Beta

Slashdot: News for Nerds

×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

New Attack Against Multiple Encryption Functions

kdawson posted more than 5 years ago | from the think-harder dept.

Security 130

An anonymous reader sends word of a paper presented a few days back by Adi Shamir, the S in RSA, that promises a new form of mathematical attack against a broad range of cryptographic ciphers. The computerworld.com.au report leans heavily on Schneier's blog entry from the Crypto 2008 conference and the attached comments. Shamir's paper has not been published yet. "[The new attack could affect] hash functions (such as MD5, SHA-256), stream ciphers (such as RC4), and block ciphers (such as DES, Triple-DES, AES) at the Crypto 2008 conference. The new method of cryptanalysis has been called a 'cube attack' and formed part of Shamir's invited presentation at Crypto 2008 — 'How to solve it: New Techniques in Algebraic Cryptanalysis.' The new attack method isn't necessarily going to work against the exact ciphers listed above, but it offers a new generic attack method that can target basically formed ciphers irrespective of the basic cipher method in use, provided that it can be described in a 'low-degree polynomial equation'... What may be the biggest outcome from this research is the range of devices in widespread use that use weaker cryptographic protection, due to power or size limitations, that are now vulnerable to a straightforward mathematical attack."

cancel ×

130 comments

ehm (-1, Offtopic)

pakar (813627) | more than 5 years ago | (#24705833)

oops

Re:ehm (5, Informative)

moderatorrater (1095745) | more than 5 years ago | (#24705937)

The summary is blatantly wrong. Take a look at the schneier blog post (from 3 days ago) and the second update: this attack only works against LSFR encryption of a low order, which means that none of the schemes mentioned in the summary are actually affected.

Now, if I were to actually RTFA, I would know whether the article was slow on the uptake or slashdot, and whether or not they should have known that the attack wouldn't affect the major algorithms, just smaller ones. Either Slashdot's dead wrong on this or computerworld is, and I'm not sure which one's more likely.

disgusting fatbodies (-1, Flamebait)

Anonymous Coward | more than 5 years ago | (#24706037)

I am so sick of all the disgusting fatass fatbodies waddling around. Bovine sheeple motherfuckers who cant even watch where theyre walking when theyre moving around their rolls of fat bulk. IT'S DISGUSTING! Put the fork down you fatasses. The only thing worse than their horrible disgusting fatass sweaty bodies is their loser attitude that never exercising and eating until they have rolls of fat and two chins is somehow not their fault. Yeah I guess the fast food restaurants made you do it you lazy sack of shit. How about you fatasses wake up and realize that you're fatasses and that one of the more useful things you can do is stay the fuck out of the way of anyone whos not a fatass. Tired of waiting for some porker to move her gigantic blubbery bulk who shouldnt have been blocking a fucking DOORWAY to chitchat to her fat friend to begin with.

Re:disgusting fatbodies (5, Funny)

thedonger (1317951) | more than 5 years ago | (#24706645)

I'm sure this post is encrypted...If only there were a way to use Schneier's algorithm...Wait...Got it! Here is the decrypted text:

Yes, I agree with moderatorrater. It appears Slashdot was jumping the gun. I like to ride mopeds.

Re:disgusting fatbodies (0)

k1e0x (1040314) | more than 5 years ago | (#24707197)

I'm sure this post is encrypted...If only there were a way to use Schneier's algorithm...Wait...Got it! Here is the decrypted text:

Yes, I agree with moderatorrater. It appears Slashdot was jumping the gun. I like to ride mopeds.

It is, but unfortunately he is using ROT26.

Re:disgusting fatbodies (1)

Hurricane Floyd (891704) | more than 5 years ago | (#24708255)

WTF? He said he likes to mop, not mopeds, get your decryption right.

Re:ehm (2, Informative)

beckerist (985855) | more than 5 years ago | (#24706057)

So long as there are ways to decrypt, there will always be a way to "attack." It isn't necessarily the fault of the algorithm either. Prime example: social engineering.

Re:ehm (1)

SoVeryTired (967875) | more than 5 years ago | (#24706729)

The obvious solution to this problem is to develop an un-decryptable cypher.
Behold:

AME33u899##d8909iksalel!

