Slashdot Mirror
NIST Proposes Abandoning DES
Mr. Manometer writes "With little fan-fare, NIST proposed yesterday to withdraw the Federal Information Processing Standard (FIPS) for the Data Encryption Standard (DES) with a Federal Register notice (pdf). NIST is encouraging federal agencies to use the Advanced Encryption Standard (AES) instead since they feel that DES is 'now vulnerable to key exhaustion using massive parallel computations.' We all knew this day would come as computers got faster & cheaper... and this should put more pressure on folks to use stronger encryption techniques with is a good thing." Some would argue that DES has been insufficient for some time now.
In '76 Lucifer was adopted and renamed "DES". Of course as computers became faster and more powerful, it was recognized that a 56-bit key was simply not large enough for high security applications. As a result of these and other serious flaws, NIST abandoned their official endorsement of DES in 1997 and began work on a replacement, to be called the Advanced Encryption Standard (AES). And so the story continues...
Sigs cause cancer.
.... I was going to write a long, well thought out reply to this story but the IT colour scheme is causing acid flashbacks.
The horror... the horror...
Wait, ...ugh..., I didn't write that and more importantly, you didn't read it. It never happened. Nothing to see here. Just move on now.
All realistic encryption scemes have a lifespan.
The darkness... controls the music. The music... controls the soul.
I thought that DES3 solved the key length problem by bumping it up to 192 bits. Of course it runs 3 times as slow.
Not that I'm saying we should cling to DES for the next hundred years. I'm all about AES.
Blaze a trail to the New World
I'm not one to point fingers, but if they do have to be pointed, they should be pointed at Mushrooms or toad licking. Not acid.
It is interesting to note that they recommend using a faster algorithm.
Of course us, of the tin-foil-hat, brigade know that the government has a very secure algorithm (gotten from area 51), but they never tell us about, just so we use an algorithm that we think is secure, but they have their own back-door.
Fight Spammers!
They want me to abandon DES and Internet Explorer? Please, NIST, why do you keep recommending against my favorite applications.
Let's hope we'll never see ICQ and Windows ME on that list.
Which is why we have to invent an unrealistic encryption scheme. Then we can use it forever.
Oh yeah! Now foreign powers will have to go back to sending sexy spies to seduce the secrets out of us instead of just breaking the codes!
-- If god wanted me to have a sig, he'd have given me a sense of humor.
I thought NIST had already recommended replacing DES with AES several years ago. It's been fairly obvious for a while now that distributed computing could crack DES encoded data.
It will be AES's time before long anyways, with quantum computing these algorithms become fairly useless.
Its be accepted by many in the industry that DES was too weak. However you can use DES repeatedly with different keys to make up for it and thus you get triple DES. It effectly gives you a key space of 56 * 3 = 168 bit keys which is much better. And you could always run the data through a few more times if you are realy paranoid.
Some would argue that DES has been insufficient for some time now.
Yeah, like since the day I first heard about it, back in 1995.
SJW: a person who perceives an injustice, and while correcting it, commits a greater injustice.
So what does this mean for 3DES?
// karmaburn - Start
// karmaburn - End
C'mon...even the distributed.net folks aren't gonna break that one anytime soon unless someone gets really lucky...which is why anyone involved in that project should really dump it an start running Predictor@Home or something useful.
// Agent Green (Ian / IU7 / KB1JQO)
// IEEE 802.3: All 10base Are Belong To Us
we should stick to a system that offers "everlasting security" and stop depending on CPU cycles to slow down attackers. Dr. Rabin's Hyper-Encryption, anyone?
. html e s-Scientist%20Outlines%20Unbreakable%20Code.htm
http://www.india-today.com/ctoday/20010501/trends
http://humboldt.sunyit.edu/553/The%20Key%20Vanish
(p.s.: while they're not mirrors, the plaigiarism is close enough that you only need to read one)
Could anyone explain why EC systems are not adopted as a standard? From what I have studied, one can use a smaller numbers and get encryption just as strong as RSA or Diffie-Hellman. And it is a lot easier to implement than DES or AES.
