Slashdot Log In
NIST Proposes Abandoning DES
Posted by
michael
on Thu Jul 29, 2004 12:37 PM
from the thanks-for-all-your-hard-work dept.
from the thanks-for-all-your-hard-work dept.
Mr. Manometer writes "With little fan-fare, NIST proposed yesterday to withdraw the Federal Information Processing Standard (FIPS) for the Data Encryption Standard (DES) with a Federal Register notice (pdf). NIST is encouraging federal agencies to use the Advanced Encryption Standard (AES) instead since they feel that DES is 'now vulnerable to key exhaustion using massive parallel computations.' We all knew this day would come as computers got faster & cheaper... and this should put more pressure on folks to use stronger encryption techniques with is a good thing." Some would argue that DES has been insufficient for some time now.
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
NIST endorsement of DES (Score:5, Informative)
In '76 Lucifer was adopted and renamed "DES". Of course as computers became faster and more powerful, it was recognized that a 56-bit key was simply not large enough for high security applications. As a result of these and other serious flaws, NIST abandoned their official endorsement of DES in 1997 and began work on a replacement, to be called the Advanced Encryption Standard (AES). And so the story continues...
DES3 (Score:3)
Not that I'm saying we should cling to DES for the next hundred years. I'm all about AES.
Re:DES3 (Score:5, Informative)
In other words 2-DES is not significantly more secure than DES, but 3-DES makes the meet in the middle attack more difficult. You can no longer meet exactly in the middle, but you could meet with 1 cipher on one side and 2 ciphers on the other side. That way you have to brute force the 2 ciphers and that way 3-DES presumably give you the security of a 112 bit key. This is also why you normally only use two different keys for 3-DES. The third key would add no extra security.
But 3-DES have inherited one of the weaknesses of DES. The block size is still only 64 bits. That makes you vulnurable to birthday attacks. For this reason I always advice against using the same 3-DES key for more than 512KB of data. With a 128 bit block like AES uses, a key can be safe for use for longer time, I would say 64GB should be secure.
Parent
Re:DES3 (Score:3, Informative)
Encryption is a litle more than just using a cipher. You need some mode of operation. ECB mode where you just split your message into 64 bit blocks and apply the cipher to each is weak. The problem is, that an attacker can easilly see which blocks contains the same cleartext, because they will all result in the same ciphertext. I once saw this illustrated by encrypting some black and white image where each 8x8 pixels where encrypted using DES in ECB mode. In
Re:DES3 (Score:5, Informative)
now, to really mess it up - the effective key length of 3DES is 112 bits, because only 2 keys are actually used, key A and B. Encrypt with A, then B, then A.
Parent
Re:DES3 (Score:3)
Sorry, you are thinking of DES2. DES2 uses two keys, and works like this Encrypt with A, decrypt with B, Encrypt with A. I'm not sure on the specifics, but using three encryptions makes it possible to exhaustivly search for A and B on their own, while using a decrypt (As far as is known) requires all combonations of A||B to be exhausted.
DES3 does, in fact, use 3 keys, and is encrypt with A, encrypt with B, encrypt with C.
Further clarification (Score:3, Informative)
However, using 3 keys with any cipher only squares the time to key recovery, regardless of whether the first key and the last key are equal. Assuming you know both the plaintext P and ciphertext C for a given message, compute a table of all possible results of encrypting P with keys 1 and 2, and a table of all po
Re:NIST endorsement of DES (Score:5, Informative)
Parent
arrggghh... (Score:5, Funny)
.... I was going to write a long, well thought out reply to this story but the IT colour scheme is causing acid flashbacks.
The horror... the horror...
As a self-appointed representative of ... (Score:5, Funny)
I'm not one to point fingers, but if they do have to be pointed, they should be pointed at Mushrooms or toad licking. Not acid.
Parent
Re:arrggghh... (Score:5, Insightful)
I seriously thought the sarcasm about the crappy color scheme was going to get old after a while, but actually it still seems appropriate. For Vishnu's sake, change the friggen colors!
Parent
Now I'm going to have to go back to ... (Score:5, Funny)
Wait, ...ugh..., I didn't write that and more importantly, you didn't read it. It never happened. Nothing to see here. Just move on now.
Re:Now I'm going to have to go back to ... (Score:3, Funny)
It was bound to happen eventually. (Score:5, Insightful)
Which is why... (Score:5, Funny)
Parent
Re:Which is why... (Score:5, Funny)
You mean a one time pad [wikipedia.org]?
Parent
Re:Which is why... (Score:5, Informative)
You mean a one time pad?
You cannot use a one time pad forever. The name should be a pretty good hint about that. Unfortunately reusing a one time pad is suggested again and again by people not fully understanding what it is all about. In many cases a one time pad is unrealistic because you have to exchange new keys over a secure channel. And usually you want to use the one time pad because you don't have a secure channel. But actually some secure channels exists that can be used to exchange the key, but cannot be used for the data transfer. One such example is seen in quantum cryptography.
