Slashdot Mirror
Brute Force
ijones writes "Brute Force, by Matt Curtin, is about an event that
many Slashdotters will remember: the cracking of the Data Encryption
Standard. In June of 1997, a 56-bit DES
key was discovered, and its encrypted
message decoded, by an ad-hoc distributed network of computers,
cooperating over the Internet. Four and a half months earlier, RSA had issued a challenge to the
cryptography community, offering $10,000 to the first group to crack a
56-bit DES encrypted message. In Brute Force, Matt
Curtin offers his first-hand account of the DESCHALL team's winning
effort." Read on for the rest of Jones' review.
Brute Force: Cracking the Data Encryption Standard
author
Matt Curtin
pages
291
publisher
Copernicus Books
rating
9
reviewer
Isaac Jones
ISBN
0387201092
summary
Volunteers working collaboratively over the internet manage to crack the Data Encryption Standard.
Although I wasn't involved with the DES cracking challenge, I am friends with the author of this book. I took a Lisp course from Matt at Ohio State University and I'll be forever grateful that Matt introduced me to functional programming with a great deal of humor and enthusiasm. I don't think I've ever seen Matt stay so serious for so long, but his enthusiasm comes through clearly in this book.
Brute Force can be enjoyed by both nerds and non-nerds interested in cryptography or codes. Those who have been a part of this or subsequent DES challenges may be particularly interested in this book. Curtin covers some technical details of DES and the brute force attack that the DESCHALL team used to discover a DES key. He also discusses the political and historical significance of this event. This is a fairly technical book, but it goes out of its way to explain non-obvious technical topics, so one doesn't need a lot of technical background to understand it.
Curtin briefly explains a lot of stuff: the C programming language, firewalls, UDP, one-time pads, protected memory, etc., in order to make this book readable for novices. Although I generally did not need such explanations, I did not find them annoying or distracting, as they were fairly brief. In fact, it's fun to read concise explanations of such topics. Occasionally, Curtin does go into just a little too much detail. The chapter on Architecture gives an explanation of some of the many pieces of software that were involved in this effort. This chapter sometimes gets a bit bogged down with explanations of useful scripts that folks wrote to analyze data or forward packets through firewalls.
Brute Force is a very readable and enjoyable book. It is well organized as a narrative, though it is not chronological; Curtin presents the background and substance to each aspect of the story together, rather than chronologically. This can be slightly confusing sometimes, but I think it improves the over-all flow of the story.
In a way, Curtin gives away the ending to the book at the beginning (and in the title), but this isn't ancient history, and most readers will probably already know that DES was defeated by this effort. He still manages to maintain a good sense of suspense throughout the book. He presents tables and analysis of the effort, along with predictions about completion dates that volunteers had made at the time. Unfortunately, he doesn't tell us whether those tables turned out to be correct. What percentage of the keyspace was searched by Macintoshes? How many different kinds of client machines were there in the end? Did Ohio State University try more keys than Oregon State University? Which one is the real OSU?
One of the main themes running throughout the book was that of community. The DESCHALL project was made up of thousands of volunteers from all over the US. Anyone with some spare CPU cycles could get involved by downloading the client software. This may remind you of other distributed computing projects like SETI@home. The community was further broken down into sub-groups like schools who would compete for bragging rights. The organization of the DESCHALL project was much like an open source project, though the key-cracking tools were not open source. Spreading the Word is a chapter about how people started to hear about DESCHALL and what the earliest adopters were like. Some of the tables in a later chapter list the operating system and hardware that the clients were running, which was a pretty cool snapshot of the Internet from 1997. It included lots of OS/2 clients, labs full of SGI machines, and plenty of computers which were only connected to the Internet via dial-up modems. Special scripts were developed for such machines so they could phone home when they needed a new block of keys.
Though the key cracking clients were not open source, they were free as in beer, at least for Americans. Since such cryptography-related software could not be exported at the time, this was a US-only effort. There was a European team, however, with their own software, called SolNet, and Curtin keeps us updated on their progress. In fact the DESCHALL project had an impact on the political debate of this time with regard to the export and control of cryptographic technologies. Curtin gives us interesting periodic updates on the political debate as the DES cracking story moves forward. Cryptography control was defeated at that time, but the use of cryptography is a right that will need continued protection.