Microsoft's .NET has AES built in and I'm pretty sure AES is what Trillian uses for encryption, so I say go for it!
[o]_O
Or maybe they should drop it for me, Destoo.
I've been using that handle since around '89
Nouvelles de jeux et technologies en français. TC
"Some would argue that DES has been insufficient for some time now."
Insufficient for what? I hate to play semantics, and I'm no cryptographer, but as I understand it, the inadequacies of an encryption algorithm are primarily defined by the implementation and the reason for it [application]. OK, it's a weak cipher, but in certain instances, it may still be useful. Right?
Nice to hear they got some good consulting.
I've been using AES-256 on all my projects that deal with sensitive data since ohhh -- 2001.
Considering that DES has been relegated to hack toy status for some time now and triple-DES is only marginally better since it's just DES encryption done threefold I think this is a very wise but belated move.
And when Hollywood even makes fun of an encryption grade by showing a guy breaking it in 60 seconds while getting a BLOWJOB, you KNOW it's time to stop using it!
Whenever this is any doubt about the structural integrity of any item (from little glass figurine to 18 wheeler transporting corrosive chemicals), slap some duct tape on it. And then a little bit more. You'll be glad you did.
Although DES's key length is short, it's a remarkably strong cipher. There are some methods to crack DES where you can do a ~little~ better than trying all the combinations, but not much better.
r diq.com/definition/Advanced_Encrypti on_Standard
Triple DES extends the key length to something acceptable and there isn't any serious cryptanalytic attack on it -- after decades of people hammering at it. Today we even know that the NSA did a good job choosing the S-boxes (although we could do a little better today.)
AES wasn't really designed to be secure, it was designed to have low CPU and power requirements so it could run on smart cards. As a result, they chose to use the absolute minimum number of rounds that they could get away with. Take away a few rounds and AES falls... If you have to use AES, use it in 192-bit mode or greater. Not for the key length but for the extra rounds.
AES is just a few years old and there are a lot of attacks that are nearly successful and practical. In 128-bit mode it's like a 12-inch wall with an 11-inch long crack in it. That last inch might hold, but I wouldn't bet on it. I tell my clients to use 3DES, and you should too...
http://www.cryptosystem.net/aes/
http://www.wo
When I did my military service in Sweden 96/97 I came across the official introduction book to cryptology (the Swedish military has, as I assume every national military has, a book division making various manuals). It was pretty standard starting out with substitution and permutation and quickly moving past most techniques up to finite field equations. I don't know when the book was written (it didn't say), but probably in the mid to late 80's since the most recent book reference was from 85. The thing that really caught my eye was however a paragraph that essentially said "DES is not certified for secure transmissions in the Swedish military for reasons we will not discuss here". Given that they broke every crypto system transmitted over Sweden during WWII, I would take their advice if they say not to use a cipher.
One of the earliest critics of DES (FIPS-46) was Whitfield Diffie, a maverick of his time. The government, industry, and press all hailed the 56-bit DES as a milestone breakthrough. At that time, ITAR regulations limited encryption algorithms to 28 or 40 bits, a serious restriciton for international corporations. IBM was prohibited from using Lucifer with its offshore subsidiaries because the Feds equated it with nuclear weaponry.
Diffie is probably best renowned for his methodology known as knapsack encryption. This was alternative to RSA which was computationally prohibitive in the early 1980s.
I remember my having difficulty in my old college days in obtaining a copy of RSA. My school had to obtain a copy of their paper from MIT through inter-library loan. I had not realized that RSA would gain such widespread adoption because ITAR would prevent international implementation for any US-based company.
signature pending slashdot approval
I am a gov't contractor in the DC metro area. While not yet reaching the rest of the country, all projects in this area for the DoD must conform with DITSCAP guidelines (DoD Information Technology Security Certification and Accredidation Process). DES and Triple DES are not compliant with DITSCAP. For now, AES is the standard.
A DITSCAP security scan checks everything from hardware to OS to application, checking permissions, accounts that own processes and NT services, and a DITSCAP compliant application logs *everything*.
