Japanese Researchers Crack Supposedly Hack-Proof Cryptography
June 19, 2012 3:54 PM
comment(s) - last by
Researchers who developed standard claimed it would take "thousands of years to crack", but it took only 148 days
We're living in either a dark, dysmal time for cryptographers or a golden,
glorious age for hackers
depending on how you look at it. Casual hackers are making short work of supposedly
modestly-secure older hashing
, and even supposedly-super-secure "strong" encryption techniques are falling to novel attacks.
I. Pair-Based Cryptography Continues to Fall in Security
The latest victim in the march of progress is pairing-based cryptography, an approach that was thought to hold the key to super-secure future communications. Japanese electronics giant Fujitsu Ltd. (
, and Japan’s
National Institute of Information and Communications Technology
a 278-digit (923-bit) cryptogram, easily besting the previous world record of 204 digits (676 bits).
Researchers who worked with pair-based cryptography have in the past expressed confidence that 900+ bit cryptograms would take hundreds of thousands of years to crack. But Fujitsu,
. achieved the feat in a mere 148.2 days -- less than half a year -- running on a 21-computer cluster with 252 cores.
Fujitsu has cracked an encryption that was previously estimated to take "hundreds of thousands of years" to break. [Image Source: Fujitsu]
By employing parallel programming methods and other novel techniques to the attack, the research team was able to cut the time that would have been required by a less state-of-the-art brute force attack with previous methods.
II. Cat and Mouse -- No System is Unbreakable
Fujitsu warns that the shocking success should serve as a warning to security firms that what seems like reliable standards may be crackable sooner than they think, and unsafe not too long after that. Writes the company:
As cryptanalytic techniques and computers become more advanced, cryptanalytic speed accelerates, and conversely, cryptographic security decreases. Therefore, it is important to evaluate how long the cryptographic technology can be securely used.
We were able to overcome this problem by making good use of various new technologies, that is, a technique optimising parameter setting that uses computer algebra, a two dimensional search algorithm extended from the linear search, and by using our efficient programing techniques to calculate a solution of an equation from a huge number of data, as well as the parallel programming technology that maximises computer power.
Cryptography today is facing a two-side assault. On the one side are the crackers, looking to employ novel methodology to reverse advance encryption. On the other side are the exploiters, looking to identify and leverage fundamental
flaws in the implementation
, flaws which sabotage the reliability of the underlying methods.
Unbreakable security is a fantasy. [Office Hackery]
Some public keys encrypted by
the RSA standard
were recently found to have "no security at all". The culprit, said Swiss researchers who published their findings in February, was improper generation. Likewise in 2010 Norwegian researchers
[abstract] results indicating
could be cracked via attacking the photon detectors that implemented the encryption via quantum mechanical effect. Here, the quantum cryptography itself was likely strong enought to stand up to any direct assault, but the glaring weak spot was the encoders/decoders in the system, which could be hijacked with traditional attacks.
Of course security researchers will surely scramble on to new and safer protection schemes. But it's more clear than ever that uncrackable encryption is anything but.
This article is over a month old, voting and posting comments is disabled
6/19/2012 7:51:49 PM
So... It took them only 3 years to go from cracking 676 bit encryption to cracking 923. At this rate, they should be able to break 1024 in a similar amount of time within a year or two.
6/19/2012 9:26:02 PM
Well, not really...
Imagine that in 1 years 1024 bits can be cracked in 6 months with that computer...
1 - Any document you "legally" sign, after those 6 months of having the keys being used are actually worthless - anything can be signed with your both public keys now!
2 - That computer seemed like a week one, for anyone wanting to go in strength to get potentially zillions of dollars (as being able to sign documents for other people is worth that), so put a really good supercomputer and it would maybe be done in 1 week or even 1 day... and now 1024 bits is unusable.
In security, you must adequate what is being secured to the security employed, so...
1024b can only be used for stuff that u don't mind as having as public, like having a normal wooden door at your house.
2048b can be used safely for a few years (to be confirmed every year with new methods like this one), like installing a great safe at home or even at a bank (the probability of being taken is low)
4096b can be used safely for several/lots of years (to be confirmed every few years), like having something at the safe where money gets printed (security measures are really huge)
So don't trust public key crypto with 1024b for anything you really can't have it made public!
Same thing for symmetric-key algorithms (AES, ...) 128b maybe considered fine, but if you really want it safe, use 256b... that way when 128b gets cracked you'll hear about it and have time to move to 512b :)
"It seems as though my state-funded math degree has failed me. Let the lashings commence." -- DailyTech Editor-in-Chief Kristopher Kubicki
Secure Wi-Fi? Not so Much -- Gaping Hole Found in WPS Pin System
December 29, 2011, 12:42 PM
Inside the Mega-Hack of Bitcoin: the Full Story
June 19, 2011, 6:40 PM
RSA Offers New SecurIDs in the Wake of Lockheed Martin Cyberattack
June 7, 2011, 6:36 PM
MD5 Is Officially Insecure: Hackers Break SSL Certificates, Impersonate CA
January 4, 2009, 5:04 PM
Researchers Crack WPA, No Brute Force Needed
November 7, 2008, 8:50 AM
AT&T Defeats Purpose of New Apple SIM, Locks iPad Air 2 SIMs to Its Network
October 24, 2014, 2:17 PM
Microsoft to Discontinue Free, Ad-supported Xbox Music Service on December 1
October 23, 2014, 10:03 AM
Christian Bale Confirmed to Play Steve Jobs in Upcoming Film
October 23, 2014, 8:43 AM
Monica Lewinsky Speaks Out, Calls Herself "Patient-Zero" for Internet Cyberbullying
October 21, 2014, 2:25 PM
Google Fiber Finally Heading to Austin, Texas in December
October 16, 2014, 11:48 AM
Dropbox Flexes Security Muscle, Appears to Have Squashed Password Breach
October 15, 2014, 12:12 PM
Most Popular Articles
Chinese Government Declares Digital War Against America's Top Tech Firms
October 20, 2014, 12:07 PM
Samsung Announces Galaxy S5 Plus with Snapdragon 805 Processor, LTE-A
October 22, 2014, 3:40 PM
Windows 8.1 + Android "Sell Mini PC" w/ Bay Trail Creates New PC Form Factor
October 20, 2014, 5:07 PM
Apple's iPad Air 2 Features Triple-core A8X Processor, 2GB of RAM
October 21, 2014, 8:32 PM
Apple Releases iOS 8.1; Adds Apple Pay Support, SMS Relay, Instant Hotspot
October 20, 2014, 1:00 PM
Latest Blog Posts
The Surface Mini That Was Never Released Gets "Hands On" Treatment
Sep 26, 2014, 8:22 AM
ISIS Imposes Ban on Teaching Evolution in Iraq
Sep 17, 2014, 5:22 PM
Space Terrorism is a Looming Threat For the United States
Apr 23, 2014, 7:47 PM
Facebook Aims to Provide Internet to "Every Person in the World" with Drones, Satellites
Apr 1, 2014, 10:20 AM
Retail Mobile Sites Experience Outages in Light of Simplexity's Bankruptcy
Mar 14, 2014, 8:48 AM
More Blog Posts
Copyright 2014 DailyTech LLC. -
Terms, Conditions & Privacy Information