Slashdot Mirror
New Attack Against Multiple Encryption Functions
An anonymous reader sends word of a paper presented a few days back by Adi Shamir, the S in RSA, that promises a new form of mathematical attack against a broad range of cryptographic ciphers. The computerworld.com.au report leans heavily on Schneier's blog entry from the Crypto 2008 conference and the attached comments. Shamir's paper has not been published yet. "[The new attack could affect] hash functions (such as MD5, SHA-256), stream ciphers (such as RC4), and block ciphers (such as DES, Triple-DES, AES) at the Crypto 2008 conference. The new method of cryptanalysis has been called a 'cube attack' and formed part of Shamir's invited presentation at Crypto 2008 — 'How to solve it: New Techniques in Algebraic Cryptanalysis.' The new attack method isn't necessarily going to work against the exact ciphers listed above, but it offers a new generic attack method that can target basically formed ciphers irrespective of the basic cipher method in use, provided that it can be described in a 'low-degree polynomial equation'... What may be the biggest outcome from this research is the range of devices in widespread use that use weaker cryptographic protection, due to power or size limitations, that are now vulnerable to a straightforward mathematical attack."
I store all of my passwords in plain text!
I talk about stuff.
The summary is blatantly wrong. Take a look at the schneier blog post (from 3 days ago) and the second update: this attack only works against LSFR encryption of a low order, which means that none of the schemes mentioned in the summary are actually affected.
Now, if I were to actually RTFA, I would know whether the article was slow on the uptake or slashdot, and whether or not they should have known that the attack wouldn't affect the major algorithms, just smaller ones. Either Slashdot's dead wrong on this or computerworld is, and I'm not sure which one's more likely.
As Schneier wrote (emphasis mine): "this attack doesn't apply to any block cipher -- DES, AES, Blowfish, Twofish, anything else -- in common use; their degree is much too high." Now, correct the misleading summary (or be uninformed FUD spreader like Computerworld).
Does this mean, can I finally recover the data encrypted by the Gpcode virus?
One of our competitors trademarked the term "hypothesis". From now on, we will call them "boneheaded ideas".
An order of magnitude improvement in cracking a 56bit key would be significant. However, most of us use far greater key-spaces and only flaws in the crypto itself or the container is the real threat. It is however interesting when anybody can make a massive improvement in cryptoanalysis. A 10x improvement would make cracking 40bit 'consumer-grade' (such as GSM and DECT) crypto trivial on the latest processors. The most likely application is to give governments easy access to snoop 'private' phone and data conversations.
This is not threatening to me at all. I don't really see the need to encrypt phone calls in the first place. It is absolutely essential to encrypt other data. This seems to be because there is a social taboo about tapping phones, but not so much so with data. Therefore all system admins must use SSH and others should consider it too.
The real threat is the quantum computer, if it exists in a practical form. If that is the case, there is one complete solution -- The awkward 'one-time pad'.
I do one better. I use inkblot tests. I can leave them in plain sight and their totally secure.
Co-worker: Your password is "flower"?
Me: What? No. It's "zombie clown hitting fish with hammer". What's wrong with you?
Those who believe the Internet is private,
find their privates are on the Internet.
I'm sure this post is encrypted...If only there were a way to use Schneier's algorithm...Wait...Got it! Here is the decrypted text:
Help fight poverty: Punch a poor person.
Me too. It's ******
What?
Your password is hunter2?
Nonsense. The real solution is to get a court order banning the guy from giving his presentation. After all, as has been demonstrated just recently, court orders are the preferred means of securing anything.
The world's burning. Moped Jesus spotted on I50. Details at 11.
ENCRYPTION IS CUBE
cube have 4 sides
1 side = 1 encryption stage
ENCRYPTION STAGE IS TIME
TIME IS CUBE
THEREFORE ENCRYPTION = TIME
time slowed by day/night on planet corners
move algorythm to cube corners to solve in limited time
move algorithm to cube centers to unsolve in unlimited time.
I saw the talk. The cube attack was very impressive: it allowed Shamir to break a fairly difficult-looking toy cipher (constructed, of course, to have an Achilles heel, but still probably impossible to break with other known techniques). He used only one bit per packet (with a million packets) and didn't use any particular knowledge of the cipher's internals.
However, as presented the attack probably only breaks toy examples. Its real-world applicability will depend on how well Shamir and Dinur manage to adapt it to ciphers which don't have this simple structure. For example, it will be difficult to apply the attack to either hash functions or block ciphers, because their iterated design tends to give them high degree. The attack will also be difficult to adapt because of its low tolerance for noise and its applicability to a narrow range of scenarios. Still, Shamir believes that it will be applicable at least to some modern stream ciphers, so I'll be keeping an eye out for the full version.
I hereby place the above post in the public domain.
...password ... like 1-2-3-4.
So the combination is one, two, three, four, five? That's the stupidest combination I've ever heard in my life! The kind of thing an idiot would have on his luggage!
Apologies to Rick Moranis and Mel Brooks.
That said, what's the difference between lower case numbers and upper case numbers?
--sabre86
"Honey, we've simply GOT to have all this porn.... to recover our hard drive!"
Kudos to the individual that can pull THAT line off...
Don't tell me to get a life. I'm a gamer; I have LOTS of lives!
While finding collisions quickly does indeed show MD5 has weaknesses, no one has found a efficient way to match an existing checksum. For most that's the definition of completely broken.