My applications logs every change to the database, when it happend, and by whom. They track who accesses what, whether or not they were given access, and alerts go out to security officers when anything out of the ordinary happens (read: often).
It takes months to secure an application for DITSCAP, and as a web guy I think some of it is bunk. Most of their guidelines were written for desktop apps where it is entirely possible to do things that are entirely impossible to do in a web environment. Nevertheless, we code to the letter of the law and attempt to address every security point brought up in a scan. Whether or not they are valid points (or even worthwhile to do because many of the points are easily fooled) is irrelevant because a scan is a scan and we must adhere to our security auditors' guidelines.
As far as this thread goes, only AES will pass a security scan. Nothing else qualifies and you would be forced to implement all your encryption with AES.
This is actually a valid point about intelligence. Although it's obvious that there are places where uncrackable encryption should be used if at all possible, there are many others where disinformation can be used to great effect. An example is where a message crackable in finite time is allowed to be intercepted because by the time it is decrypted it is too late to take action, the object being to build up the credibility of an information source prior to shovelling out a great load of disinformation. I believe this technique was used ahead of the D-Day landings as part of the plan to persuade the Germans that the invasion would actually be in the Pas de Calais.
For this reason I would have thought it was unwise for official bodies to make statements about the use of different forms of encryption - unless it's a double bluff and DES will continue to be used for short-life messages.
Tinfoil hat? Stress-relieved oxygen-free copper plated mumetal in my case.
Panurge has posted for the last time. Thanks for the positive moderations.
Secrets normally take years, often decades to be out in the public domain. What was daunting before EFF's 1998 achievement is looking more and more trivia for a government that wouldn't blink at the cost of buying a 1,000 node super-computer.
To future-proof secrets, you'd have to encrypt at a level that not only would be ridiculously expensive to crack today, but as long as you need to keep them, well, secret. Imagine some of the files from the time of the UNSC's Iraq debates a year-and-a-half ago getting cracked today or before the next US presidential election.
Information: "I want to be anthropomorphized"
So they aren't going to admit that the only reason for recommending it in the first place was that they had the ability to break it all along? And now that lots of others can, it gives them no advantage...
Anyone know any cyphers that are immune to Shor's algorthim? I don't think AES is...
3dinfo@maficstudios.com
The knapsack algorithm was devised by Ralph Merkle and Martin Hellman. Knapsacks would still be computationally prohibitive if they had not been broken.
Also, Whitfield Diffie is certainly best renowned for the Diffie-Hellman algorithm for key exchange.
sig intentionally left blank
Diffie didn't invent knapsack encryption. Diffie and his colleague, Martin Hellman, invented the first public key cryptosystem, Diffie-Hellman, and founded the modern field of cryptography. We all owe them (and Ralph Merkle, who basically did the same things at the same time) an enormous debt.
There were no ITAR limits on key length. The law simply stated that you needed a license to export products that included cryptography; strictly interpreted that would have included a Secret Decoder Ring. It wasn't until Lotus wanted to export Notes with crypto built in that the NSA got involved in the process of making it possible for products that used crypto to be granted export licenses by demanding features such as CDWF, which made it easy for the NSA to break messages while keeping it hard for everyone else.
Lucifer was vulnerable to a differential cryptanalytic attack that reduced the effective key strength to around 56 bits. However, IBM and the NSA kept their knowledge of DC secret until Biham and Shamir rediscovered it in 89.
RSA was invented later. It was never prohibitively slow, though of course it's got much faster over the years.
If you wanted a description of RSA, why didn't you just buy a copy of Scientific American, where it was first published in Martin Gardener's "Mathematical Games" column?
Xenu loves you!
AES certainly was designed to be secure. You exaggerate the extent of what people have against it so far by an absolutely gargantuan margin.
In addition, you are clearly unaware of Stefan Lucks's attacks on 3DES, which take it down to about 72 bits of security - far from the 112 it promises. You might as well just use DESX, which is about as strong but three times faster.
Xenu loves you!
Actually, 3DES uses encrypt with A, decrypt with B, encrypt with A. This makes the degenerate case where A equals B backwards-compatible to single-key DES, and is why 3DES is also called DES-EDE.