Re:ehm (5, Funny)

MightyMartian (840721) | more than 5 years ago | (#24706905)

Nonsense. The real solution is to get a court order banning the guy from giving his presentation. After all, as has been demonstrated just recently, court orders are the preferred means of securing anything.

Re:ehm (1)

beckerist (985855) | more than 5 years ago | (#24709835)

aq4jhfg80q34tru92q34wv354rgq3giehjgbpoe
=Then what's the point? (Couldn't decipher it could you?!)

Re:ehm (1)

NetNinja (469346) | more than 5 years ago | (#24706157)

FUD!

Re:ehm (4, Funny)

Thelasko (1196535) | more than 5 years ago | (#24706197)

Does this mean, can I finally recover the data encrypted by the Gpcode virus? [slashdot.org]

Re:ehm (2, Interesting)

wirelessbuzzers (552513) | more than 5 years ago | (#24707419)

There was a rump session talk on Gpcode, actually. It was suggested that if you had enough porn and/or music on your computer (tens of thousands of files with known headers, I believe), an attack on RC4 would recover your disk. It's related to the attack that breaks WEP. I don't know if it's been implemented.

Re:ehm (4, Funny)

UncleTogie (1004853) | more than 5 years ago | (#24708981)

"Honey, we've simply GOT to have all this porn.... to recover our hard drive!"

Kudos to the individual that can pull THAT line off...

Ha! I'm immune! (5, Funny)

DikSeaCup (767041) | more than 5 years ago | (#24705853)

I store all of my passwords in plain text!

Re:Ha! I'm immune! (5, Funny)

oahazmatt (868057) | more than 5 years ago | (#24706563)

I do one better. I use inkblot tests. I can leave them in plain sight and their totally secure.

Co-worker: Your password is "flower"?
Me: What? No. It's "zombie clown hitting fish with hammer". What's wrong with you?

Re:Ha! I'm immune! (1)

norminator (784674) | more than 5 years ago | (#24708025)

Some security... you have just become a victim of social engineering. If you have to correct people who misinterpret your inkblots, your security is even weaker than with a simple 4 letter all lower case numeric-only password... like 1-2-3-4.

And now to log into your /. account with "zombie clown hitting fish with hammer" as the password...

Hold on, I've got to get this out of my system (4, Funny)

sabre86 (730704) | more than 5 years ago | (#24708925)

...password ... like 1-2-3-4.

So the combination is one, two, three, four, five? That's the stupidest combination I've ever heard in my life! The kind of thing an idiot would have on his luggage!

Apologies to Rick Moranis and Mel Brooks. [imdb.com]

That said, what's the difference between lower case numbers and upper case numbers?

--sabre86

Re:Hold on, I've got to get this out of my system (0)

Anonymous Coward | more than 5 years ago | (#24710537)

Depends on your keyboard layout--
1234567890
!@#$%^&*()

Re:Ha! I'm immune! (0)

Anonymous Coward | more than 5 years ago | (#24708773)

This really isn't a bad idea. Didn't Slashdot have a story about Microsoft publishing a paper backing this idea up?

Re:Ha! I'm immune! (2, Funny)

Alsee (515537) | more than 5 years ago | (#24709839)

Wow! Cool! Me too! I have 5 different inkblots for logging into five different systems.

All five passwords are "Boobies".

-

Re:Ha! I'm immune! (1)

ewhac (5844) | more than 5 years ago | (#24710689)

"An elephant wearing a hat."

Re:Ha! I'm immune! (5, Funny)

iminplaya (723125) | more than 5 years ago | (#24706667)

Me too. It's ******

Re:Ha! I'm immune! (5, Funny)

jam244 (701505) | more than 5 years ago | (#24706699)

Your password is hunter2?

Re:Ha! I'm immune! (3, Funny)

MooseMuffin (799896) | more than 5 years ago | (#24706911)

No you moron, that's my password!

CUBES (0)

Anonymous Coward | more than 5 years ago | (#24705865)

ATTACK!

Re:CUBES (2, Funny)

Kiaser Zohsay (20134) | more than 5 years ago | (#24705993)

FOR GREAT JUSTICE!

Re:CUBES (1)

sexconker (1179573) | more than 5 years ago | (#24707597)

AND MASSIVE DAMAGE!

svefg cbfg! (0)

Anonymous Coward | more than 5 years ago | (#24705883)

svefg cbfg!

