GAK cracking?

Just days after a U.S. graduate student cracked the most powerful
computer encryption system allowed out of the country, the Commerce
Department announced it would allow three companies to export an
even stronger system. 

Until this year, computer encryption programs, which scramble 
information and render it unreadable without a password or software 
"key," were classified as munitions and stronger programs could not 
be exported. 

But under a controversial new Clinton administration policy that took 
effect Jan. 1, companies may receive permission to export stronger 
programs. 

"I'm happy that we've been able to do this within the first month 
without rancor or difficulty," Under Secretary of Commerce for Export 
Administration William Reinsch told Reuters in a telephone interview. 

To export stronger programs immediately, companies must agree to 
incorporate features within two years allowing the government to 
decode encrypted messages by recovering the software keys, however. 

The administration's policy has been widely criticized as not 
relaxing the export limits enough and some companies feared the requirement 
for a two-year plan would substantially delay export approvals. 

The quick approvals should quell some of the criticism and encourage 
more applicants, Reinsch said. 

"As a result of this, you will have more companies taking it
seriously and we will expect more plans over the next couple of
months," he said. 

Encryption was once the realm of spies and generals. But with the
explosion of online commerce on the Internet, encryption has become
a vital tool for protecting everything from a business' email
message to a consumer's credit card number sent over the net. 

The amount of protection afforded by encryption is largely a function 
of the length of the software key measured in bits, the smallest unit of 
computer data. 

Companies said products with just 40-bit long keys, the old limit, 
were too easy to crack. The approvals came just days after Ian Goldberg, a 
graduate student at the University of California, cracked a message 
encoded with a software key 40-bits long. 

The government did not name the companies given permission to export 
stronger, 56-bit programs, but Glenwood, Md.,-based Trusted 
Information Systems acknowledged that it was one of the three.

On Mon, 3 Feb 1997, tmcghan@gill-simpson.com wrote:

> Just days after a U.S. graduate student cracked the most powerful
> computer encryption system allowed out of the country, the Commerce
> Department announced it would allow three companies to export an
> even stronger system. 

[snip]

> Companies said products with just 40-bit long keys, the old limit, 
> were too easy to crack. The approvals came just days after Ian Goldberg, a 
> graduate student at the University of California, cracked a message 
> encoded with a software key 40-bits long. 
> 
> The government did not name the companies given permission to export 
> stronger, 56-bit programs, but Glenwood, Md.,-based Trusted 
> Information Systems acknowledged that it was one of the three. 

Why does it not surprise me that TIS gets permission to export 56-bit (DES?) ?
They do key recovery (is it GAK?) They brag about government consulting. The
clients they will admit to having are listed on:
http://www.tis.com/docs/products/consulting/govt/govcon.html
and, purely unsubstantiated rumors here, but I've heard (seen) TIS, NSA, FBI 
and other  "friends" of ours all together in the same paragraph. Conspiracy?
Maybe... This is both good and bad.... yes, longer codes are now exportable,
but only to / by certain people?

I notice that the new cipher length is 56 bit...same size as DES? hopefully
that's just a coincidence (yeah, right) or maybe somebody's starting to see
the real world where people download pirate cryptosystems and says "so let's
export bigger ones and make a buck off it, too..." (yeah, right)


PLUR
chris
--
Chris Kuethe <ckuethe@gpu.srv.ualberta.ca> LPGV Electronics and Controls
        <c100305@wolfcreek.cs.ualberta.ca> http://www.ualberta.ca/~ckuethe/
RSA in 2 lines of PERL lives at http://www.dcs.ex.ac.uk/~aba/rsa/          
print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>   
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc`