Slashdot Mirror
Draft FIPS for the Advanced Encryption Standard
Several people wrote with news that NIST has released a draft standard for the AES. They're inviting public comment, so if the NSA has added a backdoor to Rijndael, now would be a good time to find it.... :)
Why does this specify three alternative pronunciations for "Rijndael"? It's supposed to be an Advanced Encryption Standard, why can't they use the standard pronunciation? Come on guys, Dutch isn't that hard a language, and it makes a lot more sense once you can pronounce it (i.e. "zuid" = "south" is obvious when you know "zuid" is pronounced "soud")
If you're really concerned about the governent subverting the algorithm, then go visit Vincent Rijmen's page about Rijndael.
No wonder this guy posted anonymously. It's this kind of thing that makes me glad for metamoderation.
--
Patrick Doyle
Patrick Doyle
I mod down every jackass who puts his moderation policy in his sig. Oh, wait a sec....
IT is provably impossible to retrieve the original text from a hash -- a simple counting argument suffices. What you meant is probably that it is hoped to be difficult to construct a message with any given hash (strong requirement) or find two documents with the same hash (weak).
The value of this is that if someone signs a document, this is typically done by encrypting a hash of the document. A weak hash will let Oscar contruct another document to have the same hash, and hence "trick" the signer into having signed that one too. So the security of digital signature relies on this being difficult.
As a counter example, I give CRC-32, which an Oscar only needs control over 33 consecutive bits in order to modify the checksum to be anything he desires.
I'm pretty familiar with the Rijndael algorithm, so I glanced quickly through the FIPS document to see if they changed the algorithm. It looks at first glance to be exactly Rijndael, with one minor reduction in generality: The blocksize is fixed to be 128-bits, rather than the variable length block (128, 192, or 256 bits) in the original Rijndael spec. That doesn't seem to be a particularly important change (128 bits is more than enough).
:-)
Now of course, you can still be paranoid if you like, and here's a suggestion if you need one: maybe that particular algorithm was selected from the 5 finalists because the NSA could break it.
Probably not likely (in retrospect, DES turned out to be much stronger than suspected), but you can cling to that if you need some conspiracy theories!
Grow up and learn to act like yo mama taught you how. But of course you mama is also yo sister and yo daddy is also yo uncle. So white trash like you deserves to die.
When can I get my shadow file encoded in AES? Hehe..
actually md5sum is pretty secure, but nothing is secure if you use plain english dictionary words. Programs like johnny cracker don't care about the encryption.
honestly, I don't know the difference between a md5sum code and a AES code, maybe someone could elucidate me.
This concern is exactly why AES wasn't developed by the government. It was developed by two researchers in Belgium. NIST basically ratified the existing Rijndael cipher as "good enough to be the standard."
The website linked in the article has lots more info.
--
Then what is the reason that the natural 64 bit key length was forced by the government to be degraded to 56 bits before IBM could release their algorithm to the world? At least that's my understanding of how it went. I think that's one of the reasons many people are paranoid.
All Your Base Are Belong To Us!!!
Guns don't kill people -- people kill people.
But the guns seem to help a bit. (apologies to Eddie Izzard)
Because asymmetric encryption is 1000 times slower than symmetric algorithms (According to Schneier, approx based on some example algorithms)
AES can actaully be decrypted, so so can your passwords.
md5 is a one way hash. That means there's no way to decrypt the password once it's encoded. This makes sense for this purpose because you don't care what a password is as long as it's the right one. There's no reason to decypher a password, if someone forgets it you just reset it.
Trolls throughout history:
Jonathan Swift
"NIST strongly encourages the public to continue performing analyses of the security of the AES, and to submit those analyses as official comments in response to this request." Looks like they want some input.
---> suck it
Do you have any evidence of a backdoor? No? I didn't think so.
You should get your information from the horse's mouth. Here is Rijndael's page in Belguim: http://www.esat.kuleuven.ac.be/~rijmen/rijndael/
I haven't read through the algorithm yet but a few questions/comments: Why are we creating ANOTHER national Symmetric Key standard? Why not go for an Asymmetric standard? 256 bit key max? With the computing power the NSA (and others) have at their disposal, they won't need a back door. And yes of course they are getting free de-bugging, testing... Wouldn't you? That's the only way to truely test the robustness of an encryption algorithm. -forgive any naivity in my posts, I know very little about cryptography... JayDogg
You can use a chaining mode to make a hash function out of a block cipher; AES in (say) Miyaguchi-Preneel mode gives you a 128-bit hash, while Tandem Davis-Meyer gives you a 256-bit hash (rather faster than SHA-256, I might add!). See Applied Cryptography for a description of these modes.