Re:svefg cbfg! (0)

Anonymous Coward | more than 5 years ago | (#24706035)

LBH SNVY VG

news at 11? (0, Redundant)

Zironic (1112127) | more than 5 years ago | (#24705901)

Low degree polynomals are relatively easy to crack, news at 11?

I thought most people used RSA nowadays because of it's mathematical ubreakability. (Huge polynomal):

Breaking of the stream ciphers can be a problem though.

Re:news at 11? (0)

Anonymous Coward | more than 5 years ago | (#24706225)

If you think that low degree polynomials are easy to crack, then prove it by giving all 4 solutions to

x^2 = 1 mod RSA-1024 [wikipedia.org] .

Re:news at 11? (2, Insightful)

MrNaz (730548) | more than 5 years ago | (#24706985)

Solution 1: x = 1
Solution 2: x = -1
Solution 3: x = BUFFER OVERFLOW
%#$%#%#%#%##%%$$

Re:news at 11? (1)

sexconker (1179573) | more than 5 years ago | (#24707651)

uh...

X^2 = 1 % big number.

big number > 1; 1 % big number = 1.

X^2 = 1 % big number == X^2 = 1

X^2 = 1

X = +/- 1 ?

What?
What voodoo are you assuming that gets 4 solutions?

Re:news at 11? (1)

GodKingAmit (1192629) | more than 5 years ago | (#24708173)

Because there are many solutions to m mod n? Example X^2 = 1 mod 8 One solution: X^2 = 1, X = +/- 1 Another solution X^2 = 9 = 1 mod 8 X = +/-3 Etc ...

Re:news at 11? (1)

geekgirlandrea (1148779) | more than 5 years ago | (#24709825)

RSA is a public-key cipher. They usually don't get used directly because they're much more expensive computationally than AES and the like, and potentially vulnerable to chosen-plaintext attacks. Real protocols like SSL typically use a public-key cipher like RSA or DSA to negotiate a shared secret key and perform authentication, and then switch to a symmetric cipher like AES or IDEA.

borg cube attack! (0, Offtopic)

Afrix (1208072) | more than 5 years ago | (#24705905)

only fractal encryption can save us now!

DES, AES, Blowshifh, twofish likely immune (3, Informative)

Hoplite3 (671379) | more than 5 years ago | (#24705939)

See Schneier's blog. No word on MD5, which is extremely common.

Re:DES, AES, Blowshifh, twofish likely immune (3, Informative)

Cyberax (705495) | more than 5 years ago | (#24705997)

MD5 is already completely broken: http://en.wikipedia.org/wiki/MD5#History_and_cryptanalysis [wikipedia.org]

Re:DES, AES, Blowshifh, twofish likely immune (1)

dubbreak (623656) | more than 5 years ago | (#24706247)

True, but that doesn't make the summary any more accurate.

depends what you're using it for (0)

Anonymous Coward | more than 5 years ago | (#24708101)

Wikipedia mentions a certificate scenario. How about reversing hashtext back to a passphrase for free? No, didn't think so.

Re:DES, AES, Blowshifh, twofish likely immune (5, Informative)

Anonymous Coward | more than 5 years ago | (#24709301)

While finding collisions quickly does indeed show MD5 has weaknesses, no one has found a efficient way to match an existing checksum. For most that's the definition of completely broken.

Nice use of language (3, Informative)

gazbo (517111) | more than 5 years ago | (#24705965)

Contrast:

[The new attack could affect] hash functions (such as MD5, SHA-256), stream ciphers (such as RC4), and block ciphers (such as DES, Triple-DES, AES)...The new attack method isn't necessarily going to work against the exact ciphers listed above

With:

Okay, he thinks that AES is immune to this attack...And this attack doesn't apply to any block cipher -- DES, AES, Blowfish, Twofish, anything else -- in common use

Slight shift in implications, dontchathink?

Correct the summary/FUD (5, Informative)

trifish (826353) | more than 5 years ago | (#24706011)

As Schneier wrote (emphasis mine): "this attack doesn't apply to any block cipher -- DES, AES, Blowfish, Twofish, anything else -- in common use; their degree is much too high." Now, correct the misleading summary (or be uninformed FUD spreader like Computerworld).

