Stories
Slash Boxes
Comments
typodupeerror delete not in

Book Reviews

Recent reviews from Slashdot readers:

Submitting a review for consideration is easy; please first read Slashdot's book review guidelines. Updated: 2008114 by samzenpus

Comments: 236 +-   New AES Attack Documented on Wednesday July 01, @04:50PM

Posted by timothy on Wednesday July 01, @04:50PM
from the ponder-don't-panic dept.
encryption
security
technology
avxo writes "Bruce Schneier covers a new cryptanalytic related-key attack on AES that is better than brute force with a complexity of 2^119. According to an e-mail by the authors: 'We also expect that a careful analysis may reduce the complexities. As a preliminary result, we think that the complexity of the attack on AES-256 can be lowered from 2^119 to about 2^110.5 data and time. We believe that these results may shed a new light on the design of the key-schedules of block ciphers, but they pose no immediate threat for the real world applications that use AES.'"
story

Related Stories

This discussion has been archived. No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
 Full
 Abbreviated
 Hidden
More
Loading... please wait.
  • Yawn (Score:3, Insightful)

    by Shikaku (1129753) on Wednesday July 01, @04:56PM (#28550501)

    So instead of taking 1 million years to brute force, it will take .9 million years?

    I totally made up those numbers but that's about the difference.

    • Re:Yawn (Score:5, Informative)

      by a_n_d_e_r_s (136412) on Wednesday July 01, @05:55PM (#28551301) Homepage Journal

      Given that the new theory lowers the time to break it with about 99.7% if it before took 1 million years it now only takes 3000 years.

      Remember for everý less bit it takes to decrypt - it halves the time it takes to break a cipher.

      • by snikulin (889460) on Wednesday July 01, @06:28PM (#28551685)

        Security [xkcd.com]

        • by froon (1160919) on Wednesday July 01, @07:42PM (#28552403)

          If you want your secrets to remain secret past the end of your life expectancy, then, in order to choose a key length, you have to be a futurist. You have to anticipate how much faster computers will get during this time. You must also be a student of politics. Because if the entire world were to become a police state obsessed with recovering old secrets, then vast resources might be thrown at the problem of factoring large prime numbers.

          So the length of the key that you use is, in and of itself, a code of sorts. A knowledgeable government eavesdropper, noting Randy's and Avi's use of a 4096-bit key, will conclude one of the following:

          -Avi doesn't know what he's talking about. This can be ruled out with a bit of research into his past accomplishments. Or,

          -Avi is clinically paranoid. This can also be ruled out with some research. Or,

          -Avi is extremely optimistic about the future development of computer technology, or pessimistic about the political climate, or both. Or,

          -Avi has a planning horizon that extends over a period of at least a century.

          -- Neal Stephenson, Cryptonomicon

          • by snikulin (889460) on Wednesday July 01, @10:30PM (#28553601)

            Lord Farquaad: I've tried to be fair to you creatures, now my patience has reached it's end! Tell me or I'll...
            Gingerbread Man: NO! Not the buttons! Not my gumdrop buttons!
            Lord Farquaad: Alright then! Who's hiding them?
            Gingerbread Man: Ok. I'll tell you. Do you know... the muffin man?

    • Re: (Score:3, Insightful)

      http://valerieaurora.org/hash.html [valerieaurora.org]
      Pay special attention to the reaction of the "slashdotter" to "minor weakness found", and compare it to your reaction.
      Remember, attacks always gets better, never worse. The first attack that weakens an algorithm *is* a big deal.

      Oh, and reducing complexity from 2^128 to 2^110 isn't as it may appear a reduction of 10% in time-to-break, infact it's a reduction of 2^18 or about a factor of a million, so it's more like if before it took a million years, now it takes ONE year. Lu

  • by techno-vampire (666512) on Wednesday July 01, @04:57PM (#28550509) Homepage
    TFA refers (as does the summary) to complexity of 2^119, and possibly lowering it to 2^110.5. Could somebody rephrase that in a way that people like me, who aren't cryptography specialists can understand what they're talking about?
    • Re: (Score:3, Insightful)

      by Anonymous Coward

      I believe the complexity is a rough measure of how long it should take to break the code. So in this case, a reduction from 2^119 to 2^110.5 is approximately 360 times faster (that is, a 2^119 complexity attack takes 360 times as long as a 2^110.5 complexity attack).

