From: uri@watson.ibm.com (Uri Blumenthal,35-016,8621267,)
Subject: Re: IBM password
Originator: uri@aixproj.watson.ibm.com
Date: Wed, 14 Oct 1992 01:34:09 GMT
Disclaimer: This posting represents the poster's views, not necessarily those of IBM
Organization: IBM T.J. Watson Research Center

From article <1992Oct10.103703.24276@infodev.cam.ac.uk>, by rja14@cl.cam.ac.uk (Ross Anderson):
>> Looks like that? OK, try to break it on your PC and post the result (:-).
>> ...................... 
>> Oh, sure... And just how many of the trial ciphertexts are you going 
>> to keep? (:-)
> 
> I'm going to take a dictionary of 50,000 words, encrypt a string of blanks
> with each word, and sort the resulting ciphertexts. I will expect this to
> solve at least 20% of encrypted files.

Would you mind to provide some practical evidence, please?
It's somewhat hard for me to believe a successful
ciphertext-only attack even on such a "weak"
mode of DES as ECB... [I mean - we all 
can make nice theories, but the
ugly real world isn't always
that cooperative :-].

>> And I fail to see, how using (silly, I agree) ECB mode helps
>> you to reduce the number of trials to 2^20...
> 
> The use of ECB togther with a redundant file format facilitates a very fast
> dictionary attack. I can see at once from any encrypted file what the 
> ciphertext corresponding to `        ' is; I can look at once at my 
> dictionary and see if the user used a password I know. 
> In other words, you only have to do the 50,000 encryptions once, rather than 
> once for each guess you make at a plaintext block.

Oh no! You can't really see that it's `      '! It could as well
be `000000000', `111111111', or whatever! So you have to run
your 50,000 words (probable key) against several probable
plaintexts... And in case both:

	a) user's stupid enough to use simple word one
	   can find in a dictionary, instead of chosing
	   something like "you%fool" (:-) ;

	b) the plaintext is either partially known, or
	   partially guessable (like Assembler source
	   code with spaces rather than tabs).

these conditions are true - you can get your shot on 
that sucker... Otherwise - naw...

> If the Da Vinci 
> designers had used CBC, then the job would be a bit harder; I would have to 
> guess a plaintext block (and its position), and then run my through my 
> dictionary testing the plaintext/ciphertext pair that this gives.

Oh really? Again, why don't we stop letting our imagination
running wild, and bring some evidence from the real world?
I've never heard of broken DES-CBC. If you can do it,
maybe you could share it with the rest of us? 
For it looks like poor Biham and Shamir are still stuck
with 2^47 chosen plaintexts... You seem to be able to 
really speed up the attack. (:-)

> Guarding against poor password choice is indeed a separate issue, but I don't
> agree it's the user's business.

Well, indeed this is separate issue. I do believe that it's up to the
user to chose his password. Probably there should be some information
(User's Manual ?) for the user about how to chose a good password,and
how to use the system efficiently...  Since I know nothing about that
"Da Vinci" system,  I can't comment how close/far from this goal they
got...

> This is one of the central problems with much of IBM's product range. The big
> blue company tries to be all things to all men, and so their products leave
> almost all the system design decisions to the customer.
> 
> By doing this, IBM designers in my view fail to take into account the ability
> and expertise which it is reasonable to expect from a small mainframe site 
> such as a typical US bank.

Well, maybe you're right here, I don't know.  But tell me, is that
"Da Vinci" system intended to be used by a bank?  And does it have
only ECB mode? [Putting our "personal" discussion aside, I'm still
amazed that ECB is used, I thought it's never used for things like
file encryption etc.]

> Compare the IBM designs with the rest of the industry: financial encryption
> products from companies like Atalla, Racal and Eracom include a ready-made
> cryptographic protocol with hierarchies of master and session keys, ATM and
> network support, operations manuals, and everything thought out so that a 
> programmer can implement a fairly secure system without having to acquire any 
> crypto expertise.

Point is taken.

Regards,
Uri.
------------
<Disclaimer>
-- 
Regards,
Uri.		uri@watson.ibm.com
------------
<Disclaimer>
Newsgroups: alt.security