Re:Correct the summary/FUD (2, Interesting)

Kjella (173770) | more than 5 years ago | (#24706577)

Here's the bane of reliable internet news. I now predict have a kazillion stories like "OMG the sky is falling" on the news sites I visit because they produce way more hits than "completely irrelevant theoretical crypto-attack found". It's really that simple, I think even if they KNOW the story is bogus it's better to get the headliner and then make a "correction" later.

Re:Correct the summary/FUD (1)

trifish (826353) | more than 5 years ago | (#24706725)

Yes. The sad truth is that even the researchers themselves engage in FUD spreading. It is much easier to get publicity if you claim "I can break anything (but wait 2 weeks for the full details)." When those full details are revealed (i.e. the fact that there is no real attack is implicitly contained in the paper) it is already too late to undo the FUD. Nobody really cares.

Re:Correct the summary/FUD (5, Informative)

secPM_MS (1081961) | more than 5 years ago | (#24706609)

The "low degree" here may be a bit higher than most readers suspect. The abstract I have for the talk is:

ABSTRACT: In this talk I will describe a new algebraic attack which is very powerful and very general. It can solve large systems of low degree polynomial equations with surprisingly low complexity. For example, solving dense random-looking equations of degree 16 in several thousand variables over GF(2) (which correspond to many types of LFSR-based stream ciphers) can now be practically done in less than 2^{32} complexity by the new technique.

That said, the algebraic degree associated with modern block codes is far beyond this. The possible uility of such approaches in reducing the complexity of collision generation in hashes is yet undetermined.

Re:Correct the summary/FUD (3, Interesting)

CodeBuster (516420) | more than 5 years ago | (#24707259)

That said, the algebraic degree associated with modern block codes is far beyond this.

Would not a modern block cipher, AES for example, be of at least order 128 or possibly higher with at least as many variables? It was also mentioned in the summary of TFA that older or lower power devices might be vulnerable, but really where are these devices being used right now? It has been my experience that if something is encrypted at all (i.e. someone actually bothered to think about security) then a stronger algorithm is generally selected (AES, 3-DES, Twofish, etc...); otherwise, and this happens all too often, encryption is simply not employed even though it easily could have been and probably should have been.

Re:Correct the summary/FUD (3, Informative)

swillden (191260) | more than 5 years ago | (#24708465)

Would not a modern block cipher, AES for example, be of at least order 128 or possibly higher with at least as many variables?

No. When you convert a cipher into a set of polynomial equations, the degree is dependent upon internal details of the cipher. It has nothing to do with the number of bits in the key. For example, I can make a cipher with a 1000-bit key, but a structure that is so simple that it can be represented with a linear function -- degree 1.

Re:Correct the summary/FUD (1)

trifish (826353) | more than 5 years ago | (#24707739)

Your post, sir, is as misleading as the Computerworld article. Was the ambiguity in it deliberate or unintentional? I hope the latter.

Re:Correct the summary/FUD (1)

Eighty7 (1130057) | more than 5 years ago | (#24707807)

.. (or be a uninformed FUD spreader like Computerworld)

That was completely uncalled for. What has Computerworld done to deserve being compared to kdawson?

Re:Correct the summary/FUD (1)

fermion (181285) | more than 5 years ago | (#24708583)

further comments suggest that it might be used against systems with weaker protection, such as HDTV, bluetooth, mobile telephone networks. So no, the secure stuff is still secure. In any case, the secure stuff is seldom broken by breaking the encryption. The secure stuff is broken by social and other backdoor attacks.

Re:Correct the summary/FUD (1)

ksd1337 (1029386) | more than 5 years ago | (#24711065)

Well, seeing as kdawson is the editor, I'm not surprised at the summary's inaccuracy.

Elliptic Curve (0, Redundant)

extirpater (132500) | more than 5 years ago | (#24706029)

i'm wondering if elliptic curve cryptography vulnerable to this kind of attack since it's about polynomial equations.

Re:Elliptic Curve (1)

Zironic (1112127) | more than 5 years ago | (#24706111)

Everything uses polynomial equations, what matters is the degree. Elliptic curve crypyography uses really high degree polynomials so you don't have to worry.

the S (0)

Anonymous Coward | more than 5 years ago | (#24706041)

I thought the S in RSA stood for 'simple'. As in Really Simple Ancryption.