The political story of DESCHALL was one aspect of the historical impact of the project. Another impact was the explosion of volunteer distributed computing networks after the DESCHALL project, with SETI@home being one of the most obvious examples. DESCHALL clearly demonstrated the viability of this kind of computation. Curtin touches briefly on this here and there, but does not go into detail. I would like him to more clearly spell out the trends in Internet distributed computing. I would like to hear that DESCHALL was derived from project A and that it inspired projects B, C, and D. Was it was the original Internet distributed computing network? Was it a fad that has abated in the last few years? Curtin touches on this a bit, but says, "Some other distributed computing projects like DESCHALL were around," (pg 200.) He says which ones, but doesn't make any claims that DESCHALL inspired SETI@home, for instance. Perhaps such things are never quite clear in the free exchange of ideas on the Internet.
The political and community aspects of the story wrap up very nicely. Curtin outlines DESCHALL's impact on driving the AES standard, and its (perhaps much smaller) impact on the debates on key escrow and encryption exports. Brute Force is a very enjoyable read about an important event, and I can happily recommend my friend Matt's book to the Slashdot crowd. My only criticisms can really be summed up by saying, "I want to hear more."
You can purchase Brute Force: Cracking the Data Encryption Standard from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.
Although I wasn't involved with the DES cracking challenge, I am friends with the author of this book. I took a Lisp course from Matt at Ohio State University and I'll be forever grateful that Matt introduced me to functional programming with a great deal of humor and enthusiasm. I don't think I've ever seen Matt stay so serious for so long, but his enthusiasm comes through clearly in this book.
Brute Force can be enjoyed by both nerds and non-nerds interested in cryptography or codes. Those who have been a part of this or subsequent DES challenges may be particularly interested in this book. Curtin covers some technical details of DES and the brute force attack that the DESCHALL team used to discover a DES key. He also discusses the political and historical significance of this event. This is a fairly technical book, but it goes out of its way to explain non-obvious technical topics, so one doesn't need a lot of technical background to understand it.
Curtin briefly explains a lot of stuff: the C programming language, firewalls, UDP, one-time pads, protected memory, etc., in order to make this book readable for novices. Although I generally did not need such explanations, I did not find them annoying or distracting, as they were fairly brief. In fact, it's fun to read concise explanations of such topics. Occasionally, Curtin does go into just a little too much detail. The chapter on Architecture gives an explanation of some of the many pieces of software that were involved in this effort. This chapter sometimes gets a bit bogged down with explanations of useful scripts that folks wrote to analyze data or forward packets through firewalls.
Brute Force is a very readable and enjoyable book. It is well organized as a narrative, though it is not chronological; Curtin presents the background and substance to each aspect of the story together, rather than chronologically. This can be slightly confusing sometimes, but I think it improves the over-all flow of the story.
In a way, Curtin gives away the ending to the book at the beginning (and in the title), but this isn't ancient history, and most readers will probably already know that DES was defeated by this effort. He still manages to maintain a good sense of suspense throughout the book. He presents tables and analysis of the effort, along with predictions about completion dates that volunteers had made at the time. Unfortunately, he doesn't tell us whether those tables turned out to be correct. What percentage of the keyspace was searched by Macintoshes? How many different kinds of client machines were there in the end? Did Ohio State University try more keys than Oregon State University? Which one is the real OSU?
One of the main themes running throughout the book was that of community. The DESCHALL project was made up of thousands of volunteers from all over the US. Anyone with some spare CPU cycles could get involved by downloading the client software. This may remind you of other distributed computing projects like SETI@home. The community was further broken down into sub-groups like schools who would compete for bragging rights. The organization of the DESCHALL project was much like an open source project, though the key-cracking tools were not open source. Spreading the Word is a chapter about how people started to hear about DESCHALL and what the earliest adopters were like. Some of the tables in a later chapter list the operating system and hardware that the clients were running, which was a pretty cool snapshot of the Internet from 1997. It included lots of OS/2 clients, labs full of SGI machines, and plenty of computers which were only connected to the Internet via dial-up modems. Special scripts were developed for such machines so they could phone home when they needed a new block of keys.
