Mechanical Code Unit

A mechanical code unit (MCU) is an electromechanical code-storage device used to enforce surety, confidentiality, and tamper-evidence of the use of highly sensitive cryptographic material, such as that used to perform permissive actions like launching a missile. The first MCUs were developed by the United States in the 20th century as part of the Minuteman missile system, but MCUs were later independently developed by other countries due to their effectiveness.

MCUs store their code material as a series of rotating discs with positions that can optionally be spring-loaded to provide a one-time-use capability. When the MCU is turned and activated, the discs rotate and engage with a series of microswitches, allowing the read-out of the code. Normally the turning is performed by an operator rotating a physical switch (for example, on a launch panel) but for special applications MCUs can be integrated within a system where the turning is automated; this is common where electrical isolation between two systems is necessary. MCUs are also tamper sealed and equipped with tamper response systems to destroy the coding if the enclosure is opened in an attempt to compromise it. There are many MCU variants, which can all be combined with one another.

Variants

Key-type

Key-type MCUs are a variant of MCUs that require a physical key to be inserted inside of the code unit and turned to complete the code, replacing the normal switch-turn action in regular MCUs. Effectively, they mechanically read the key bitting, translating it into the other half of the code. The same bits used as part of the locking mechanism to normally stop the key from turning are not the same as those in the actual code, preventing the key's part of the code from being trivially recovered from the locking mechanism.

One-time-use

Some MCUs may be one-time-use to ensure any tampering is visible and cryptographic material is never re-used. When this kind of MCU is used and the switch is released again, the coding of the unit is mechanically zeroized. Thus the cryptographic material is permanently destroyed and the unit is both internally and externally evident of use. To be put back in service, the unit then must be rekeyed. For example in Facility Termination System vaults, all manual switches - enable, fire, and abort - are of this one-time-use type.

Gated

Gated MCUs have a "gate" that keeps the switch in the closed position until the action is complete; normally hand-operated MCUs are spring-loaded, so they automatically return to the SET (or CODE USED) position when released. Gated MCUs are useful when the code needs to be available for multiple operations, instead of just one decisive operations, such as a launch. The "gate" may be manual or automatic; that is, the operator may either need to manually release it or there might be some electrical signal generated by a control system that drops the gate when all actions are complete.

Remote load

Some MCUs may provide the ability for a "remote load" action - that is, to allow the use of a code that is supplied externally rather than using and consuming the code within the MCU. For example, this is used within the enable switch in FTS vaults; during normal operations, the enable switch is turned to the left to the REMOTE LOAD position instead of to the ENABLE position on the right. When the MCU is used in this way it only opens a data channel to allow the remote code to be loaded and does not use or consume its own internal cryptographic material.