Re:the S (1)

NatasRevol (731260) | more than 5 years ago | (#24706391)

Really Simple Acronyms.

Was that so hard?

Re:the S (1)

MrNaz (730548) | more than 5 years ago | (#24707025)

Was that NP hard?

Was that so hard?

Use two different encryption methods. (1, Redundant)

Futurepower(R) (558542) | more than 5 years ago | (#24706087)

My understanding is that this is the big issue about mathematical attacks: They depend on the encryption method. If you merely encrypt things more than once, using two or more different encryption methods, the chances there will ever be a successful mathematical attack are very, very small.

I have an enormous amount of respect for Bruce Schneier, but his writing is designed to get him business, not to give easy answers to big problems.

I recommend GNU Privacy Guard [gnupg.org] .

Re:Use two different encryption methods. (3, Informative)

Zironic (1112127) | more than 5 years ago | (#24706185)

Well, they rely on knowing what method you used but so does any cryptography attack, it's impossible to create an attack that can target any encryption since it's impossible to tell the difference between something encrypted and random noise.

So if the attacker knows you're using two different methods he just has to crack them both one at a time. It's not terribly different from knowing you use one method.

What you're doing is just attempting to practise security through obscurity when you layer encryption on encryption.

I think we agree. (1)

Futurepower(R) (558542) | more than 5 years ago | (#24706837)

I think my point is correct: It is very unlikely that two different very strong encryption methods will be cracked at the same time. So using two or more, even if the methods and their order are known by an attacker, provides protection against attack.

You said, "... it's impossible to create an attack that can target any encryption..." That's part of what I was saying.

And my comment should not have been moderated Redundant, since all the comments posted before it were just junk when it was posted.

Re:Use two different encryption methods. (0)

Anonymous Coward | more than 5 years ago | (#24708217)

Sorry, that's absurd. It's a great tradtion in crypto forums to denigrate the idea of using two ciphers in series - IMO because that is the LAST thing an intel service that can (at a cost) break one cipher, wants people doing. Can we say, crypto astroturf?

The facts: Superencipherment - encrypting data with one cipher and key, then encrypting the ciphertext with a different cipher and key - does not double the keyspace search for an attack - it raises it exponentially. The same applies not only to brute force attacks, it also applies to the complexity of /any/ solution to the ciphertext in question.

So for instance using 3DES with a 160 bit key, then enciphering the output with AES using a different, 256 bit key, is approximately equivalent to using a cipher with a key space of 160^256 bits.

Re:Use two different encryption methods. (2, Funny)

TMB (70166) | more than 5 years ago | (#24706317)

That's why I use rot13 not once, but twice!

Re:Use two different encryption methods. (1)

pjt33 (739471) | more than 5 years ago | (#24709181)

I use it three times, in encrypt-decrypt-encrypt mode. It works for DES, so it must be good!

Re:Use two different encryption methods. (3, Insightful)

moderatorrater (1095745) | more than 5 years ago | (#24706731)

I have an enormous amount of respect for Bruce Schneier, but his writing is designed to get him business, not to give easy answers to big problems.

umm, easy answers to big problems? There are none, sir, and while bruce does occasionally plug his own products, I've never thought that he was just into it to make money. Reading his blog is the most informative part of my day.

Besides, we all know that his real reason for blogging is to help squid become the dominant species on the planet like they were intended to be.

Re:Use two different encryption methods. (1)

Detritus (11846) | more than 5 years ago | (#24708761)

Bad assumption. The composition of two ciphers can be treated as a third cipher, which may not be any stronger than its parents, and can even be weaker. The attacker is not obligated to solve the system in the same sequence that was used to encrypt the plaintext.

Re:Use two different encryption methods. (1)

Vellmont (569020) | more than 5 years ago | (#24709465)


If you merely encrypt things more than once, using two or more different encryption methods, the chances there will ever be a successful mathematical attack are very, very small.

Maybe. The fact that nobody really does this is a strong indication that this isn't as good a solution as you might think it is though.

The encryption algorithm itself is likely the strongest part of your whole system anyway. Most of the time the attacks on the system don't completely break it open and make it useless. The weak parts are the software implementation of the system, key exchange, and simply the human beings involved. The encryption algorithm is just one part of the entire system.

I have an enormous amount of respect for Bruce Schneier, but his writing is designed to get him business, not to give easy answers to big problems.

So if you can't attack his ideas, attack his motivation? I don't know that anyone has come up with easy answers to the big problems of security. Are you really implying that there exists simple solutions that a select few know about, but are (for some reason) keeping secret from everyone else?

Quick, apply DMCA! (2, Insightful)

Anonymous Coward | more than 5 years ago | (#24706091)

Ban the Math, it's a circumvention tool.

Re:Quick, apply DMCA! (1)

k1e0x (1040314) | more than 5 years ago | (#24707113)

Yeah, thats funny. :)

It's like saying "Quick we need a law against this math, that will get rid of it!"

Some quick thoughts (1)

Ex-Linux-Fanboy (1311235) | more than 5 years ago | (#24706141)

I'm no crypto guru, but I have read Schneier's Applied Cryptography and have read various papers describing cryptographic primitives. Looking at the blog entry (yes, I do read Slashdot for its articles), the paper hasn't been published yet. We don't know, at this point, whether this is a theoretical attack or a practical attack.

It doesn't affect AES; it may or may not affect RC4, which is pretty widely used. What it appears to affect is Radio Gatun, a nice, fairly new construction that can either be a hash or stream cipher, taking a key of any length. Radio Gatun is nice because its core can fit in under 2k of memory and it's an elegant, extensible construction.

However, scanning the paper [noekeon.org] describing the function, I note the quote "It has algebraic degree 2" on page 10. So it looks like a nice, small elegant cryptographic primitive has fallen.

The synopsis stated "low grade" crypto (4, Interesting)

billsf (34378) | more than 5 years ago | (#24706229)

An order of magnitude improvement in cracking a 56bit key would be significant. However, most of us use far greater key-spaces and only flaws in the crypto itself or the container is the real threat. It is however interesting when anybody can make a massive improvement in cryptoanalysis. A 10x improvement would make cracking 40bit 'consumer-grade' (such as GSM and DECT) crypto trivial on the latest processors. The most likely application is to give governments easy access to snoop 'private' phone and data conversations.

This is not threatening to me at all. I don't really see the need to encrypt phone calls in the first place. It is absolutely essential to encrypt other data. This seems to be because there is a social taboo about tapping phones, but not so much so with data. Therefore all system admins must use SSH and others should consider it too.

The real threat is the quantum computer, if it exists in a practical form. If that is the case, there is one complete solution -- The awkward 'one-time pad'.

Re:The synopsis stated "low grade" crypto (5, Insightful)

eudaemon (320983) | more than 5 years ago | (#24706469)

The reason to casually encrypt phone calls or any other data is to prevent the casual snooping of same.

Look at this way -- the barrier to entry for snooping your data is very low, and getting lower with each
new executive order. On the other hand the barrier to entry on snooping your data can be set arbitrarily high;
you can choose anything from 56 bit single-DES to 2048 bit RC4. The effort required to casually snoop you for
no other reason has now exploded. It was fear of people adopting this strategy and blocking the casual snooping
that inspired the clipper chip. It was the people's laziness, ignorance or both towards protecting their privacy
and their fear of terror that has eroded any expectation of privacy now, which is truly unfortunate.

If we had an expectation of privacy in this country, I think things would be very different now with regards to
all the second order effects such as identity theft.

Re:The synopsis stated "low grade" crypto (1)

psydeshow (154300) | more than 5 years ago | (#24710333)

The barrier to entry for snooping your data is very low, and getting lower with each
new executive order. On the other hand the barrier to entry on snooping your data can be set arbitrarily high;
you can choose anything from 56 bit single-DES to 2048 bit RC4.

I find this point fascinating, actually. It has never been easier to provably hide information, even as the social safeguards protecting privacy are being systematically dismantled.

In some ways, each of those Executive Orders is doing us a favor, by telling us again and again, "Encrypt your communications, or keep your trap shut."

Re:The synopsis stated "low grade" crypto (1)

Hal_Porter (817932) | more than 5 years ago | (#24706999)

A 10x improvement would make cracking 40bit 'consumer-grade' (such as GSM and DECT) crypto trivial on the latest processors. The most likely application is to give governments easy access to snoop 'private' phone and data conversations.

