letter.
Depending on the model/version/variant, different print head types
were supplied. There are print heads with fixed or re-arrangeable letters,
and there are units with a fixed or variable offset between the input and output
print head. The following variations in print heads are known:
Re-arrangeable print head
Each of the heads has 26 removable inserts — one for each letter of the
alphabet. This allows the alphabet to be scrambled freely. It is important
though, that the secondary head is scrambled in the same way but in reverse
order, as otherwise the machine would lose its reciprocity. Swapping
the letters of the print heads is only useful when the letters of the
indicator disc (dial) can also be swapped. The latter is not always the
case and depends on the version/variant of the machine.
If the order of the letters on the output print head is not the reverse
of the order on the input head, the machine is no longer reciprocal. This
can be solved by using a second print head which is the 'mirror' of
the first one, and swapping them when switching from ciphering to
As the print head contains only the letters of the alphabet and no SPACE,
it was common practice to trade one of the letters for the SPACE character.
This was done by setting an index pin –
fitted at the right side of the rightmost print head
– at the required letter. In this example it is set
to the letter X, which is the least frequently used letter in most
languages. Should the letter X appear in the plaintext, it could easily be
swapped for one or two other letters. Here are some examples of commonly used
SPACE characters and their replacements:
VVe.g. Spanish, Italian, French
TSe.g. English, German
When present, the F/V feature allows the user to switch between a fixed offset
of the print heads (F) or a variable one (V). In the latter case the two print
detached at the start of the ciphering cycle,
and are reconnected
once the output letter is printed. This means that for each cycle, a new
offset of the two print heads will be used. The following configurations are
When cipherig, the input letter is selected by rotating the knob at the
left side of the machine (i.e. the print head) until the pointer at the front
of the machine points to the desired letter
on the letter ring. This letter
ring is known as the indicator or dial. It is usually engraved
with the letters of the alphabet, but may also consist of
small individual circular inserts,
in which case they can be swapped. This is useful
when re-arranging the letters of the print heads (in the same order).
BC-52 Simulator for Windows
Belgian crypto-researcher Dirk Rijmenants, has created a very realistic
simulation of the BC-52 that runs on the Windows™ operating system.
The BC-52 is actually a C-52 that is seated on a B-52 keyboard, hence the
name BC-52. The software allows you to select between C-52 and CX-52 simulation,
and customize the machine in various ways. Full instructions are included
with the program.
The image on the right shows a screenshot of the BC-52 simulator
running on Windows. It can also be used on Linux (WINE) and Mac (Parallels).
➤ Download (off-site)
Below is a sound clip of a CX-52 in operation, recorded at
Crypto Museum on11 April 2021.
- The Hagelin Cryptographer, Type CX-52
User Manual in English, French and German. 36 pages.
D-035. Crypto AG, 1 January 1962.
- The Hagelin Cryptographer, Type CX-52 (photographs)
Photographs belonging to the above manual [A]. 4 pages.
Crypto AG. 16 January 1951.
- Instructions for the tape controlled cryptographer CX/RT
User Manual for the CX-52 with random tape (RT) (English). 7 pages.
No. 3165-a. Crypto AG (OST/iz), June 1968.
- Spare parts catalogue CX-52 (No 21101 etc)
Spare parts list with instructions in English, French and German. 35 pages.
L-061 (S/N 61851). Crypto AG. 1 January 1962.
- RT/CX One Time Tape auxiliary device
CX-52/RT sales brochure (English). 3 pages.
No. 3093 A. Crypto AG (Sn/hf), December 1958.
- Appareillage pour Chiffrement à Bandes Perforées
Instructions for CX-52/RT (RT/CX), B-621 and PEB-61 (French).
No. 2268. Crypto AG, Oskar Sturzinger. February 1969. 5 pages.
- Die Klaviatur B-621 (B-62)
B-621 (B-62) keyboard attachment for CX-52 (German). 14 pages (with schematics).
No. 1188a. Crypto AG, Oskar Sturzinger. June 1968.
- CX-52 Condensed Instructions
No. 3035b. Crypto AG, BH. November 1957.
- Description of Cryptographers 'Hagelin' Type CX-52
No. 3027. Crypto AG, Oskar Stürzinger, August 1956.
- CX-52 Service Instructions and Maintenance for Ciphering Machines Type CX-52
No. 3099. Crypto AG, BH, January 1959.
- Spare parts catalogue for Hagelin Ciphering Machine Type CX-52
No. L-013. Crypto AG, May 1956.
- Cryptographer type CX-52 - Specification
No. I-3006c. Crypto AG, Oskar Stürzinger, November 1957.
- Service Instructions for keyboard unit B-52
No. E-3121a. Crypto AG, Oskar Stürzinger, 12 November 1956 — July 1961.
- Ersatzteilkatalog (B-52) (spare parts catalogue)
No. L-027. Crypto AG, 10 October 1957.
- Keyboard attachment unit type B-52
No. 3052a. Crypto AG, Sn, January 1958.
- C-52 Trouble Shooting
No. 3225a. Crypto AG, date unknown.
- Usage of Hagelin cryptographer CX-52
No. <unknown>. 25 November 1964.
- Description Technique des Cryptographes Type CX-52
No. 2027. Crypto AG (BH.Sn), February 1955.
- Bedienungsanweisung für das Gerät 'CR-2' (CX-52/RT)
ZB6, BACR68, S/N 533. Bundeswehr (Germany), 1968.
- L'emploi de Bandes Aléatoires ... des Machines à Chiffrer C4 et CX-52
No. 2084-a. Crypto AG (BH/iz), February 1969.(in French langage).
- Crypto Museum, The Gentleman's Agreement
30 July 2015.
- Deavours and Kruth, Machine Cryptography and Modern Cryptanalysis
ISBN 0-89006-161-0. 1985, p. 197.
- Boris Hagelin, Die Geschichte der Hagelin-Cryptos
Original manuscript by Boris Hagelin in German language. Zug, Fall 1979. 1
- Wikipedia, Coprime integers
Retrieved February 2020.
- Crypto Museum, Operation RUBICON
- Klaus Kopacz & Paul Reuvers, Schlüsselgerät 41
Crypto Museum, 6 February 2021.
- Bart Wessel, The Hagelin Cryptographers C-52 and CX-52
Crypto Museum, 24 February 2021. ➤ Info
This story was later translated by Boris Hagelin into English. It can be downloaded here.
Any links shown in red are currently unavailable.
If you like the information on this website, why not make a donation?|
© Crypto Museum. Created: Tuesday 04 August 2009. Last changed: Tuesday, 22 June 2021 - 18:34 CET.