Re: Can we kill single DES?

On Tue, 1 Oct 1996 16:27:18 -6, Peter Trei wrote:

>1. Is this a good idea? What will happen if DES becomes perceived
>    as insecure?

That's Declan's department (and other non-clueless journalists - declan is
just the most visible).   If it get's widespread and the target is something
like Digicash, it'd get picked up by the Crime/Snoozeweek crowd.

>2. What is the probability of success required to make it worth doing?

Judging by the people on the list, about 50%.... <g>

>3. What would be the consequences of failure?

Depends on the type of failure - ranging from dreadful to minor.

>4. What other platforms than NT/Win95/Pentium should be considered?
>   I could write a Unix demon version, but unless it's tailored for the 
>   cpu, a lot of efficency is lost
>   (The aggregate number of idle cycles available for testing is the 
>  crucial number).

A Linux port (Pentium) would be *very* good - lots of Linux people tend to by
pro-cpunk.  Ditto for OS/2.   And who knows, if you hyped the business
aspects enough you might even find IBM or some other large corp willing to
donate some time on large system.

>5. What's a good target? Ideally, we need a plaintext/ciphertext pair,

ecash, ecash, ecash!    Given all the attention anything that 'will give your
VISA number to evil hackers' gets, this is an important target.  It's serious
and newsworthy.

>6. What other incentives can be used to recruit machines?

Maybe give away a Pentium to the person who finds it? (Assuming donations
from list members, of course)

#  Chris Adams <adamsc@io-online.com>   | http://www.io-online.com/adamsc/adamsc.htp
#  <cadams@acucobol.com>		 | send mail with subject "send PGPKEY"
"That's our advantage at Microsoft; we set the standards and we can change them."
   --- Karen Hargrove, Microsoft (quoted in the Feb 1993 Unix Review editorial)

On Wed, 2 Oct 1996, Adamsc wrote:

> >1. Is this a good idea? What will happen if DES becomes perceived
> >    as insecure?
> 
> That's Declan's department (and other non-clueless journalists - declan is
> just the most visible).   If it get's widespread and the target is something
> like Digicash, it'd get picked up by the Crime/Snoozeweek crowd.

This is the meme I've been trying to spread -- that 56-bit DES is *not*
secure. This cuts through all the rhetoric about differences between key
recovery and key escrow, who's going to be in this industry alliance, etc. 

Bottom line: it sucks; your data are insecure; don't use it. That 
argument is one jlists can understand.

And I think I've been successful. Tomorrow's issue of a popular
newsmagazine may mention just this.

-Declan


// declan@eff.org // I do not represent the EFF // declan@well.com //

On Wed, 2 Oct 1996, Adamsc wrote:

> On Tue, 1 Oct 1996 16:27:18 -6, Peter Trei wrote:
> 
> >1. Is this a good idea? What will happen if DES becomes perceived
> >    as insecure?
> 
> That's Declan's department (and other non-clueless journalists - declan is
> just the most visible).   If it get's widespread and the target is something
> like Digicash, it'd get picked up by the Crime/Snoozeweek crowd.

Sorry, not a chance. The symmetric cipher used in Ecash is 3DES. Since 
DigiCash has the good fortune to be located in The Netherlands, full 
strength crypto can be (and is) used in all their products.

I would advise any company suffering from a loss of competitiveness due to 
US export regulations to do the logical thing and move their operation 
to a more suitable location.

--Lucky

On Wed, 2 Oct 1996, Adamsc wrote:

> A Linux port (Pentium) would be *very* good - lots of Linux people tend to by
> pro-cpunk.  Ditto for OS/2.   And who knows, if you hyped the business
> aspects enough you might even find IBM or some other large corp willing to
> donate some time on large system.

    Maybe Deep Blue gets bored in between its chess matches. :)

                       ________________________________
                      [ Bruce M. - Feist Systems, Inc. ]
                       ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
             'DISA information shows that computer attacks on the 
          Department of Defense are successful 65 percent of the time.
        The DoD, despite its problems, probably has one of the strongest
         computer security programs in government.' -GAO/T-AIMD-96-108

DB only has 64 Pentiums.  There are lots of small businesses with more
compute power.  Much more useful to sell IBM on the idea of a
Christmas Tree screen saver. :)

Adam

Bruce M. wrote:

| > A Linux port (Pentium) would be *very* good - lots of Linux people tend to by
| > pro-cpunk.  Ditto for OS/2.   And who knows, if you hyped the business
| > aspects enough you might even find IBM or some other large corp willing to
| > donate some time on large system.
| 
|     Maybe Deep Blue gets bored in between its chess matches. :)



-- 
"Every year the Republicans campaign like Libertarians, and then go to
Wasthington and spend like Democrats."

Vote Harry Browne for President.  http://www.harrybrowne96.org