Governments either tap unencrypted GSM conversations at the basestation or have custom hardware to break 40 bit encryption. Or both probably.

Re:The synopsis stated "low grade" crypto (1)

thogard (43403) | more than 5 years ago | (#24707105)

40 bit DES is already in the realm of home machines. The problem isn't trying all the 2^40 key combinations but detecting when one of them gives you the right key. If you know the plain text is most likly ASCII, then you can check that the top bits of a block are all zeros but then you still have to have another way to process the 2^32 results that pass the 1st test. The more you know about the plain text the more false results you can discard but there still may be loads of other keys that might look right until you get to the next block depending on the chaining method.

Imagine (1)

joeflies (529536) | more than 5 years ago | (#24707177)

Imagine a beowoulf cluster of quantum computers!

Re:The synopsis stated "low grade" crypto (0)

Anonymous Coward | more than 5 years ago | (#24707331)

Is it just me or does the "one-time pad" sound like a feminine hygiene product?

Re:The synopsis stated "low grade" crypto (1)

93 Escort Wagon (326346) | more than 5 years ago | (#24707991)

The real threat is the quantum computer, if it exists in a practical form. If that is the case, there is one complete solution -- The awkward 'one-time pad'.

I use a "one-time pad" for all my account logins.

A Post-it note counts as a one-time pad, right?

Re:The synopsis stated "low grade" crypto (1)

swillden (191260) | more than 5 years ago | (#24708557)

The real threat is the quantum computer, if it exists in a practical form.

Incorrect. No one has demonstrated any way to use a quantum computer (even if one existed) to break a symmetric block cipher like AES or DES. Shor's algorithm allows a quantum computer to factor large numbers quickly, which would destroy RSA, and it seems likely that similar approaches might be used to attack other public-key algorithms.

Public key cryptography is useful for easing the key distribution problem, but it's not essential to most uses of cryptography.

Doesn't Affect me (0, Redundant)

exabrial (818005) | more than 5 years ago | (#24706281)

My data is safe since I see that ROT13 isn't affected... Nice try you so-called 'crypto experts'!

Re:Doesn't Affect me (1)

trongey (21550) | more than 5 years ago | (#24707979)

What an amateur.
I use ROT14. That really screws 'em up.

'low-degree polynomial equation' (1)

Cheesebisquit (1324407) | more than 5 years ago | (#24706387)

Why is 'low-degree polynomial equation' in quotes? These are the things every high school and middle school student studies; it's not some exotic term.

Re:'low-degree polynomial equation' (1)

u38cg (607297) | more than 5 years ago | (#24709455)

Well, given that Taco & co can't manage to add up the number of people who wish idle./. would go the f*** away, I think it's safe to assume that 'low-degree polynomial equation' is pretty scary biscuits from their point of view.

"Cube" attack (1, Redundant)

dpilot (134227) | more than 5 years ago | (#24706623)

TFA (I read it a day or two ago, before it was posted to Slashdot.) mentions this as a "cube" attack, along with the low-order polynomial stuff, etc.

Does this also mean that TIMECUBE is busted?
I know it's been a while since TIMECUBE reared its ugly head here, but it would be good to hear that it's fully busted, not just sleeping.

(For the humor impaired, I know the cube attack has nothing to do with TIMECUBE other than sharing 4 letters, but it seemed like a neat idea.)

Re:"Cube" attack (3, Funny)

k1e0x (1040314) | more than 5 years ago | (#24707143)

TIMECUBE theory can never be broken because Shamir's math is educated stupid.

kdawson FUD again (0)

Anonymous Coward | more than 5 years ago | (#24706767)

Enough said

Good cracking utility? (1, Offtopic)

cat_jesus (525334) | more than 5 years ago | (#24706827)

I've recently come across a situation where my client's data is being held hostage by their application vendor. The vendor decided to encrypt the data during one of their 'upgrades' and now that the client wants to move to another application, the vendor won't decrypt the data without being paid a huge fee. They probably used something easy like an XOR cipher but I don't have the time to research how to figure this out. Are there any tools out there that I can use to give a sample of the encrypted data and the decrypted data, figure out the method used and then decrypt all the data?

I'd love to stick it to the application vendor. What a dick move.

Re:Good cracking utility? (0)

Anonymous Coward | more than 5 years ago | (#24707191)

pay with credit card. next question.

