🚀 go-pugleaf

In article <bontchev.725111504@fbihh> bontchev@fbihh.informatik.uni-hamburg.de writes:
>karn@servo.qualcomm.com (Phil Karn) writes:
>
>> >Does anyone have an opinion on the technical merits of RC2 and RC4?
>
>> Yeah. If NSA will let them out of the country, then they can't be very
>> good at all. It's as simple as that.
>
>Hmm... I've heard (rumours, rumours...) that thre is an exportable
>version of MailSafe, which is limited to 512 (or was it 540?) bit keys
>(or was it moduli?)... Does that mean that NSA can factor such
>numbers?... Would be a pretty serous advancement in mathematics, not
>just in cryptography... It would also mean that they find cracking the
>key easier than the other forms of attack... Could somebody in the USA
>check that there is indeed an exportable version of MailSafe and see
>what the max key size is?
>
I have a copy of the MailSafe manual sitting in front of me.  It's the U.S.
domestic version--and it says that the modulus size is 400 bits.  Also, "you
can purchase...files for generating larger keys from RSA Data Security...."
I have no idea about the exportable version.

Regarding RC2 and RC4, their primary claim to fame is that they accept
variable-length keys.  The NSA is willing to let them be exported as long as
the key length is less than 40 bits (or maybe it's 40 bits or less--I forget).
Some simple calculations should convince you that this key length is very
succeptible to a brute-force attack.

Some literature from RSADS counters that the key generation for RC2 and RC4
are very lengthy.  This doesn't mean much for encrypting large files--you do
the key generation once in the beginning, and then encrypt successive data
blocks.  However, if you are trying one key after another, this will greatly
increase the time required for a brute-force attack.  To me this is a red
herring.  It would be very easy to encrypt a commonly used block in every
possible key, and then store all the ciphertexts on a dozen or so magnetic
tape cartridges.  After that, a chosen-ciphertext attack with one ciphertext
block goes as fast as the tape I/O.

Bruce