From: uri@watson.ibm.com (Uri Blumenthal)
Subject: Re: IBM password
Date: Fri, 09 Oct 1992 18:40:45 GMT
Distribution: usa
Reply-To: uri@watson.ibm.com
Disclaimer: This posting represents the poster's views, not necessarily those of IBM
Organization: Why do you care?

In article <1992Oct9.144004.19367@infodev.cam.ac.uk>, rja14@cl.cam.ac.uk (Ross Anderson) writes:

> |> Looks like a PC will be enough to do keysearch on this one: just encrypt
> |> a null string with all the passwords in a dictionary, and sort the list.
> 
> In article <1992Oct08.185037.113247@watson.ibm.com>, a man from Big Blue 
> (inventors of DES) commented:
> 
> > Looks like that? OK, try to break it on your PC and post the result (:-).

> Rubbish. I'm talking keysearch, not differential cryptanalysis! What is 
> the diversity of passwords that people choose? Experience with unix 
> password crackers shows that you can guess a fair number of them by 
> running through a dictionary. The key space is no longer anything like
> 2^56 - it'll be somwhere between 2^10 and 2^20.

Rubbish. Please tell me, how having visible patterns in the ciphertext
(because silly implementors didn't use CBC :-) is going to help you to
find the key, unless you're trying to use diff.cryptanalysis (and even
if you do :-)?

And how are those patterns going to help you in dictionary attack?

And limiting the password to 8 characters is very typical  for DES-like
systems (those with limitation of key-length of only 56 bits). It still
sounds rather strange (I'm being very mild :-) to pretend it's 2^10, or
2^20 nonetheless. 

If you use ONLY all the printable ("visible" :-) characters for the 
password, it gives you "only" about  4304672100000000 possibilities. 
To compare:
passwd:4304672100000000
2^51 = 2251799813685248
2^52 = 4503599627370496

(courtesy of BC program :-).

Even if you use only upper and lower case alphabet plus digits,
you still get about 218340105584896 possibilities... 
Comparing again:
passwd:218340105584896
2^47 = 140737488355328
2^48 = 281474976710656

Now, when are you going to employ your PC to break it? (:-)

If, on the other hand,  you're talking about Dictionary Attack
(about as old as the Universe, see the paper of Mr. Morris :-),
indeed some users (roughly between 5% and 25% of the user pool,
depending on the site, I'd guess) will use poor crackable 
passwords. SO WHAT?  Or should the system explicitely
check each password against the dictionary it has
and reject poor password? I think it's USER'S
BUSINESS.

> You check each guess by encrypting a string of blanks by each trial password
> until you get the common pattern. In fact, you only have to do these
> trial encryptions once, and sort and store the result; you can then see at
> once if a ciphertext was created using any of these passwords by just
> looking in your list for the common pattern.

Oh, sure... And just how many of the trial ciphertexts are you going 
to keep? (:-)

And I fail to see, how using (silly, I agree) ECB mode helps
you to reduce the number of trials to 2^20...

Also I don't see how ECB (of CBC, or [CO]FB) mode affects
the passwords users choose. Some users indeed choose very
poor passwords, so what?  I can't grasp what you are
complaining about: is it that ECB mode is
vulnerable, or is it that the users
are choosing poor passwords?


> Moral: having a good encryption algorithm is not enough. You also have to 
> implement it sensibly.

Agreed, but I think you failed to show where the implementation
you complain about, breaks.


> If you really want to do an experiment with a PC, that would be a much more
> interesting attack than trashing Da Vinci. Given that most ATMs nowadays 
> are networked together, it's enough to be able to break a few banks' keys.

Probably... (Thanks for a good idea :-).

Regards,
Uri.
------------
<Disclaimer>