I hope NIST standardise some such mode, but at the moment they're only talking about standardising modes for encryption and MAC, not for hashing.
--
Xenu loves you!
The NSA have not proposed a "fix for DES". There is evidence in the design of DES that the designers (IBM) knew about differential cryptanalysis, but not about linear cryptanalysis; however, for practical purposes brute force search is still the best attack on it; thus, the usual fix is to apply it thrice with two or three different keys (Triple-DES).
There is some evidence (in Skipjack) to suggest the public community is now ahead of the NSA in theoretical cryptanalysis. Certainly there are a hell of a lot of breathtakingly smart people in it.
--
Xenu loves you!
You should validate this implementation against the spec to check for back doors before you use it. Not because you'll find a backdoor - I've read this code, you won't - but because it'll be a useful education in crypto implementation techniques. There's quite a bit of cunning in the way the implementation is put together, particularly the way the tables are built. And you can appreciate the simplicity and beauty of Rijndael when you do it.
--
Xenu loves you!
Electric Angst is a troll, as a check on the user info will reveal (see "YHBT. YHL. HAND.").
No-one who knows how this cipher was chosen could seriously believe that Daemen and Rijmen are NSA plants, or that there's room to hide anything in an algorithm as simple and clear as Rijndael.
--
Xenu loves you!
For one reason, it's the National Security Agency. It spies on everyone except Americans, even the allies that agree to host their bases.
For another, the British Government sold a bunch of Enigma machines throughout the third world after WWII. I wouldn't put it past the NSA to pull a similar stunt.
Any sufficiently advanced technology is indistinguishable from a rigged demo
--Andy Finkel (J. Klass?)
I also should point out that that many /.ers, including myself, aren't American.
Any sufficiently advanced technology is indistinguishable from a rigged demo
--Andy Finkel (J. Klass?)
There are ways to view MS Word docs without using MS Word, or for that matter any Microsoft products. I do agree though, that this sort of document should be published in a more universal format such as HTML or at least PDF.
If the NSA puts their stamp of approval on an encryption algorythm for public use, you can damn well expect that they can compromise it.
It's like asking a burgular which locks to use.
Back in the 70's the NSA delayed the release of DES, for reasons which they could not disclose at the time.
NSA knew of a then-classified attack against DES known as differential cryptanalysis. NSA could not disclose why they delayed the release of DES, they could only say that they were still working on it. Lots of people speculated NSA was inserting a "secret backdoor", when actually they were ensuring the national standard for data encryption would be secure against even secret attacks than only NSA knew about at the time.
Of course, the complete design criteria for DES were not published at that time. Since not all of the steps in the algorithm seemed logical at the time, people got real suspicious. AES, on the other hand, is pretty straightforward.
For more background, check out this history of DES, or Eli Biham'sthese papers on differential cryptanalysys.
--
NSA broke DES before anyone else did, and they fixed DES to make more resistant agaist that kind of attack. Only much later did anyone outside NSA break DES thru differential cryptanalysis, and by that point (late 80s/early90s, iirc), it was becoming practical to simply brute-force DES.
--
You can make this statement from the laws of thermodynamics (Energy in a system is conserved). And since information is energy, (Think about data compression, is information lost in the message - Entropy? Think about an air compressor, is energy lost in the air - Temperature/UnitVolume?). Think about it for 5 minutes before you hit the reply button. Afterall, we live in the universe, not an equation sheet.
Now what about asymmetric algos? Do the laws of thermodynamics suggest there is conceivably a perfect public-key algorithm? Nope. The public key contains information about the private key, all the information you need in fact. So what protects us? It is our child-like understanding of these hard problems.
Now what about quantum crypto? Is this any different from asym algos? Information must be transferred. It cannot be destroyed.
Granted, if one day someone proves the fundamental laws of thermodynamics wrong, we're all in trouble. But I doubt that will happen.
The key exchange problem - I would state - is by it's very nature a problem with no permanent solution. It implies the destruction and re-emergence of information on a massive scale. The only thing we can do is protect our selves with "strong" key exchange systems and prepare for the enviable: humanity's intellectual growth.
