Slashdot Mirror
Can the NSA brute force RC6? Probably.
Anonymous Cypherpunk writes "The latest Cryptogram Newsletter has an interesting link to a paper about the feasability of building a RC6 cracking machine much like the EFF's Deep Crack DES cracker. The proposed machine would cost roughly $280 million and be able to crack a 64-bit key in an average of only 3.58 minutes. "
http://www.nsa.gov:8080/
"Providing and protecting vital information through cryptology"
Does anyone else find that ironic & hypocritcal?
Oh, and the NSA does have oversight. Not as good as I (nor many people) would like, but they do answer to congress and the DoD.
The NSA routinely refuses Congressional requests for information (on the occasions it IS brought to the attention of congress). That's not oversight, that's a sham.
Considering that a good secrecy tactic is to deliberatly leak damaging information to keep people from digging for disasterously damaging information, one must wonder what's going on there. Don't ask Congress, they don't know.
The president MIGHT know what's going on in the NSA. Consider though that this is an organization dedicated to digging up deep dark secrets, and that the president has an image (such as it may be) to uphold.
Looking at the balance of power in the above relationship, this is a recipe for disaster. It might as well have been designed to be corrupt. And We The People are supposed to believe that in spite of this, in 50 years time, the NSA has not become corrupt?
In theory, they could shut it down, but in reality it won't happen unless or until the consequences of NOT doing so outweigh having every dirty little secret revealed to the world (and a few total fictions as well).
I'm not sure that even a public opinion strong enough to guarentee that NOT shutting them down would mean being un-electable ,even as dog catcher, for life would be enough to counter having every last secret (including stealing a fig newton from mom's cookie jar at age 4) revealed to the world. This one may require villagers with torches and pitchforks.
We've seen stuff like this before. Does the name E.J.Hoover ring a bell? History is on the side of democracy -- without resorting to the "lynch mob" kind.
J. E. Hoover lived a full life, died a natural death, and was buried with full honors. All while nasty rumors (probably true) circulated everywhere. Those rumors were enough (at that time) to end any career in Washington unless extrordinary means were used to stay in power. I don't see how that helps your point.
J.E. Hoover was also a one man show. His death ended (as far as anyone knows) the extortion racket. The question is, in NSA's case is it one man (in which case it will go on until that man dies) or is it institutional? (in which case, only the 'lynch mob' will end it).
Keep in mind ( Re: Germany and strong encryption) that the NSA has a history of infiltrating corperations in Europe who make strong encryption equipment, and inserting fatal flaws into the design. That's how they decrypt diplomatic channels. The EU could seriously limit the NSA's power, but that would effectivly BE the lynch mob since the action would not be coming from those who supposedly have oversight.
One big goal in cryptography is to eliminate any such curve. Ideally, the keyspace and the cypher text both look like white noise.
Perhaps my definition of "lynch mob" is different from yours" (I'm picturing burning buildings, here).
I think I allowed my metaphore to cloud the meaning. The burning buildings will be more a figurative thing. I'll try to experss it better:
The NSA will not be shut down by an act of congress, the president, or the DOD. It will be shut down by consistant and loud public outcry. The leaders of the NSA may well feel as if the metaphorical angry villagers have surrounded them. The process will need to take place on several fronts. The people of the EU will have a role to play as well, by demanding that their governments withdraw support, facillities, and permission to base operations on European soil. There will probably be many angry words (even more than usual) in the U.N. over this.
Short summary, it can be shut down, but not by those who supposedly have oversight. It has grown too powerful for them.
All of this info is public knowledge, interestingly enough. 15-20 years ago, noone would even acknowledge that the organization existed. Now they recruit on college campuses.
My, how times have changed :)
It is an interesting question as to whether such an organization could, in ~50 years of dedicated work, defeat mathematical problems that have stood (in some cases, such as the factoring of large numbers) for more than 2000 years as either "extremely difficult" or "unsolvable". My money's on the notion that they're about 10 years ahead of public domain cryptography at this time. They're not gods, however. I'm betting they've probably gone quite a bit further in developing certain technologies useful for cryptography, such as quantum computing (if it can be done), photonics and quantum encryption.
However, it's important to remember that even an organization that could break DES or RC6 (or any encryption, for that matter) in minutes would be overwhelmed if everyone used encryption (real-time mass scanning of internet traffic, for example, would be impossible), and the NSA knows it as well -- this is one reason they've campaigned alongside the FBI to limit the spread of encryption technology.