    • Re: (Score:3, Informative)

      Normally, "complexity" in computer science refers to how long it takes to do a given task, given the size of the task. It's usually expressed as O(blah), read, "Order of blah". For example, an O(n^2) ("order n squared") complexity means that if it takes "m" minutes to finish a problem of size x, then it will take 16m minutes to finish a problem of size 4x. I'm not familiar with the term "complexity" being used in this context and with these specific numbers.
      • It's usually expressed as O(blah)...

        Yeah; I know, and I'd not have wondered if they'd expressed it that way. It's good to know that I'm not the only reader that doesn't understand the terminology.

      • Re:Complexity (Score:4, Interesting)

        by Kjella (173770) on Wednesday July 01, @06:52PM (#28551921) Homepage

        I'm not familiar with the term "complexity" being used in this context and with these specific numbers.

        Because it's not a problem that scales with n, it's an attack on one particular value of n. Ideally brute forcing an n-bit cipher has complexity O(2^n). For 256 bit AES, they've found an attack that instead of the ideal 2^256 attempts takes 2^119 attempts. But you can't say O(2^119) because that is equal to O(1), and any function with n would be false since it doesn't apply to other n. I guess you could say an attack with "complexity O(2^(n*119/256) for n=256" but you're likely to confuse a hundred times as many as are enlightened.

    • Re:Complexity (Score:5, Informative)

      by vux984 (928602) on Wednesday July 01, @05:18PM (#28550809)

      Could somebody rephrase that in a way that people like me, who aren't cryptography specialists can understand what they're talking about?

      Sure I'll rephrase it for you. "Don't worry."

      What? You wanted something deeper without having to know anything? Ok...so AES was thought to require 2^128 time units to brute force. So 2^119 time complexity means essentially that the new algorithm takes 2^119 units of time to complete which is a lot better, and they think it might be able to optimize it down to 2^110 units of time.

      What a 'unit of time is' is a computing science hand-wave because it doesn't really matter what it is. When comparing algorithms for large problems you are interested in how it compares relative to other algorithms, not how much absolute time it will take on a Commodore 64 or Intel i7 or whether its programmed in Smalltalk vs C. Those details while important in their own right aren't really relevant to the comparison of the algorithms themselves.

      A 2^110 algorithm is significantly better than a 2^119 algorithm for 'large problems' regardless of what we set the unit of time to be, and in turn 2^119 is much better than 2^128.

      In practice the unit of time is rooted in how long it takes a computer to do 'an operation'. So it might be milliseconds or nanoseconds, or whatever. And the upshot is that even 2^110 is STILL gazillion years even if its programmed in C on an i7 and every i7 on the planet is contributing to the effort...

      Hence... "Don't worry."

      Its mathematically very interesting, but for the moment, its nothing to "worry" about.

    • Basically they're looking for weaknesses in the encryption or a way to break the encryption. The basic idea is that if you have a x-bit key for you encryption system then you should be able to generate 2^x different keys. So for instance if you had 4-bit encryption, then you would have 4 bits that you could assign a value to. That is you have something like _ _ _ _ where each _ can be either a 1 or a 0. When you work out the number of unique ways you can make this assignment you get 16, or 2^4.

      To break

    • Re:Complexity (Score:5, Informative)

      by Joce640k (829181) on Wednesday July 01, @05:38PM (#28551085) Homepage
      It means you only have to test 2^119 possible keys to break 256-bit AES - still far beyond what's ever going to be feasible (do the math - give everybody on the planet a million PCs running at 1THz and see how long it takes to do 2^119 things, then figure out where you're going to get that much electricity from)

      Interesting to note is that AES-128 is immune to this attack - it's now the strongest variant of AES. Everybody (like me) who thought the 256-bit and 192-bit were a waste of time now has a reason to be smug about it.

      Reason: Both AES-192 and AES-256 are just AES-128 internally but they mess around with the key data between each loop of the encryption process. The new attack only works on the "messing around" part of the process so AES-128 is unaffected.
        • ...and when I say "strongest" I mean in a pure math sort of way.

          Any attack which starts with things like "first you encrypt 2^128 carefully chosen plaintexts and store them in a hash table" isn't really an attack you should worry about.
  • by Anonymous Coward on Wednesday July 01, @04:57PM (#28550513)

    Crypto is broken. It's not IF, but WHEN. That's why crypto is pointless to use. this is why I use open source, and even keep all doors unlocked. It's pointless to try and protect propery, real or intellectual/imaginary.

