The keyboard-driven rotor machines didn't scale up well. Beyond three rotors, motor drive was usually needed, although the cute little M-209 used a wheel and lever for input, rather than a keyboard. The next step up was the Lorenz SZ-40/42, a six-rotor machine set up as a peripheral for a Teletype. That was cracked with the Colossus electronic key-tester.
The Germans built the T-52 Geheimschreiber, with 10 rotors, but that had a built-in Teletype machine and was too heavy to be portable. The Allies didn't crack that one.
That was the original limit on key length. The longer the key, the bigger and heavier the machine.
I was lucky enough to get to play with one of these things when a lecturer from the Bletchley Park foundation toured here some years back. She gave a fascinating and riveting talk on the history of the device.
I was surprised to hear that these were actually commercially available before the war, and that the allies had quite a few of them in store already. The crucial thing they were after were the booklets with the daily rotor and plugboard settings - far more valuable than the machines themselves.
The real game was the Lorenz-stye encryptors that were used for communications between German commands. These delivered the strategic information about mid-to longterm movement of units and so on which allowed they Allies to correctly anticipate attacks. These were the messages that Colossus was used to decrypt, as opposed to the Bombes which were decrypting Enigma traffic, and which were largely derivative of earlier Polish efforts to decrypt Enigma.
I read a book a while back https://www.goodreads.com/book/show/1127838.Colossus that looks at all of this in detail. Surprisingly, if the book is correct, Turing seemed to have limited contact with the Colossus effort, and was more involved with the Enigma decryption. The Colossus people didn't seem to be terribly occupied by ideas such as Turing-completeness, they were just building machines that were capable of doing certain operations at high speed.
Those were, from what I hear, much harder to break, thus the efforts to capture the code books and devices from the U-boats.
The reflector essentially routed the signal path back through the rotors again, which the Germans thought made the device even harder to decrypt. However, the wiring involved essentially meant that the same letter typed could NEVER be represented by itself once encrypted. (e.g. a raw 'A' could never come out encrypted as 'A' etc.).
This n-1 weakness meant that allied cryptographers could eliminate options by a large factor when running decrypting routines.
Also, the Germans would routinely ask their field operators to send long random garbage transmissions in order to soak up the time and energy of the allied decrypting teams.
However, human nature took over, and a lot of operators were simply too lazy to hit random keys on the device, but instead would repeatedly press the same key (usually the 'L' key which was the lowest key on the right of the keyboard) while chatting to their colleagues.
Thus when the allied cryptographers saw a long transmission which never contained the letter 'L', they knew it was a 'dummy lazy transmission', and they could use 'LLLLL...' as the crib which made cracking that day's Enigma code so much simpler.
An astonishing example of when a tactic to try and make things harder to crack actually made it easier to do so (with the assistance of human frailties).
Bletchley Park has a machine on display as well, and also hosts the Bombe machine which was used to crack Enigma codes during the war. It used motors to drive copies of the rotors in Enigma in order to find a "short circuit" (where one letter coded back to itself) since this would indicate the starting point was invalid. The rotors would then tick one over and start again. The reason for so many columns was that each column of three was a different stating point - in effect, base 26 counters where each 3-digit number was started from a different number. To account for different rotor combinations and choices there were 20 or so machines built each corresponding to a different rotor choice (ABC, ABD, ABE, ACB, ACD etc). In fact it didn't just use the reflexive lookup for short circuiting; the cryptanalysts produced "cribs" which were hypothesised guesses of loops; if R-S, and S-T and T-R then this would be another short circuit option. The bombe was "programmed" with such cribs mechanically (leads plugged in to simulate connections) and then set to run. Since this process changed at midnight each day they would do the same thing day after day.
Round the corner from Bletchley Park is the National Museum of Computing http://tnmoc.org which although on the same site is a different organisation. They have the Colossus machine which was used to break the Lorenz cypher, and was the first programmable electronic computer (although the program was wired in in hardware, in effect a manual ROM).
It's well worth going to see both of these if you ever happen to be in the Milton Keynes area, or if you're passing through London - it's half an hour away by train.
