1. Announcements: Get your ch 1-2 quiz if you haven’t. Get your ch 1-2 quiz if you haven’t. Grading change: Grading change: Homeworks are mixed programming and written, makes no sense to separate them. Lumping 40% prog + 25% written into 65% homework. Homework 4 posted, couple details missing Homework 4 posted, couple details missingToday: Discuss tomorrow’s quiz Discuss tomorrow’s quiz Attacks on DES Attacks on DESQuestions? DTTF/NB479: DszquphsbqizDay 15

2. Tomorrow’s quiz For each problem, I’ll specify the algorithm: Shift Affine Vigenere Hill LFSR and attack: Ciphertext only known plaintext May require you to modify your code some on the fly Have your algorithms ready to run…

3. Breaking DES 1975: Whitfield Diffie and Martin Hellman’s proposition Whitfield Diffie Martin Hellman’sWhitfield Diffie Martin Hellman’s 1977: DES made the standard by NBS (NIST) 1987: DES’ 2 nd 5-year review. Acknowledged weakness. NSA offered to replace it. 1992: DES re-certified again! 1993: Michael Wiener’s proposed (special purpose) device

4. Distributed approaches to breaking DES 1997: DES Challenge issued. $10K prize Solved by Rocke Verser in ~5 months Solved by Rocke Verser in ~5 monthsRocke Verser Rocke Verser A distributed attack A distributed attack Found after searching ___% of keyspace Found after searching ___% of keyspace 1998: DES Challenge II Down to 39 days, 85% of keyspace! Down to 39 days, 85% of keyspace! Also in 1998…

5. DES Cracker Budget of only $200,000 1998 dollars vs $20,000,000 1977 dollars vs $20,000,000 1977 dollars Used mixture of software and hardware Discuss specialized hardware to prune keys Used assumptions about plaintext Used assumptions about plaintext Operated on 2 64-bit blocks of ciphertext Operated on 2 64-bit blocks of ciphertext Result? Cracked in less than 5 days

6. Post-DES Let N = 2 56 = 72,057,594,037,927,936 be the number of DES keys Brute force attacks that take O(N) DES computations are now reasonable. Can we just double encrypt to get O(N 2 ) computations? Use k1, k2 Use k1, k2 C = E k2 (E k1 (P)), so P = D k1 (D k2 (C)) ? C = E k2 (E k1 (P)), so P = D k1 (D k2 (C)) ?

7. Meet-in-the-middle attack Assume k completely determines E k and D k Know P and C = E k2 (E k1 (P)) P E k1 (P) (for all k1) C D k2 (C) (for all k2) Time complexity? O( n ) DES computations, O( n 2 ) comparisons O(n 2 ) memory

8. Triple-DES? Type DES computations ComparisonsMemory Brute force DES Double C=E k2 (E k1 (P)) O(N) O(N 2 ) O(N) Triple1 C=E k3 (E k2 (E k1 (P))) Triple2 C=E k1 (E k2 (E k1 (P))) Triple3 C=E k2 (E k1 ((E k1 (P)) Describe attacks on triple 1-3, fill out chart, and order by level of security