So that said, why gripe over a possible weakness in Rijndael when the CSE or the NSA have solved the hard problems of asym algos to get at your precious block cipher key used in all electronic transmissions? You're not safe no matter how strong the cipher is, even the proposed perfect cipher.
For those people (myself included) who are too lazy to interpret the specification and enter the code in yourself, you can find a C & C++ implementation here. Note a link to this and other useful information is provided from the original link.
Given one hour to live, the student replied: "I'd spend it with professor FP who can make an hour seem like a lifetime."
I thought they meant this FIPS! I figured it was taking it a bit far making a disk partitioning program in to an Advanced Encryption Standard, but you never know... ;-)
"I may not have morals, but I have standards."
"I may not have morals, but I have standards."
Now, if we could just prove that they're both saying the same things, instead of the PDF one saying "Here's the Open Source AES implementation" and the DOC one saying "Dear A Valued Micro$oft Customer, trust this special Micro$oft/NSA joint venture AES implementation. *ERROR DETECTED: the network traffic light on your PC is blinking indicating it is malfunctioning. [ok][continue]"
John
John
For those people (myself included) who are too lazy to interpret the specification and enter the code in yourself, you can find a C & C++ implementation here.
Don't listen to this guy! It's a trick! The NSA has planted this guy and the code. Nudge nudge, wink wink. Write your own implementation from the spec and you'll see the back-door, clear as day. Tricky buggers...
DES was sanctioned by the the NSA and it was broken by somebody not in the NSA. (don't have the book here to reference but they talk about it in applied cryptography). Of course after that happened the NSA said yes we know about that type of attack here is a fix for DES. So the public cryptography community may be behind the NSA but people do figure things out. There are pleanty of math PhD's that don't work for the NSA you know.
As x approaches total apathy I couldn't care less.
Basically what they do is encrypt the password with blowfish. Then they take the resulting cypher and encrypt it in blowfish. Then they take that result and encrypt it in blowfish. And repeat the cycle something like 36 times. This effectively creates a one-way hash.
I think the logic is not so much that it's a provable perfect hash (only one password will create the same hash), but that it's way to computationally expensive to do a dictionary attack.
Trolls throughout history:
Jonathan Swift
Looks like they're serious about the comments.
There's always sufficient, but not always at the right place nor for the right folks.
Maybe a better solution would to have an government-indepedent group that is politically neutral be responsible for the development of encryption standards. I don't know how exactly that could be setup, but it at least might be worth a little thought.
All five final candidates for the AES got the NSA stamp of approval. If they can break them all, even Serpent, they probably have orbital mind control rays too.
A burglar you trust is an excellent person to ask about what locks to use. Of course, NIST didn't just ask the NSA, they asked all the best burglars in the world, and the conclusion is that this is as secure a lock as you could possibly need for the foreseeable future.
--
Xenu loves you!
So this "change", is really just rewriting Rijndael to fit the NIST's proposal. Check the original 1997 request for candiates.
I don't know what it is about cryptography that causes people to widly speculate about it, but unless you have any evidence, I claim that there is no known backdoors in DES, or AES. Period.
If you read Steven Levy's Crypto, chapter 2, you'll see that DES was quite strong in its day. Its structure now makes sense, once the T-attack was rediscovered by Biham and Shamir as differential cryptanalysis. The only just criticism of DES was that even then 56-bit was conceiviable weak in the future, not in the 1970s when it was first made standard.
The NSA has two responsibilities , to gather national intelligences, and to preserve the US Government's own security. The AES will be used as the standard encryption for non-classified (basicilly non-military) security, and willing likely be adopted by X9 as a sucessor to TripleDES for banking and international financial security. Using a weak algorithm for AES is would not make the NSA's responsibility of protecting the US Government's security easier, so I do not see the benefit of trying to do such a thing.
NIST started the process of designing a successor to AES many years ago, and fifteen algorithms were submitted from all over the world as candidate successors. The eventual winner comes from a team from Belgium; it's been thoroughly examined by the worlds best cryptanalysts and I don't think anyone thinks there's going to be a useful break.
So long as this FIPS is simply a formal description of the algorithm we were all examining (and it appears to be), there's no problem. NIST have done all the right things here.
--
Xenu loves you!
Far from resting on their laurels, the Rijndael team have been busy with new cipher design work. Check out their latest creation, Noekon, designed for simple implementation and resistance to differential power attacks and other side channel attacks.
--
Xenu loves you!