  • Complexity. (Score:5, Funny)

    by girlintraining (1395911) on Wednesday July 01, @04:57PM (#28550517)

    For those who don't have a degree in oh-shit-that's-a-big-number, can someone give a comparative analysis of what "2^119" complexity means? I mean what else is "2^119" hard to solve? And yes, the math nerds are undoubtedly either dying of laughter or yelling at the screen for my abuse of powers of two... I don't care.

    • Re:Complexity. (Score:5, Informative)

      by xZgf6xHx2uhoAj9D (1160707) on Wednesday July 01, @05:05PM (#28550631)

      AES-128 uses keys which are 128 bits long. That means in order to "break AES" (in order to decrypt something you don't have the key to), all you have to do is try all possible keys of length 128 until you find one that works. That means you would have to try 2^128 different combinations, which is a lot.

      What these people have done is found some clever way where you can break AES trying only 2^119 combinations. Effectively this means AES is no better than if it had used 119-bit keys instead of 128-bit keys. Sometimes you'll hear this colloquially as something like "AES has 119 bits of security", referring to how many combinations of keys you have to try before you find the one works.

      2^119 is a massively large number. Trying 2^119 combinations is still terribly far outside of the realm of what all of the world's most powerful supercomputers combined could hope to do. This is an attack of theoretical interest, not practical interest.

      • Re:Complexity. (Score:5, Insightful)

        by cpu_fusion (705735) on Wednesday July 01, @05:11PM (#28550725)

        Pardon me, but isn't the article about AES-256? So this is a much more significant drop in the number of bits.

        Of course, I've only read the summary. This is slashdot, natch.

        • Oh dear, you're absolutely right. This is about AES-256. That's quite a significant attack indeed (though still not enough to make it practical).
            • Re: (Score:3, Interesting)

              I believe the probability being halved has something to do with the birthday paradox.

              Actually, that just applies to secure hash functions (like MD5 and SHA, and the like) and not to block ciphers. If AES-256 can be cracked with only 2^119 calculations, that is a HUGE drop in security.

              The reason that hash functions really only give you half as many bits of security as you have bits in the digest is that a hash is considered broken if you can find two messages which have the same hash. Since you can vary both messages, you only have to try 2^(n/2) as many, just like the birthday "paradox".

      • Re: (Score:2, Informative)

        by Anonymous Coward

        Except IYRTFA, the attack only works on AES-192 and AES-256. AES-128 is unaffected, which would seem to imply that, oddly, AES-128 could be stronger than AES-256 and AES-192 in some circumstances.

        • This is an attack on key schedules; the key schedule of AES-128 is different from that of AES-192 and AES-256, thus rendering it impervious to this particular attack. As the authors note, this sheds new light on key schedule design, much in the same way that differential cryptanalysis shed light on S-box design.
      • Re:Complexity. (Score:5, Informative)

        by quercus.aeternam (1174283) on Wednesday July 01, @05:16PM (#28550793) Homepage

        Two things:

        First, they are talking about AES-256.

        Second, I find it useful to think about how much faster that is. In this case, it means it is 2^137 times faster than a pure brute force attack, which certainly seems impressive. Fortunately, as you mentioned, this is still far too difficult to be applied.

        Just for fun, google this: 2^119 picoseconds in millenia

        • Re: (Score:3, Informative)

          Just for fun, google this: 2^119 picoseconds in millenia.

          Google says:

          2.10607966 × 10^13 millenia -- which equals about 21,000,000 billion years

          With the new attack the figure is 2^110.5 trys, which is

          (2^110.5) picoseconds = 5.81727815 × 10^10 millenia

          a mere 58,000 billion years.

          Looking at it another way, 119 - 110.5 = 8.5, which is the reduction of the exponent, giving 2^8.5 = 362. So knocking off 8.5 bits reduces the amount of time+effort by that ratio.

          "Picosecond" is the assumed

        • Re:Complexity. (Score:5, Interesting)

          by AlHunt (982887) on Wednesday July 01, @06:21PM (#28551597) Homepage Journal

          >Just for fun, google this: 2^119 picoseconds in millenia

          And for even more fun - 64 minutes after the parent posted, the post itself was the first result.

      • Re: (Score:3, Interesting)

        by Anonymous Coward

        2^119 is a massively large number.

        664613997892457936451903530140172288

        Meh. I've seen bigger.