As far as proof, there are three resources I've found on the NSA. The first is the book "Puzzle Palace" published in the late 70's/early 80's (I don't recall the publisher or the author). The second is the NSA's own website. And the third is hearsay, including alleged NSA employee manuals, etc. published on the 'Net. Needless to say, the last is the least credible.
I'd bet we'll see more possible NSA stunts in the future, as they work more closely with the FBI on high-profile cases that involve criminals and terrorists. Such instances, I would think, would be inherently more visible than the super-secret breaking of Russian launch codes.
Speaking of which, I heard not too long ago that the Russians use RSA encryption for their nuclear launch systems. That alone tells us something of the NSA's capabilities, or lack of same -- assuming it's true.
Kythe
(Remove "x"'s from
Kythe
64 bit and 1024 bit encryption generally refer to 2 different things. The 64-bit encryption is usually symmetric, and relies upon various mathematical convolutions. The 1024 bit encryption is usually a "public-key" encryption method, and is considerably easier to crack for a given key length. 128-bit RSA, for example (if such a thing were available) would be so insecure as to be virtually useless, whereas 128-bit IDEA or CAST is unbreakable, to the best of public-domain knowledge.
Kythe
(Remove "x"'s from
Kythe
I assume that you are reffering to distributed.net's effort in DES-III. At the time of that contest, we had about 40,000-50,000 'active participants' who had submitted blocks within the previous 30 days. Currently, we are working on RC5-64 and have about 67,000 participants who have submitted blocks in the past 30 days. Over the entire life of the RC5-64 contest, blocks have been submitted by 188,845 seperate email addresses, but as you can see, most of those emails are no longer active.
Jim Nasby
distributed.net
Just over 188 thousand people are involving their machines in the DES cracking effort. Nearly 900 thousand are participating in SETI@home.
What if SETI@home were just a ruse by the NSA to bust open encrypted messages? Package it as something exciting, get all those none-techie-geek people involved...
Ooh! Spooky! Hey... what's that sound? Is someone ther...
--
Don't like it? Respond with words, not karma.
dude, they arn't *actualy* doing this, this is just some guys thoughts on how much a computer like this would cost to build. there's no indication that the NSA, is building, will ever build, or hasn't already built such a device
_
"Subtle mind control? Why do all these HTML buttons say 'Submit' ?"
ReadThe ReflectionEngine, a cyberpunk style n
Funny to see that article by the EFF. They have no idea how much they have underestimated the NSA.
I used to work for a company called Annapolis Micro Systems (Annapolis, MD). They specialize in selling high performance configurable computing boards (both VME and PCI versions). These boards are especially suited to numerically intense algorithms (image processing, encryption).
It's no big surprise that the single biggest customer of AMS is the NSA. They routinely bought Wildfire arrays (see website) by the dozens. Two guesses as to what they were using them for, and the first doesn't count...
It must be emphasized what kind of power these arrays confer. Anyone familiar with configurable computing knows several things:
1) It's not for the light of wallet.
2) It requires a hefty design overhead for each application.
3) It presents the fastest known solutions to almost every NP-complete and iterative solution problem ever posed.
I am a hardware designer by trade, and I can tell you that is almost beyond my ability to measure what kind of processing power these boards can enable, purchased in groups.
Be afraid, be very afraid...
(Author's note: from my limited knowledge of encryption, keys larger than 1024 bytes probably aren't crackable by brute force in this day).
The opinions I post here have nothing to do with my employer.
Its much more interesting than the theoretical brute force machine.
:-) Or if I am, everyone will be doing the same cheat, until we all decide to fix the rules.
I like the quote about cheating. Been doing that all weekend. Great fun being accused of cheating when all you do is exploit a loophole in the rules. Don't know if I'll ever be invited back for a games night again
There is a good follow up about good security == good engineering.
And the JYA article is a simple extrapolation of the EFF's DES breaker to more bits. A quick look at the numbers and I don't think it would cost anywhere near as much to build a machine like that. And if a big three or four letter agency wanted to build a series of these machines, they would get their own chip foundry going, and the price would come down as time went on. Assuming the NSA has done that, you can imagine the cracking power they can throw against codes they haven't comprimised yet.
the AC
Hemos is like...sci-fi fans;he thinks technology is cool, but he hasn't bothered to understand the science it's based on