However, using 3 keys with any cipher only squares the time to key recovery, regardless of whether the first key and the last key are equal. Assuming you know both the plaintext P and ciphertext C for a given message, compute a table of all possible results of encrypting P with keys 1 and 2, and a table of all possible results of decrypting C with key 3, then join on the intermediate ciphertext. If only 2 keys were used, computing and joining two single-key tables would bring the time cost down to only 1 additional bit of key strength.
...when you're writing a game...tweak the difficulty of "Easy" to something [your mother] can cope with. -- onion2k
Diffie and Hellman attacked the short key length of DES from the day it was proposed, arguing for keys of at least 128 bits in length. Michael Wiener proposed a $1 million hardware cracking machine not long afterwards, to demonstrate the vulnerability. People could do the sums even then and see that 56 bits was far from being enough.
Xenu loves you!
It was known when 3DES was proposed that the "meet in the middle" attack reduced the effective strength to 112 bits. Lucks's attacks reduce that strength to 90 bits. See
k s/ papers.html
http://th.informatik.uni-mannheim.de/People/Luc
Xenu loves you!
Triple Data Encryption Algorithm or ''TDEA.'' TDEA encrypts each block three times with the DES algorithm, using either two or three different 56-bit keys. This approach yields effective key lengths of 112 or 168 bits. TDEA is considered a very strong algorithm. The original 56-bit DES algorithm can be modified to be interoperable with TDEA.
Are you more of an expert than those at NIST?
I misremembered the efficacy of Lucks's attacks - it's more like 90 bits. See
k s/ papers.html
http://th.informatik.uni-mannheim.de/People/Luc
Xenu loves you!
Encryption is just a kind of fancy FedEx for fancy information. There's no value after delivery, because somebody signs for it, and that person is vulnerable to blandishment, threat, seduction, coercion and Vulcan mind melds. The inadequacy of DES for most purposes if matched by the inadequacy of ANY scheme where secure pipes join, meter, valve or misalign.
They're just now getting around to this?!?
...Some would argue that DES has been insufficient for some time now.
Well, duh!
I switched to blowfish and IDEA years ago.
Typical of how our government is ages behind the times.
Anyone know what the patent encumbrance status of AES is? Will it be usable by open source software?
Tired of FB/Google censorship? Visit UNCENSORED!
It's a strong estrogen and a causative factor in several forms of cancer, in infertility and reproductive abnormalities in those exposed in utero and even in their progeny.
Diethylstilbestrol is, like most hormones, a hazard to those who handle it, and there's precious few excuses for using it anymore; its use as an anti-abortive was based on faulty evidence.
I don't know if the Rijndael cipher (the algorithm that one the AES contest, essentially) is covered by any patents, but it doesn't matter - the winner agrees to allow anyone to use the cipher regardless of patent coverage, essentially.
RC5, however, does use techniques covered by patents. You'll find that some GNU/Linux distributions, such as Red Hat, don't even include the OpenSSL support for it for that reason. (RH7x also left out IDEA, but unfortunately I don't know about more recent releases.) And I know I've read accounts of people having to build OpenSSL with no-rsa or no-rc5 because RSA approached them and asked them to license the technology.
Everyone is guaranteed use of AES. Besides, it's not like Rijndael is some crappy old cipher (probably), so why use something else?
If America's Duct Tape Manufacturers falter, the impact to the American economy
could be catastrophic! And no patriotic American wants that. So be patriotic! Buy more patriotic American duct tape, and shore up the patriotic American economy, so all of our American children can grow up safe, strong, and patriotically American in good old patriotic American America!
Oper on the Nightstar
Mr. Simpson, are you going to buy those toads or just lick them?
--
"Outlook not so good." That magic 8-ball knows everything! I'll ask about Exchange Server next.
Terrible, terrible, HORRIBLE analogy.
Cryptography rounds are not like walls... It's not like a wall, where defeating each one removes strenghth. In cryptography, even if you can break up to 127-bits, that last 1-bit stll means it's just as strong as ever.