        • Re:Complexity. (Score:4, Informative)

          by tabrisnet (722816) on Wednesday July 01, @05:32PM (#28551003)

          Bull.

          a) AES is not based on prime numbers, nor is it a public-key cipher. you're thinking RSA or some other public-key cipher. Hence why RSA has to be at least 1024 (and now 2048 and up is recommended) bits long.

          b) There's a lot more bull going around here. AES256 was believed to require 2^128 operations to bruteforce, not 2^256. Thus any question of 256 -> 119 is bull. It's 128 -> 119.

          c) Brute-forcing a 64bit RC5 key took distributed.net years (and note that that was with the benefit of Moore's [so called] Law). Mind you, that actually required searching a 64bit keyspace.

    • I mean what else is "2^119" hard to solve?

      Finding a file which has an MD5 hash of either 000000000000000000000000000000XX or 000000000000000000000000000001XX for some pair of hexadecimal digits XX.

      Computing the 2^100th bit of Pi (approximately -- the BBP algorithm has some factors of log thrown in, so I've dropped a factor of 2^19 to account for those).

      Sorting a list of 31 elements using bogo-sort.

    • Re: (Score:2, Interesting)

      A couple of years ago (2003), a cryptographic system was said to be secured if it requires more than 2^80 computation. I do not know what is the current standard and I have no clue how to find it.
      However 2^110 is still way to large for us at the moment.
      To give an estimation. Supose you have one million processors clocked at 10Ghz (which nobody have nowadays), you can do 10^6 * 10^10 = 10^16 ~= 2^48 computations per second. To crack AES and using this machine you'll need 2^110 / 2^48 = 2^62 seconds to do
    • Well I'm not particularly a math geek, but 2^10=1KB. 2^20=1MB. 2^30=1GB. And so on. So if you were storing 2^120 bits, it would be basically be a trillion trillion terabytes. Is that right? Someone feel free to check my math.

      I mean, that doesn't give an explanation of the problem, so it doesn't really answer your question. But maybe it gives you an idea of scale? I guess by lowering the complexity of the attack by 2^8.5 it means that an encryption key that would take you 300 years to crack, you mig

  • but they pose no immediate threat for the real world applications that use AES.

    Funny how news of just about every major break of an existing cryptography system or secure hash method has started out with just about those same exact words.

  • Quantum Computers (Score:3, Insightful)

    by religious freak (1005821) on Wednesday July 01, @05:05PM (#28550643)
    Yeah, this is interesting math, but I don't think our cryptographic scheme is in danger until quantum computers become a stable and reliable source of heavy computing. Then we're all in trouble. How do you create a key, when the entire large number method is made obsolete by quantum computing? I haven't looked into it much, but I don't think anyone has found an answer yet.

    To my knowledge quantum cryptography is still limited to very close distances, while cracking a crypto key is obviously not affected by this limitation.
    • Re:Quantum Computers (Score:4, Informative)

      by mathimus1863 (1120437) on Wednesday July 01, @06:31PM (#28551713)
      Parent is slightly off on the Quantum computing comment. Quantum computers can break cryptographic protocols based on the difficulty of integer factorization (RSA/PGP/GPG/PKI/SSL/TLS), and discrete-logarithms (all of the above plus elgamal, elliptic curves). However, AES is a block cipher which relies on neither of these pure-math problems.

      The only advantage of QCs in breaking AES is that Grover's Algorithm can be applied for random guessing of the encryption key. AES-256 has 2^256 possible encryption keys. It takes a classical computer an average of n/2 guesses to find the right key, or 2^255 operations. However a QC running Grover's Algorithm does it in an average of approx sqrt(n) "guesses." This means that it takes about 2^128 operations to get the AES-256 key using a quantum computer.

      As previous posters have mentioned, 2^128 is still far out of our reach. And to subvert QCs for this type of problem, all we have to do is double our key length to get the same security. Perhaps if we find a way to combine Grover's Algorithm with this new AES vulnerability, we can get it down to 2^60 to 2^64, but that is still extremely prohibitive. Additionally, that's a big "if," since Grover's Algorithm is intended for pure-guessing problems.
    • Re: (Score:3, Informative)

      How do you create a key, when the entire large number method is made obsolete by quantum computing?

      There are several methods of public-key encryption which are secure against quantum computers. Try Lamport Signatures for a start:

      http://en.wikipedia.org/wiki/Lamport_signature [wikipedia.org]

    • There are some physics I know (I was one once...) that work on quantum computers. They don't think they will ever be faster at cracking than classic computers.

      There are 2 reasons.

