🚀 go-pugleaf

cbbrowne@csi.uottawa.ca (Christopher Browne) writes:

>If it "only" costs $56, then they must have some CHEAP ways to break
>DES, unless they're COMPLETELY ignoring the cost of computer
>resources.  In short, for $56 a pop, they can't be using brute force.
>Maybe they can use differential analysis.  Maybe they can use
>something analogous to D.A.  But for $56 per pop, they're either
>lying, or they have SOME "silver bullet."

Of course, the risk of a trap door has never been completely 
negated.  However, notable experts disagree with you about the
cost of a brute-force attack.  Dr. Hellman (see my previous post)
maintains that it costs between $10 and $100 to break a DES key
by brute force (if you can afford the $1M to $10M startup costs,
and if you keep the DES-breaking machine continuously busy).  

Dr. Ron Rivest (the "R" in RSA) also gave a talk where he showed
the following:

          DATE 
BUDGET       | 1993   2003   2013
      -------|------|------|------
      $25K   | 47   | 52   | 57
      -------|------|------|-----
      $25M   | 60   | 65   | 70
      -------|------|------|-----
      $25G   | 73   | 78   | 83

The cells represent the bit-size of the largest key that an
organization with a certain-size budget could afford to break
by brute force.  It was assumed that decryption times would be
about the same as for DES.  Thus, a small country, a drug cartel,
or anyone else with $25M to spend could afford to brute-force
attack DES (which has 56 bits - less than 60).

Interestingly enough, exportable crypto implementations (40 key-
bits or less) can be broken by the local cops, a group of grad
students, or anyone else with $25K to spend.

The French equivalent of NSA has made it public that they consider
it their duty to spy on American firms and give the data to French
firms.  They could afford the $25G.

He made a similar table for RSA keys:

          DATE 
BUDGET       | 1993   2003   2013
      -------|------|------|------
      $25K   | 400  | 450  | 550
      -------|------|------|-----
      $25M   | 600  | 700  | 850
      -------|------|------|-----
      $25G   | 900  | 1050 | 1200

So, 512-bit RSA keys aren't looking so great anymore.  1024-bit
keys seem barely adequate in this light.  2K- to 3K-bit RSA keys
seem prudent to protect any data that you are seriously 
concerned might be attacked by a big-budget ($25G) enemy.

-- 
Peter K. Boucher
--
RIPEM public key available upon request.