Re:Good cracking utility? (0)

Anonymous Coward | more than 5 years ago | (#24707247)

The vendor decided to encrypt the data during an upgrade? This sounds more like an issue for legal.

Also, I'm not sure that using a 3rd party tool to attempt to decrypt all of their data is such a good idea, to me it wreaks with concerns of liability.

Re:Good cracking utility? (0)

Anonymous Coward | more than 5 years ago | (#24707309)

Seriously? That's essentially extortion, isn't it? Your client should just get a nice lawyer to contact them.

And you should publish the vendor's name here, so everyone can avoid them forever.

Re:Good cracking utility? (1)

cat_jesus (525334) | more than 5 years ago | (#24709569)

Seriously. The bizarre thing is that this is a small police department. They would rather have someone manually move the data rather than go through the hassle of going after the vendor or paying them.

I have already told them they should notify the State AG. But these people are technologically challenged and don't want to advertise their ignorance. It's all about maintaining appearances.

It takes a lot of balls to do something like this to the government, especially to the police.

The name of the software is COPERS(pronounced coppers). I kid you not.

Re:Good cracking utility? (1)

Hurricane Floyd (891704) | more than 5 years ago | (#24708349)

Such a situation would be illegal in most countries, time for court. BTW, next time use ant-virus as I am aware that you have been infected by an encrypting virus and the writers want money to decrypt your data, you were just too embarrassed to tell the truth.

Cube attack in detail... (4, Funny)

Anonymous Coward | more than 5 years ago | (#24706923)

ENCRYPTION IS CUBE
cube have 4 sides
1 side = 1 encryption stage
ENCRYPTION STAGE IS TIME
TIME IS CUBE
THEREFORE ENCRYPTION = TIME
time slowed by day/night on planet corners
move algorythm to cube corners to solve in limited time
move algorithm to cube centers to unsolve in unlimited time.

A CRITICAL FLAW!x7q (1)

genericpoweruser (1223032) | more than 5 years ago | (#24708777)

Cubes have 6 sides.

...*whoosh!*

crypto law and public policy (1)

Benjamin_Wright (1168679) | more than 5 years ago | (#24707051)

From a public policy perspective: This post reminds us that cryptography is a dynamic and sometimes surprising science. The implication is that to achieve data security with cryptography is not just a simple task. But politicians have recently been writing laws and regulations with the assumption that to "encrypt" data is the end-all be-all of data security. It is not. Lawmakers are unwise [blogspot.com] to require a specific technology like "encryption" for data security. --Ben Wright http://hack-igations.blogspot.com/2008/02/encryption-legislation-goes-overboard.html [blogspot.com]

It will be interesting to see the full paper (4, Insightful)

wirelessbuzzers (552513) | more than 5 years ago | (#24707691)

I saw the talk. The cube attack was very impressive: it allowed Shamir to break a fairly difficult-looking toy cipher (constructed, of course, to have an Achilles heel, but still probably impossible to break with other known techniques). He used only one bit per packet (with a million packets) and didn't use any particular knowledge of the cipher's internals.

However, as presented the attack probably only breaks toy examples. Its real-world applicability will depend on how well Shamir and Dinur manage to adapt it to ciphers which don't have this simple structure. For example, it will be difficult to apply the attack to either hash functions or block ciphers, because their iterated design tends to give them high degree. The attack will also be difficult to adapt because of its low tolerance for noise and its applicability to a narrow range of scenarios. Still, Shamir believes that it will be applicable at least to some modern stream ciphers, so I'll be keeping an eye out for the full version.

BS (1)

Hurricane Floyd (891704) | more than 5 years ago | (#24708297)

This is just more snake oil bunk that really shows no weakness in modern hash functions or algorithms either one.

Break my Serpent 256bit! (1)

Bengie (1121981) | more than 5 years ago | (#24708397)

How many orders of magnitude would one have to increase breaking 256bit Serpent to make it relative to one life time?... :P

Setec Astronomy (1)

Deliveranc3 (629997) | more than 5 years ago | (#24708541)

"And give him head whenever he wants." - Sidney Poitier.
Load More Comments
Slashdot Account

Need an Account?

Forgot your password?

Don't worry, we never post anything without your permission.

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>
Create a Slashdot Account

Loading...