Though the key cracking clients were not open source, they were free as in beer, at least for Americans. Since such cryptography-related software could not be exported at the time, this was a US-only effort. There was a European team, however, with their own software, called SolNet, and Curtin keeps us updated on their progress. In fact the DESCHALL project had an impact on the political debate of this time with regard to the export and control of cryptographic technologies. Curtin gives us interesting periodic updates on the political debate as the DES cracking story moves forward. Cryptography control was defeated at that time, but the use of cryptography is a right that will need continued protection.
The political story of DESCHALL was one aspect of the historical impact of the project. Another impact was the explosion of volunteer distributed computing networks after the DESCHALL project, with SETI@home being one of the most obvious examples. DESCHALL clearly demonstrated the viability of this kind of computation. Curtin touches briefly on this here and there, but does not go into detail. I would like him to more clearly spell out the trends in Internet distributed computing. I would like to hear that DESCHALL was derived from project A and that it inspired projects B, C, and D. Was it was the original Internet distributed computing network? Was it a fad that has abated in the last few years? Curtin touches on this a bit, but says, "Some other distributed computing projects like DESCHALL were around," (pg 200.) He says which ones, but doesn't make any claims that DESCHALL inspired SETI@home, for instance. Perhaps such things are never quite clear in the free exchange of ideas on the Internet.
The political and community aspects of the story wrap up very nicely. Curtin outlines DESCHALL's impact on driving the AES standard, and its (perhaps much smaller) impact on the debates on key escrow and encryption exports. Brute Force is a very enjoyable read about an important event, and I can happily recommend my friend Matt's book to the Slashdot crowd. My only criticisms can really be summed up by saying, "I want to hear more."
You can purchase Brute Force: Cracking the Data Encryption Standard from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.
> by an ad-hok distributed network
Come one..."ad-hok?"
No gods, no demons, and no masters. Secular Humanism!
For crying out loud indeed.
For those interested in this sort of thing, http://www.distributed.net/ runs like SETI@Home - lots of small individual clients working together to brute force encryption keys.
Join the Empire! http://www.empirereborn.net/
At the ISP I was working for at the time we had this running on all the servers. It was very fun and the best part is that the CEO was in on the whole thing. Hard to find good places with a fun attitude these days. Damn shame.
Cypherpunks: Civil Liberty Through Complex Mathematics. Those who live by the sword die by the arrow.
Maybe the author will follow up with a dozen-page illustrated children's book about how CSS was cracked.
Skype is too convoluted... Now I'm reverse-engineering the Kyoto Protocol.
Once again serving as the "missing bit in every /. editor" I'm proud to preseng (geeeeee!) something more about Matt.
;)
He is a very weird and amusing fella
Grammar Zealots: please spare a non-english writer (lastknight dot com)
it would have been if thay had used an ad-hoc network....
It would have saved 1/6 of the keyspace.
The secret of success is honesty and fair dealing. If you can fake those, you've got it made. (Marx)
I still have my DESCHALL t-shirt. As I recall, we spent more time arguing about what the t-shirt should look like AFTER the key was recovered than we spent recovering the key. :) Here were my thoughts on the subject back then.
a 56-bit DES key was discovered, and its encrypted message decoded, by an ad-hok distributed network of computers, cooperating over the Internet
At least it wasn't an ad-hocked or ad-wocked network, that might have taken longer.
Cogito ergo Zorro. Sprechen sie das Donuts? Je parle Franglish. Que pasa, dude?
-- Tigger warning: This post may contain tiggers! --
succesor?
You will also want to check out Cracking DES the story of our building the real DES cracker, the machine on its own that was able to crack DES in just a couple of days, demonstrating finally that DES was not secure.
