Re: Where is the key cracking farming software?

Dan Bailey <dan@milliways.org> writes on cpunks:
> There must be several versions of the code at this point.  The
> Cypherpunks release, Damien's release and whoever else wrote some code
> to do the chore.  If someone could pass me a pointer to the version
> that's best-commented and most understandable (one man's C is another
> man's crypto) I'd like to port it to Windows NT and write a simple
> installation to install it as a service.

Yep there's lots of versions of the brutessl software, ones I know of
(in no particular order):

- Damien Doligez wrote one
- Andrew Roos wrote on (this is the one we're using for the challenge)
- Eric Young wrote one
- I wrote one

More related softwares, specifications etc.

- Piete Brookes, Andy Brown, and I wrote a protocol specification for
  a SMTP style key doler - SKSP (Simple Key Search Protocol) - draft
  RFC like document on brute (www url below).

- Piete wrote a unix socket based key server and client for generic
  unix machines (in perl).

- Andy Brown wrote a Windows NT client which talks the same protocol

- David Byers did a MasPar port of the brutessl code

> 	Perhaps a general-purpose OO bruteforcing library (addition to
> Crypto++?) would be a good idea.  Just pass a pointers to the
> encrypt() and decrypt() functions to use for this session to the
> Cracker object, which in turn takes a number of bits and starts
> cracking.:)

The socket based key distributer allows you to write clients which
interact with the key server.  Take a look at Andy's code.

> 	The problem with this is the disparity among out-of-the-box encrypt
> and decrypt functions.  But I suppose it's nothing that couldn't be
> overcome with wrapper functions.  Just thinking out loud. :)

Not sure how Andy addresses this in the NT code (I don't have NT), but
for the unix client you'd just get another brute force program,
compile it and update the client.

Piete has a WWW URL for the software (the protocol spec is there too) at:

	http://www.brute.cl.cam.ac.uk/brute/

(Brute is a subsubdomain he set up for the purpose).

Also this:

	ftp://ftp.brute.cl.cam.ac.uk/pub/brute/

should work.

And the socket server runs on: sksp.brute.cl.cam.ac.uk (port 19957).

I think we're ready to start another challenge, this one a
collaborative project like the brute rc4 one.  Just need some
challenges now (asked Hal about this).

Adam

| Yep there's lots of versions of the brutessl software, ones I know of
| (in no particular order):
| 
| - Damien Doligez wrote one
| - Andrew Roos wrote on (this is the one we're using for the challenge)
| - Eric Young wrote one
| - I wrote one

| I think we're ready to start another challenge, this one a
| collaborative project like the brute rc4 one.  Just need some
| challenges now (asked Hal about this).

I think it is time this kind of software is outlawed! I mean, it is a 
criminal instrument, and the only good it does is to embarrase good
old well-meaning companies trying to make a profit. Besides, the 
customers should know better than to buy stuff over the net! And Netscape
said AS IS all the time, didn't they?

(Just joking! :-))

But seriously, I wonder how long it will take before bruteXXX programs 
will be classified as "criminal instruments"? As well as real good 
random generators, I guess? (I don't think they will outlaw the XOR
op, so to get rid of one-time-pads they have to go for the random gen...)

/Christian

-----BEGIN PGP SIGNED MESSAGE-----


This may be more of a computer science question than a cryptography
one, but it seems relevant to the current discussion:

What is the current technology for running large compute-intensive
jobs accross a whole lotta computers?  Specifically, what's the best
way to run something like a big key-cracking job on a farm of
workstations?  Run separate jobs on each machine that check in to a
main server for new keys to crack?  Or is there a better way?

Also, on the note of producing a cheap parallel setup: a simple 90MHz
pentium motherboard is ~$150.  A cheap network card is under $50, and
I'll bet it's possible to build a custom power-supply that'll juice a
whole bunch of motherboards for under $200.  You don't need monitors
or keyboards for these machines -- just one of each to plug into the
various machines to troubleshoot. Thus, the incremental cost of adding
another pentium to a big cracking job is about $200 -- the startup
cost is the cost of the distributed power supply, monitor, keyboard,
etc. plus one server.  And it's even cheaper to build this sort of
setup if you go to someone who knows what s/he is doing, and can put a
whole lotta CPUs onto one motherboard...

The point is, that while one pentium can't do a whole lot, it's pretty
cheap to build a DIY pentium "farm."  And if a whole lot of people
have these farms, and are willing to run distributed cracking jobs on
them, computing power like that of the systems used in the RC40 crack
is very easy to come by.

Finally, there is a factor that hasn't been touched on much yet.
Credit cards are not the crux of the problem: in the years to come,
there will be more and more ways to manipulate money on the net.
Charles Schwab is already working on a way to trade stocks wholesale
over the net (or have they already started?), and I know of a couple
other companies that have plans in the works to do the same.  If it's
possible for a small group to break one of *these* keys in a
relatively short time (a month or two, I suppose), the money at stake
could be well worth the compute time involved.


- -sq

-----BEGIN PGP SIGNATURE-----
Version: 2.6

iQCVAwUBMDTPE1IP+Y8TPTdtAQGf3wP/f+X6nCvFqnqtdjUv4JqV3AMZVTXaf1At
TCvP8DByrbRH/Yo/1PQvtOkLIcmII1meI0FQjLRsE13EL5KNZoppyAkcCTl5Rr92
bsrHZsZLI3cYry9YZP/m1XthrrZg5ppePIbfOiUzqoCYHCUvqlhJyTRl00Y4lZP4
+mLYuDh1Rps=
=+Tij
-----END PGP SIGNATURE-----

A couple of months back, someone (Adam Back, perhaps?) made mention of
work on secure, reliable distributed computing on untrusted networks
of untrusted machines. I seem to remember mention of sending out bogus
computations in order to obscure the actual computation being
performed.

I was never able to follow the reference, since all the info available
was the name of a Japanese professor, with no mention of the
university or of any publications I could look up.

Does this work ring a bell with anyone else?

nathan