Re: Bias in ACM and IEEE articles on cryptography

Thread View: sci.crypt

3 messages

[T] Back to Threads [V] Tree View [G] Group Articles

3 total messages Started by "Don Coppersmith" Wed, 26 Aug 1992 14:27

#670

Author: "Don Coppersmith"
Date: Wed, 26 Aug 1992 14:27

14 lines
975 bytes

Andrew Haley ( ahaley@eoe.co.uk ) writes:

>                                    There's no point in using any more
> key bits, because differential cryptanalysis will find the subkeys in
> 2**47 operations whatever the key length.
........----------

The Biham-Shamir work requires 2**47 _chosen_plaintext_ messages,
not just that many operations.  Running 2**47 > 10**14 messages past
the machine that contains the secret key is _much_ trickier than doing
that many operations on your own machine.  This respresents massive
data that you've got to get out of your opponent's machine!

Don Coppersmith

Re: Bias in ACM and IEEE articles on cryptography

#682

Author: Uri Blumenthal
Date: Wed, 26 Aug 1992 20:44

23 lines
1589 bytes

In article <9208261429.AA00938@ucbvax.Berkeley.EDU>, copper@WATSON.IBM.COM ("Don Coppersmith") writes:
|> 
|> > There's no point in using any more key bits, because differential 
|> > cryptanalysis will find the subkeys in 2**47 operations whatever 
|> > the key length.
|> 
|> The Biham-Shamir work requires 2**47 _chosen_plaintext_ messages,
|> not just that many operations.  Running 2**47 > 10**14 messages past
|> the machine that contains the secret key is _much_ trickier than doing
|> that many operations on your own machine.

Sure. But I think they suggested the method of "converting" chosen
plaintext message attack inot *known* plaintext attack, with about
2**49 known plaintexts required...  They assume, that if  you have
sufficient amount of *known* plaintexts -  you'd be able to choose
from it...   Comments?  

[BTW, I can't recall the exact amount of messages needed, sorry.]
--
Regards,
Uri.		uri@watson.ibm.com
------------
<Disclaimer>

Re: Bias in ACM and IEEE articles on cryptography

#693

Author: Andrew Haley
Date: Thu, 27 Aug 1992 09:29

25 lines
1606 bytes

copper@WATSON.IBM.COM (Don Coppersmith) writes:
: Andrew Haley ( ahaley@eoe.co.uk ) writes:
: 
: >                                    There's no point in using any more
: > key bits, because differential cryptanalysis will find the subkeys in
: > 2**47 operations whatever the key length.
: ........----------
: 
: The Biham-Shamir work requires 2**47 _chosen_plaintext_ messages,
: not just that many operations.  Running 2**47 > 10**14 messages past
: the machine that contains the secret key is _much_ trickier than doing
: that many operations on your own machine.  This respresents massive
: data that you've got to get out of your opponent's machine!

Yes, I should have mentioned that, but as a design principle of
cryptosystems I would have thought that there shouldn't be any
possible chosen text attacks which involve less encryptions than
exhaustive search.  There should not be more key bits than needed to
prevent the opponent's best atack, simply as a principle of economy.

Anyway, my original point is still valid; DES is secure as far as any
of us know (and I'm sure you know better than most) and dual key
triple encryption usefully extends the key of DES for long term use.

Andrew.

Thread Navigation

This is a paginated view of messages in the thread with full content displayed inline.

Messages are displayed in chronological order, with the original post highlighted in green.

Use pagination controls to navigate through all messages in large threads.

Back to All Threads