[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

DES-CBC brute forced.

This is relevant to the issue of selecting
bulk encryption algorithms for ESP.

[Note: I have a personal interest here - I
proposed the DES key search to RSA back in
October, and it grew out of that suggestion.
I also invented some of the techniques used.]

- Peter Trei
trei@process.com

---------------------------------------------

Forwarded message:
>From owner-deschall-announce@gatekeeper.megasoft.com Wed Jun 18
13:43:46 1997 Date: Wed, 18 Jun 1997 14:09:11 -0600 From: Rocke Verser
<rcv@dopey.verser.frii.com> Message-Id:
<199706182009.OAA06697@dopey.verser.frii.com> To:
deschall@gatekeeper.megasoft.com Subject: DESCHALL Press Release
Sender: owner-deschall@gatekeeper.megasoft.com Precedence: bulk

        INTERNET-LINKED COMPUTERS CHALLENGE DATA ENCRYPTION STANDARD

     LOVELAND, COLORADO (June 18, 1997).  Tens of thousands of
computers, all across the U.S. and Canada, linked together via the
Internet in an unprecedented cooperative supercomputing effort to
decrypt a message encoded with the government-endorsed Data Encryption
Standard (DES).

     Responding to a challenge, including a prize of $10,000, offered
     by
RSA Data Security, Inc, the DESCHALL effort successfully decoded
RSADSI's secret message.

     According to Rocke Verser, a contract programmer and consultant
     who
developed the specialized software in his spare time, "Tens of
thousands of computers worked cooperatively on the challenge in what
is believed to be one of the largest supercomputing efforts ever
undertaken outside of government."

     Using a technique called "brute-force", computers participating
     in
the challenge simply began trying every possible decryption key. 
There are over 72 quadrillion keys (72,057,594,037,927,936).  At the
time the winning key was reported to RSADSI, the DESCHALL effort had
searched almost 25% of the total.  At its peak over the recent
weekend, the DESCHALL effort was testing 7 billion keys per second.

     Verser considers this project to be remarkable in two ways:

     One.  This is the first time anyone has publicly shown that they
can read a message encrypted with DES.  And this was done with "spare"
CPU time, mostly from ordinary PCs, by thousands of users who have
never even met each other.  U.S. government and industry will have to
take a hard look at their cryptographic policies.  "DES can no longer
be considered secure against a determined adversary", Verser said.

     Two.  This project demonstrates the kind of supercomputing power
that can be harnessed on the Internet using nothing but "spare" CPU
time.  "Imagine what might be possible using millions of computers
connected to the Internet!"  Aside from cryptography and other obvious
mathematical uses, supercomputers are used in many fields of science.
"Perhaps a cure for cancer is lurking on the Internet?", said Verser,
"Or perhaps the Internet will become Everyman's supercomputer."


     Under current U.S. government export regulations, and
     underscoring
a problem faced by the U.S. software industry, the program that
searched the keys could not be exported, except to Canada.  A
competitive effort, based in Sweden, sprang up well after the DESCHALL
effort began.  Able to "market" their keysearch software around the
world, the Swedish effort caught up quickly, and had searched nearly
10 quadrillion keys by the end of the contest.

                   ------------------------------------

     Verser agrees with the sentiment voiced in RSADSI's secret
     message:
"Strong cryptography makes the world a safer place."

     Use of strong cryptography, both domestically and
     internationally,
is essential in today's electronic world.  "But not at the expense of
a citizen's right to privacy."  Verser adds, "Recent proposals for
'key-recovery' and for criminalization of the use of cryptography have
no place in a free society."


     Information about the DESCHALL effort is available from the
official DESCHALL Web site at: 
<http://www.frii.com/~rcv/deschall.htm>



MEDIA CONTACTS:
      Matt Curtin, (908) 431-5300 x 295,
      <cmcurtin@research.megasoft.com>

ALTERNATE:
      Rocke Verser, (970) 663-5629, <rcv@dopey.verser.frii.com>

ALTERNATE:
      Justin Dolske, (614) 459-5194, <dolske.1@osu.edu>

                                    - 30 -
Follow-Ups: