Date: Sat, 29 Dec 2001 19:22:10 -0600 (CST) From: Tina Bird <[EMAIL PROTECTED]> Subject: Re: [LIB] Security
DES is a 56-bit key length cipher. Independent of implementation, it took 2.1 days for the custom-built "Deep Crack" machine to test all possible 56-bit keys in the DES keyspace -- that machine was a multi-processor system with 10000 CPUs, but balancing the difficulty of assembling all those processors, the group that did the work only bought >>33MHz<< processors -- hardly top of the line even in, uh, 1997/1998 when the work was done. http://www.cryptome.org/cracking-des.htm This work was done to force the US government to admit publicly that its chosen crypto algorithm -- DES -- wasn't able to protect private data even against a reasonably well-funded private attacker (the group estimated that, given their blueprints and code, which they published freely, it would cost about $50k US to build a cracker of your own). The US government has chosen a replacement algorithm called Rijndael; commercial implementations should be available this year, and the code is already available. http://www.nist.gov/aes All of that being said, there are lots and lots of ways for government agencies to get access to individual private data -- and yes, Raymond, TEMPEST (which is based on the radio emissions that a PC puts out) works on laptops as well as desktops. The big problem I have with home users and individuals not patching their personal machines isn't the threat to >their< data, it's the high likelihood that their machines will be used as launch points for attacks on other boxes. tbird -- security geek On Sat, 29 Dec 2001, Raymond wrote: > Date: Sun, 30 Dec 2001 09:50:17 +0800 > From: Raymond <[EMAIL PROTECTED]> > Subject: Re: [LIB] Security > > At 05:42 PM 29/12/2001 -0800, you wrote: > >Date: Sun, 30 Dec 2001 01:36:17 +0000 > >From: "Matthew Hanson" <[EMAIL PROTECTED]> > >Subject: Re: [LIB] Security > > > >>Date: Sat, 29 Dec 2001 16:35:01 -0800 (PST) > >>From: David Chien <[EMAIL PROTECTED]> > > > >>www.pgpi.com's PGP Disk will help keep your PC secured from outside > > > >Something that guy said that threw me was that PGP was an algorithm in itself. I >always thought that PGP was Philip Zimmerman's system of excanging keys... and that >he used RSA or some other established algorithm to do the actual encryption. My >memory is foggy on this. The only time I used PGPi, I think I recall having to >choose an algorithm from a drop-down box. > > IDEA data encryption, RSA for key management, MD5 for hashes. IDEA hasn't been >publicly broken yet, I don't think RSA nor MD5 have been sufficiently comprimised to >render the PGP system insecure either. IIRC key lengths are also long enough to keep >data secure for a decade or 2 barring any major advances in cryptographic techniques >(I'm going by what I read in 'Applied Cryptography' first edition here though, I've >not read any more recent confirming texts on these algorithms so I could be wrong). > > > >Another thing this guy told me was that DES has been broken. > > Well IIRC DES to NSA's public standard can now be broken by brute force anyway given >a sufficiently resourced adversary. You could use triple-DES though and make it a lot >harder ... > > > > I asked if it's something that would a few super-computers to throw at, and he >said no. That is was a simple high-school hack of some kind. Like I said... I don't >follow this stuff very much... so DES could have patched (can that be done?) by this >point for all I know. > > *shrug* did he say DES had been broken or a specific DES implementation has been >broken? Bear in mind, there are 2 parts to any piece of encryption software, the >algorithm and the implementation. Often the implementation can be broken more easily >than the algorithm itself (eg. if the implementation puts a constant header somewhere >you can use a known plaintext attack for instance). Of coures, DES itself is getting >old now anyway ... IIRC it was based on IBM's Lucifer cipher and supposed to expire >in the 90's as a standard anyway (note DES stands for Data Encryption Standard which >is pretty ironic I guess). > > > >>I laugh as other poor IE/Outlook users keep getting hacked/viruses/exploited > >>with my Netscape-based, secured Libretto. > > > >Can someone explain to me just why Mircosoft thought it would be such a great idea >to be able to set an option in Outlook(X?) that would allow email attachments to be >launched automatically when an email is opened!!!???? As I recall, some of the first >versions came set up that way by default. > >Wasn't that what originally inspired the creator of the Love bug? > > Thats Microsoft for you ... remember, security is inversely proportional to >convenience. Microsoft's OE just went too far for convenience. If you're paranoid >about that, use Pine, good luck any executables getting run there!! > > > - Raymond > > --- > > > /~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\ > | | "Does fuzzy logic tickle?" | > | ___ | "My HDD has no reverse. How do I backup?" | > | /__/ +-------------------------------------------| > | / \ a y b o t | [EMAIL PROTECTED] | > | | HTTP://www.raybot.net | > | ICQ: 31756092 | Need help? Visit #Windows98 on DALNet! | > \~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~/ > > > > > ************************************************************** > http://libretto.basiclink.com - Libretto mailing list > http://libretto.basiclink.com/archive - Archives > http://www.picante.com/~gtaylor/portable/faq.html - FAQ > -------TO UNSUBSCRIBE------- > Reply to any of the list messages. The reply mail should be > addressed to: [EMAIL PROTECTED] - Then replace any text > on the message's subject line: cmd:unsubscribe > --------TO UNSUBSCRIBE DIGEST------ > Do above but with this on subject line: cmd:unsubscribe digest > ************************************************************** > ************************************************************** http://libretto.basiclink.com - Libretto mailing list http://libretto.basiclink.com/archive - Archives http://www.picante.com/~gtaylor/portable/faq.html - FAQ -------TO UNSUBSCRIBE------- Reply to any of the list messages. The reply mail should be addressed to: [EMAIL PROTECTED] - Then replace any text on the message's subject line: cmd:unsubscribe --------TO UNSUBSCRIBE DIGEST------ Do above but with this on subject line: cmd:unsubscribe digest **************************************************************
