🚀 go-pugleaf

In article <23.2B4A0D74@purplet.demon.co.uk>, Owen.Lewis@purplet.demon.co.uk (Owen Lewis) writes:
>         What first world government permits the use of DES for the protection 
>         of classified material? Does the US government? I believe not.

Definitely not in the U.S.  Bamford quotes Kahn (I think from ``Kahn on
Codes'', but that book is in my office, and I'm at home) as speculating
that there was a debate within NSA on how strong a putative DES should
be.  Certainly, they wanted to be able to crack it, but they also had
to ensure that enemies couldn't.  Remember that espionage against American
companies was (and is) a significant threat.

>  And while we are discussing theories, I believe James Bamforth, the NSA 
>  watcher, went on record some time ago with a claim that the cost to the US 
>  taxpayer for breaking each DES ciphertext is $56. Can anyone supply the  
>  assumptions from which he must have made this extrapolation?

These appear to be Diffie and Hellman's numbers.  That is, design a
brute-force cracker with a million chips at $10 apiece.  Double that for
power supplies, control circuitry, etc.  If each chip can do a trial
decryption in 1 microsecond, an average solution takes ~10 hours.
Depreciating over five years gives ~$5K per solution.  They then
noted that the cost of computation has been dropping by a factor of 10
every five years, so ten years later, the machine should cost $200,000
instead of $20,000,000, and each solution would cost $50.

I don't think that that projection has held up.  Chips of that sophistication
don't, I think, cost that little, even in such large quantities.  For a
more recent analysis of the cost of a brute-force cracker, see

@article{deswatch,
        author = {Gilles Garon and Richard Outerbridge},
        title = {{DES} {Watch}:  An Examination of the Sufficiency of the Data
                Encryption Standard for Financial Institution Information Securi
ty
                in the 1990's},
        journal = {Cryptologia},
        month = {July},
        year = {1991},
        volume = {XV},
        number = 3,
        pages = {177--193}
}

Their conclusion -- and I agree with it -- is that straight DES is
probably still useful for protecting individual sessions, but is not
suitable for encrypting keys.  Why?  An enemy can turn a cracker loose
on a single message, and -- at a considerable cost -- achieve a solution.
But that solution gives you the plaintext to a key distribution message,
which will let you recover the master key.  And after that, you're home
free.  They suggest using triple encryption for key distribution.