Code Cracking With a Point
A code-cracking feat last week by 23-year-old UC Berkeley graduate student Ian Goldberg came as little surprise to the crypto-weenies involved in the endless battle over U.S. government encryption policy.
But it did make its point with a bit more zing than has been the norm in a painfully arcane debate that nonetheless has profound significance for national security, individual freedom and global commerce in the electronic age.
Responding to a $1,000 challenge from RSA Data Security Inc., whose business is directly hindered by U.S. export restrictions on cryptography, Goldberg broke the most secure data encryption code the government allows to be exported in 3 1/2 hours.
“The cryptography software that you are allowed to export is so weak as to be useless,” said RSA spokesman Kurt Stammberger. “It shows you that any kid with access to computers can crack this kind of cryptography.”
Well, not any kid.
Goldberg made headlines last year when he and his pals at Berkeley’s computer science department discovered a flaw in the security of a Netscape Communications Corp. software program designed to let people safely make credit card purchases via the World Wide Web. Netscape quickly put out a corrected version of its program.
The young cryptologist, at the “no-end-in-sight” stage in pursuing his doctorate degree, enjoys raising public awareness about computer security issues. But he had a special place in his heart for exposing what he likes to describe as the “ludicrous” vulnerability of the code the government approves for export.
“The export restrictions affect me a great deal,” Goldberg said. “I can’t publish my research on the Internet because of the export restrictions.”
The U.S. government, contending that if strong encryption was widely used it would prevent law enforcement officials from tracking criminals and spies, bars exports of codes higher than 40 bits. Each bit is part of a key that scrambles data sent across computer networks so that only the intended recipient can decode it.
The longer the key, the more possibilities there are, so the longer it will take to try all of them.
Basic math indicates there are a trillion possible combinations to a 40-bit key. So Goldberg linked together 250 workstations at Berkeley and programmed them to test every combination--at a rate of 100 billion per hour.
He found the key about halfway through the search. If the correct key had been the last combination, he estimates it would have taken him 10 hours. And if he’d had 500 networked computers at his disposal, he could have done it in half the time.
On Friday, the Commerce Department (in an unrelated move?) announced it would allow three companies to export 56-bit encryption software. Under a new Clinton administration policy that took effect Jan. 1, the companies must agree to incorporate features that would give government officials with a search warrant access to the keys.
That has caused many firms and civil libertarians to repudiate the plan. But the government’s 56-bit concession fails to impress Goldberg on strictly mathematical grounds.
“Fifty-six bit is only 65,000 times harder than 40-bit,” he shrugged. “Now, 128 bit is another thing. There isn’t enough time left before the sun explodes to crack that.”