      First a quantum computer construction complexity goes up to the power of qbits. ie a quantum computer with n qbits has construction complexity of O(2^n), so with Moores law in place the number of qbits goes up linearly with time... This is leaving out the extra qbits you need for error correcting with decoherence that makes a
      • You are not in the shit. Secure communication can be established on an insecure channel using quantum cryptography. Look it up on Wikipedia.
  • 2^119 is... (Score:5, Interesting)

    by AnotherBlackHat (265897) on Wednesday July 01, @05:13PM (#28550757) Homepage

    For those who are asking "what's 2^119 complexity mean?"

    2^64 is about as hard a problem as we can reasonably solve these days.
    2^80 is about as hard a problem as we can unreasonably solve. I.e. we can do it, but it would take the budget of a country for several years to do.
    A can of soda has about 2^83 molecules in it.
    2^119 is still way beyond anything we can reasonably do, but isn't so hard that we can rule out any theoretical possibility of solving it.
    A house sized computer built of solid nano-compute units, each a few hundred molecules on a side, with a cycle time of about 10 petahertz could do it in less than a lifetime.
    Perhaps possible but I wouldn't worry about it.
    2^256 is so hard that it may not even be theoretically possible to solve - or maybe you could if you're willing to destroy a few solar systems, and wait a few million years.
    While cracking 2^256 may not be theoretically impossible, it would be easier to look everywhere the information you want might be hidden - including inside the mind of your opponent - even if he's dead.

    • Re: (Score:3, Interesting)

      2^40 would take very little time on a home PC, an afternoon or maybe a day.

      40 bits is also the size of the keyspace used by HDCP for HDMI and DVI, for "encrypted" HD displays. I don't feel like doing the math, but determining all of the 40-bit keys used in HDCP could probably be done in a short time on a reasonable home PC, using a man in the middle attack. However, for copying HD video, one would still probably get better quality by showing Macrovision, the MPAA, and the Blu-Ray consortium that using BD+

      • Re:2^119 is... (Score:5, Interesting)

        by Kjella (173770) on Wednesday July 01, @06:16PM (#28551539) Homepage

        So you're saying that 256 bits should be enough for anyone?

        Unless you discover reversible computing, yes. Otherwise you could have an infinitely fast computer, but even the Sun at E=mc^2 and 100% efficiency couldn't do it. It's not a speed limitation, it's an energy limitation. Take the Landauer limit [wikipedia.org] at background radiation temperature [wikipedia.org]. Plug that into a calculator and you get joules required:

        (2^256) * 1.3806504 * (10^(-23)) * 2.72500 * ln(2) = 3.0196359 * 10^54

        Energy of sun:
        1.98892 * (10^30) * (299 792 458^2) = 1.78755215 * 10^47

  • by Anonymous Coward on Wednesday July 01, @06:39PM (#28551789)

    The usual threat model for a cipher is either a "chosen plaintext attack" (CPA) or a "chosen ciphertext attack" (CCA). In both of those, you have a lot of plaintext-ciphertext pairs all encrypted under the same key, and your job is to use that info against the cipher. Not necessarily to actually compute the key (which would totally destroy the cipher) but even to be able to infer anything about it statistically (for example, to have a better than random chance of guessing whether a new plaintext/ciphertext pair was encrypted with the same key).

    This attack is a related-key attack, which traditionally means that you get to see the same plaintext encrypted under enormous numbers (like 2^119 in this case) of different but related keys, rather than under the same key (or a "small" number of keys like a few trillion). This is a threat model that most ciphers aren't designed against and it's instead countered by designing the application to not rely on it. For example, don't use the cipher as a hash function by using the plaintext as a key and encrypting some constant. Properly designed crypto applications don't let attackers access the keys, and they generate their keys randomly rather than letting them be related. I don't think related-key attack resistance was part of the specification given to entrants of the AES contest, and IIRC the AES standard doesn't claim such resistance.

    Nonetheless, the designers of Rijndael (the cipher that is the basis of AES) designed Rijndael to be "ideal", which among other things Rijndael was supposed resist related-key attacks, which was above and beyond the AES requirements.

    This new discovery finds that the AES cipher in fact does not meet Rijndael's design goals. Rijndael's design goals, however, exceeded the requirements stated in the AES standardization process, and any applications using AES are supposed to only use the characteristics of AES stated in the standard. So, even if this attack were of low enough complexity to be practical, it STILL should not affect valid AES applications, unless they are relying on characteristics that AES was never promised to have.

An ounce of mother is worth a ton of priest. -- Spanish proverb