However though a one time pad is unconditionally secure, it only guarantees secrecy. Integrity is an interely different matter. Luckily there also exist unconditionally secure MACs for that, and they are a lot more realistic than a one time pad, because the key is smaller and most of the key can be reused. This is very important because without integrity over a clasical channel, even quantum cryptography would have been vulnurable to a man in the midle attack.
But quantum cryptography is not the only way to exchange a one time pad. Other unrealistic ways to exchange a one time pad is using either noisy channels or assumptions about memory bounded adversaries. I call them unrealistic because they are both based on somewhat unrealistic assumptions and require extreme amounts of data to be transfered to create a small one time pad. The most realistic way to exchange a one time pad probably still is to do it in advance. In some cases the exchange in advance makes a lot of sense. Think for example wireless equipment. You'd consider a wire to be secure, but it is inconvenient. But you still have to connect a wire occationally to recharge your battery, at the same time a one time pad could be tranfered over a faster and more secure wired link.
Parent
Computation power?? (Score:5, Insightful)
It is interesting to note that they recommend using a faster algorithm.
Of course us, of the tin-foil-hat, brigade know that the government has a very secure algorithm (gotten from area 51), but they never tell us about, just so we use an algorithm that we think is secure, but they have their own back-door.
Man, they are cruel (Score:5, Funny)
Let's hope we'll never see ICQ and Windows ME on that list.
YES!!! (Score:5, Funny)
Re:YES!!! (Score:3, Funny)
In a related story, a mysterious female named "Alotta Patootie" was detained at a northern border crossing on suspicion of ill intent. Formal charges have not been anounced, but the woman did try to seduce four CBP (Customs and Border Protection) agents and succeeded in kicking a fifth in the tallywhacker.
NIST already said DES isn't sufficient (Score:2, Informative)
It will be AES's time before long anyways, with quantum computing these algorithms become fairly useless.
What about triple DES (Score:4, Insightful)
Re:What about triple DES (Score:3, Interesting)
Say what you will about DES, but please ... (Score:3, Funny)
Whenever this is any doubt about the structural integrity of any item (from little glass figurine to 18 wheeler transporting corrosive chemicals), slap some duct tape on it. And then a little bit more. You'll be gla
Re:Say what you will about DES, but please ... (Score:3, Funny)
But, hey, get with the program dude, you forgot to mention the plastic.
And don't forget, WD-40 has a role also.
Re:What about triple DES (Score:3, Insightful)
1) DES has been around a long time. People have attacked it for years, with every new and old technique of cryptanalysis. DES was created by IBM with help (no, really!) from NSA -- it was NSA that proposed adjustements in the S-Boxes that made DES more resistant to differential cryptanalysis. DES has proven to be secure, except for the obvious key-length problem, in the very best way you can prove an algorithm secure -- by having the best minds on the plane
Re:What about triple DES (Score:3, Insightful)
Indeed. It is one thing for NIST to recommend that everyone using software implementations of DES should change to something else (although it appears that they are actually only recommending it to government users). It is a very different thing to deal with the millions of consumer devices out there with hardware DES which would have to be replaced.
Re:What about triple DES (Score:3, Interesting)
When the S-box attacks came out in the 90s or so, people thought DES might be vaunerable to it -- but the adjustments the NSA had made decades before to the standard prevented its vaunerability.
That's impressive. Did they know, or was it just lucky.
Re:What about triple DES (Score:4, Informative)
Parent
Re:What about triple DES (Score:3, Informative)
Effective strength of 3DES: about 90 bits (Score:3, Informative)
http://th.informatik.uni-mannheim.de/People/Luc
Re:What about triple DES (Score:3, Informative)
If you could try one key at every clock cycle, which would be amazing in and of itself, it would take you 54,844,652,936,586,090.5 years of computation on a 3 GHz machine to try every key. If you take half
I nominate this for understatement of the day (Score:5, Insightful)
Yeah, like since the day I first heard about it, back in 1995.
Isufficient for what? (Score:4, Insightful)
Insufficient for what? I hate to play semantics, and I'm no cryptographer, but as I understand it, the inadequacies of an encryption algorithm are primarily defined by the implementation and the reason for it [application]. OK, it's a weak cipher, but in certain instances, it may still be useful. Right?
Re:Isufficient for what? (Score:3, Insightful)
Re:Isufficient for what? (Score:3, Insightful)
Insufficient for what?
What it boils down to is that DES has a fixed key length of 56 bits. Sure, you can 3DES it but you've also tripled the number of computations you have to do for every block of data. So while DES's key size has remained fixed, computing power is expanding at Moore's law. So, inevitably, computing power will overwhelm DES's practicality. It's just a matter of time (read: now). While AES, on the other hand, allows you to expand the key size from 128-bits by 64-bit blocks. So we
Good! (Score:4, Funny)
I've been using AES-256 on all my projects that deal with sensitive data since ohhh -- 2001.
