backtop


Print 22 comment(s) - last by JPForums.. on Jun 21 at 3:52 PM

Researchers who developed standard claimed it would take "thousands of years to crack", but it took only 148 days

We're living in either a dark, dysmal time for cryptographers or a golden, glorious age for hackers depending on how you look at it.  Casual hackers are making short work of supposedly modestly-secure older hashing standards like MD5, and even supposedly-super-secure "strong" encryption techniques are falling to novel attacks.

I. Pair-Based Cryptography Continues to Fall in Security 

The latest victim in the march of progress is pairing-based cryptography, an approach that was thought to hold the key to super-secure future communications.  Japanese electronics giant Fujitsu Ltd. (TYO:6702), Kyushu University, and Japan’s National Institute of Information and Communications Technology (NICT) cracked a 278-digit (923-bit) cryptogram, easily besting the previous world record of 204 digits (676 bits).

Researchers who worked with pair-based cryptography have in the past expressed confidence that 900+ bit cryptograms would take hundreds of thousands of years to crack.  But Fujitsu, et al. achieved the feat in a mere 148.2 days -- less than half a year -- running on a 21-computer cluster with 252 cores.

Fujitsu cracking
Fujitsu has cracked an encryption that was previously estimated to take "hundreds of thousands of years" to break. [Image Source: Fujitsu]

By employing parallel programming methods and other novel techniques to the attack, the research team was able to cut the time that would have been required by a less state-of-the-art brute force attack with previous methods.

II. Cat and Mouse -- No System is Unbreakable

Fujitsu warns that the shocking success should serve as a warning to security firms that what seems like reliable standards may be crackable sooner than they think, and unsafe not too long after that.  Writes the company:

As cryptanalytic techniques and computers become more advanced, cryptanalytic speed accelerates, and conversely, cryptographic security decreases.  Therefore, it is important to evaluate how long the cryptographic technology can be securely used.

We were able to overcome this problem by making good use of various new technologies, that is, a technique optimising parameter setting that uses computer algebra, a two dimensional search algorithm extended from the linear search, and by using our efficient programing techniques to calculate a solution of an equation from a huge number of data, as well as the parallel programming technology that maximises computer power.

Cryptography today is facing a two-side assault.  On the one side are the crackers, looking to employ novel methodology to reverse advance encryption.  On the other side are the exploiters, looking to identify and leverage fundamental flaws in the implementation, flaws which sabotage the reliability of the underlying methods.

Hacker proof
Unbreakable security is a fantasy. [Office Hackery]

Some public keys encrypted by the RSA standard were recently found to have "no security at all".  The culprit, said Swiss researchers who published their findings in February, was improper generation.  Likewise in 2010 Norwegian researchers published [abstract] results indicating quantum cryptography could be cracked via attacking the photon detectors that implemented the encryption via quantum mechanical effect.  Here, the quantum cryptography itself was likely strong enought to stand up to any direct assault, but the glaring weak spot was the encoders/decoders in the system, which could be hijacked with traditional attacks.

Of course security researchers will surely scramble on to new and safer protection schemes.  But it's more clear than ever that uncrackable encryption is anything but.

Source: Fujitsu



Comments     Threshold


This article is over a month old, voting and posting comments is disabled

RE: AES broken?
By Qapa on 6/19/2012 9:40:26 PM , Rating: 3
Symmetric-key algorithms don't go those key lengths yet...

Triple-DES, AES, (...) generally are still in the 1xx bits.

So we are talking about public key algorithms (like RSA, ...).

And who cares? Anyone that wants to sign anything digitally... that is a possibility for instance in many countries for legal stuff... governments already allow lots of stuff to be done like that.. some companies also already allow that for signing stuff, and for making emails really secure... on that note, some people were (are?) fans of PGP, which uses that type of keys...


RE: AES broken?
By JPForums on 6/20/2012 8:19:00 AM , Rating: 2
quote:
So we are talking about public key algorithms (like RSA, ...).

Actually, we are talking about PBC algorithms.
http://en.wikipedia.org/wiki/Pairing-based_cryptog...

Though they are apparently more complex than public key algorithms, they aren't necessarily more secure. Complexity sometimes creates areas of weakness that are hard to see. That said, the recommended RSA key length is 2048 or larger as 1024 bit was called into question into 2003.

quote:
... on that note, some people were (are?) fans of PGP, which uses that type of keys...

Not exactly.
quote:
PGP encryption uses a serial combination of hashing, data compression, symmetric-key cryptography, and, finally, public-key cryptography; each step uses one of several supported algorithms.

http://en.wikipedia.org/wiki/Pretty_Good_Privacy


"Young lady, in this house we obey the laws of thermodynamics!" -- Homer Simpson














botimage
Copyright 2014 DailyTech LLC. - RSS Feed | Advertise | About Us | Ethics | FAQ | Terms, Conditions & Privacy Information | Kristopher Kubicki