We also have a page about Cracking DES
Has it been over a year since you last donated to the Electronic Frontier Foundation
is oklahoma state university, you barbaraous heathens
It was the first distributed computing project I ever took part in, and as I was just setting up a lab full of then-screaming-fast P166 boxes, it seemed like a good way to test them out...
If everyone got their minds out of the gutter and started choosing decent key numbers I'm sure DES wouldn't be broken so quickly. ;-)
"Brute Force can be enjoyed by both nerds and non-nerds interested in cryptography or codes." So ... nerds. ;)
Who doesn't like free music?
Actually, SETI@Home runs like http://www.distributed.net./
He said, "You'll be able to tell your grandchildren that you helped assemble the first NT supercomputer," and I cringed.
We got quite a yelling at a while later, but we spiked our ranking up quite a bit that weekend, which was all that mattered. ;-)
How did you manage to get though that whole review without mentioning the distributed.net or the EFF, who also cracked DES. Yet you metion SETI@home many times which was started years after DESCHALL, EFF, and distributed.net, but has little resemblance to any of them.
:)
Amusing, now go install Folding@home
- Adam L. Beberg - The Cosm Project - http://www.mithral.com/
That guy was my Lisp instructor at OSU (Ohio). Nice guy, knows his Lisp. I just thought I would throw that out there, moving on.
Why is the text "functional programming" linked to the Slashdot front page in the review?
"Yields falsehood when preceded by its own quotation" yields falsehood when preceded by its own quotation.
Every time someone mentions brute-force attacks against encrypted data, all I can think of is the growing number of computers that part of remote controlled botnets.
I imagine that brute-force encryption attacks by anyone with a direct or indirect connection to a 20,000+ node net are alarmingly easy.
So what was the message that was decoded?
I was involved (VERY slightly) in an effort called the "Distributed Internet Crack" to brute-force the keyspace of 48-bit RC5 in February 1997.
The project was the brainchild of Germano Caronni, a member of the Swiss Federal Institute of Technology in Zuerich.
The Distributed Internet Crack would be an immediate predecessor to DESCHALL, which started only 8 days after DIC successfully cracked 48-bit RC5.
The possibility of cracking DES is mentioned in the Distributed Internet Crack FAQ: "Paul Foley estimates that DES would be approximately 70 times more difficult to solve than 48-bit RC5". DIC solved 48-bit RC5 in about 13.5 days whereas DESCHALL took about 120 days (obviously with many more computers involved).
My impression at the time is that DIC and it's immediate predecessor, which involved much the same team and cracked 40-bit RC5 in 3.5 days, were among the first to use this sort of distributed computing (involving volunteered computer time, coordinated via the internet) on such a large scale. I'd be very interested in learning about any predecessors of these projects.
Reading over the FAQ for the Distributed Internet Crack is actually quite interesting after all these years. You can still see it here:
Also a press release on the project's successful conclusion:
Some quotes from the FAQ:
Solution: 74 a3 53 cc 0b 19
Time: from start of contest until Mon Feb 10 18:52:23 1997 (a little over 13 days)
Method: again, massive distributed coordinated keysearch
The Distributed Internet Crack is harnessing the power of thousands of computers over the internet to crack an encryption challenge offered by RSA Laboratories. The group first attacked the 40-bit RC5 Challenge, cracking it in about 3.5 hours
The Distributed Internet Crack broke new ground in several areas:
I thought it was an ok game, but I never thought they'd bother making it into a book!
R.
...like the UD one did?
Grammar Zealotes: please spare a non-english writer
/runs
I probably shouldn't say this, but it's spelt Zealots...
This sig all sigs devours
The only project they list is the Human Proteome Folding Project.
I know the UD client had some issues, which is why they dropped off of the face of the earth for awhile. I personally stopped using it because every time I installed it I ended up with an infected file on my hard drive. I never heard back from their support, so I don't know if it was a false positive, a corrupted mirror, or what. I just went back to SETI. So far this one has been okay. I mainly run it because, as I mentioned, it's kosher on my work desktop.
Xbox reviews.. We think they're funny.