Considering that DES has been relegated to hack toy status for some time now and triple-DES is only marginally better since it's just DES encryption done threefold I think this is a very wise but belated move.
And when Hollywood even makes fun of an encryption grade by showing a guy breaking it in 60 seconds while getting a BLOWJOB, you KNOW it's time to stop using it!
Re:Good! (Score:3, Informative)
Disallowed for .se use for a while (Score:3, Interesting)
Critics proven right (Score:4, Informative)
Diffie is probably best renowned for his methodology known as knapsack encryption. This was alternative to RSA which was computationally prohibitive in the early 1980s.
I remember my having difficulty in my old college days in obtaining a copy of RSA. My school had to obtain a copy of their paper from MIT through inter-library loan. I had not realized that RSA would gain such widespread adoption because ITAR would prevent international implementation for any US-based company.
Corrections to the above history (Score:4, Informative)
There were no ITAR limits on key length. The law simply stated that you needed a license to export products that included cryptography; strictly interpreted that would have included a Secret Decoder Ring. It wasn't until Lotus wanted to export Notes with crypto built in that the NSA got involved in the process of making it possible for products that used crypto to be granted export licenses by demanding features such as CDWF, which made it easy for the NSA to break messages while keeping it hard for everyone else.
Lucifer was vulnerable to a differential cryptanalytic attack that reduced the effective key strength to around 56 bits. However, IBM and the NSA kept their knowledge of DC secret until Biham and Shamir rediscovered it in 89.
RSA was invented later. It was never prohibitively slow, though of course it's got much faster over the years.
If you wanted a description of RSA, why didn't you just buy a copy of Scientific American, where it was first published in Martin Gardener's "Mathematical Games" column?
Parent
Re:Critics proven right (Score:3, Informative)
I would think that he is known for Diffie-Hellman key exchange [wikipedia.org], especially since Hellman created the knapsack encryption
Diffie-Hellman key exchange is done every day when one makes a ssl or ssh connection.
But who wants a totally secure system? (Score:5, Interesting)
This is actually a valid point about intelligence. Although it's obvious that there are places where uncrackable encryption should be used if at all possible, there are many others where disinformation can be used to great effect. An example is where a message crackable in finite time is allowed to be intercepted because by the time it is decrypted it is too late to take action, the object being to build up the credibility of an information source prior to shovelling out a great load of disinformation. I believe this technique was used ahead of the D-Day landings as part of the plan to persuade the Germans that the invasion would actually be in the Pas de Calais.
For this reason I would have thought it was unwise for official bodies to make statements about the use of different forms of encryption - unless it's a double bluff and DES will continue to be used for short-life messages.
Tinfoil hat? Stress-relieved oxygen-free copper plated mumetal in my case.
Cracking yesterday's secrets? (Score:4, Insightful)
To future-proof secrets, you'd have to encrypt at a level that not only would be ridiculously expensive to crack today, but as long as you need to keep them, well, secret. Imagine some of the files from the time of the UNSC's Iraq debates a year-and-a-half ago getting cracked today or before the next US presidential election.
Re:Elliptic Curve Cryptosystem... (Score:3, Informative)
Re:Elliptic Curve Cryptosystem... (Score:5, Informative)
DES and AES are symmetric ciphers, where you use the same key for both operations.
The two forms of crypto have different uses, and ECC isn't all that useful as a replacement for DES. That's what AES is for.
As an aside, Diffie-Hellman is a method of key agreement, and is not a cipher in itself, but rather it is used in conjunction with other crypto systems. (IPsec, for instance, uses DH, I believe.)
J
Parent
AES is *much* stronger than 3DES (Score:3, Insightful)
In addition, you are clearly unaware of Stefan Lucks's attacks on 3DES, which take it down to about 72 bits of security - far from the 112 it promises. You might as well just use DESX, which is about as strong but three times faster.
90 bits, not 72 bits (Score:4, Informative)
http://th.informatik.uni-mannheim.de/People/Luc
Parent
Re:Triple DES AES (Score:5, Informative)
Terrible, terrible, HORRIBLE analogy.
Cryptography rounds are not like walls... It's not like a wall, where defeating each one removes strenghth. In cryptography, even if you can break up to 127-bits, that last 1-bit stll means it's just as strong as ever.
A good example (besides AES) is skipjack... NSA's own. There would have been a vulnerability if it used one less round, but since it uses 1 more, it's still perfectly safe, and hasn't been broken yet...
In other words, find a new analogy, and don't tell people that AES is insecure. It's gone through detailed analysis to make sure it's secure... The same process that approved of DES years ago.
If you trust 3-DES, you should trust AES, too.
Personally, I use blowfish whenever possible, but I haven't seen any crypto hardware with blowfish built-in so I doubt it'll get more widespread anytime soon.
Parent