A good example (besides AES) is skipjack... NSA's own. There would have been a vulnerability if it used one less round, but since it uses 1 more, it's still perfectly safe, and hasn't been broken yet...
In other words, find a new analogy, and don't tell people that AES is insecure. It's gone through detailed analysis to make sure it's secure... The same process that approved of DES years ago.
If you trust 3-DES, you should trust AES, too.
Personally, I use blowfish whenever possible, but I haven't seen any crypto hardware with blowfish built-in so I doubt it'll get more widespread anytime soon.
Slashdot gets worse every day... Pipedot: News for nerds, without the corporate slant
I just heard some sad news on talk radio - data encryption standard DES was found dead in his Maine home this morning. There weren't any more details. I'm sure everyone in the Slashdot community will miss him - even if you didn't enjoy his work, there's no denying his contributions to popular culture. Truly an American icon.
Just wait for the email from NIST forcing you to upgrade your DES or Tripple DES keys to new AES keys free of charge.
And you thought the patriot act was bad...
More information about the Cryptographic Module Validation Program (the current standard for encryption is FIPS 140-2) can be found here: http://csrc.nist.gov/cryptval/140-2.htm
Also, here's a group which has both Windows and Linux versions of a FIPS 140-2 AES implementation, if you want to know what it looks like in action: http://www.standardnetworks.com/moveitcrypto
open4free © : i'm using the old russian effective 256-bit key GOST
Can anyone demonstrate that it doesn't exist with the dangerous current technologies of cheap UVLSI-chips?
There are many traps!!!.
open4free ©
Can anyone demonstrate that it doesn't exist with the dangerous current technologies of cheap VLSI-chips?
There are many traps!!!.
open4free ©
take two. Use one for the message and one to transmit two more pads. lather, rinse, repeat.
You are standing in an open server west of a blue house, with a boarded front door. There is an Exchange mailbox here.
I'll feel better if just the one with the most votes gets elected.
Slashdot Eds Link Anonymous Posts With Logged Posts
They Are Vermin Feeding On Each Other's Feces.
I Hate \.
You are incorrect, 3DES normally uses just 2 keys, A-B-A. There is a known attack on 2DES (read other posters for an explanation, I'm not going to repeat what they said better than I can) making 2Des where you use encrypt with A, then B equivalent to a 57 bit total key length. 3Des defeats that attack and as used with 2 keys gives you 112 bits of equivalent key length.
There are many different ways to implement 3DES (and I know of no theoretical reason you couldn't use 3 different keys), the most common one is to encrypt with key A, then DECRYPT with key B, then encrypt with key A. Note that the middle step is decryption with the wrong key. I'm not sure what the reasoning behind this is anymore. Nobody has used any form a DES for a few years now if they had any other choice.
Mabye they will come up with a way to make computers work at speeds faster than light, perhaps some kind of hyperspace/subspace/tachyon/whatever system. Or just go quantum computing or even better, superstring computing (or brane computing, or whatever they come up with). How about manipulating black holes to create a new universe in which the speed of light is much faster than in ours? There are many possibilities beyond the current limits of physics.
Earlier today, the IAB drafted an RFC regarding HTTP which was quickly DTCF, much to the BA of several CCNPs who AHAIFSD until finally they GUAH and said "TFWT". FFTA, but IMHO that's just a bunch of FU FUD. TIWNBTS. NIGGATASBIASTSRPENMAR.
Sure, and maybe we'll have robots with positronic brains by 1985. Oops. You are talking about science fiction. Putting "superstring" and "brane" or "black hole" in your post is not the same as making a scientific argument.
There are many possibilities outside the realm of current physics theories. It's trivially easy to come up with some, as you have. The problem is not to come up with ideas beyond current physics, it is to come up with ideas which are WITHIN this tricky thing called REALITY. And modern physics does a damn good job of describing reality already. Improving it is hard work.
Might as well hope that future scientific discoveries allow "chocolate cake for everyone! Yay!"
I hate to break it to you but I think you might have misunderstood the concept of "rubber-hose cryptanalysis."
Sincerely,
Pan Tarhei Hosé, PhD.
"Homo sum et cogito ergo odi profanum vulgus et libido."