Xref: cantaloupe.srv.cs.cmu.edu sci.crypt:16039 alt.security.pgp:2726 alt.privacy.clipper:138 Newsgroups: sci.crypt,alt.security.pgp,alt.privacy.clipper Path: cantaloupe.srv.cs.cmu.edu!magnesium.club.cc.cmu.edu!news.sei.cmu.edu!cis.ohio-state.edu!pacific.mps.ohio-state.edu!zaphod.mps.ohio-state.edu!cs.utexas.edu!uunet!lehman.com!snark!pmetzger From: pmetzger@snark.shearson.com (Perry E. Metzger) Subject: Re: Off the shelf cheap DES keyseach machine (Was: Re: Corporate Message-ID: <1993Apr26.232333.3752@lehman.com> Sender: news@lehman.com (News) Organization: Partnership for an America Free Drug References: Date: Mon, 26 Apr 1993 23:23:33 GMT Lines: 32 "Jon \\lnes" writes: >A person I know, belonging to a research lab of a rivate >company, claimed to me during a priavte conversation that, given the >equipment in his lab, he could crack a Kerberos ticket in 15 minutes to >an hour. He had access to rather powerful DES hardware, but not of an >extraordinare kind, I believe. The attack was possible because of the >amount of known plaintext in the ticket, which itself constitutes a small >message. This was two years ago. I don't believe you, and I don't believe your friend. Why? Because DES is not known to have any known plaintext attacks readily availble. Unless your friend knows something and is keeping it secret, he was bullshitting you. Now, it IS possible that he noted a weakness in the *implementation* of the Kerberos protocol. For instance, using a weak RNG to generate keys might cut down on the keyspace (not for the user keys -- for the other kind who's name I can't remember). However, this is not what was claimed. You are claiming a general weakness in DES, which is not known to exist in the open literature. Don't get me wrong -- DES is weaker than it should be. However, cracking it in 15 minutes requires more money be spent on the cracking machine than ANY organization I know of has available. -- Perry Metzger pmetzger@shearson.com -- Laissez faire, laissez passer. Le monde va de lui meme.