A Java implemented key collision attack on the Data Encryption Standard (DES) John Loughran, Tom Dowling NUI, Maynooth, Co. Kildare, Ireland PPPJ ‘03

17 th June 2003Java implemented DES attack2 Java Cryptography Used Java Cryptographic Extension (JCE) based on Java Cryptographic Architecture (JCA) Contains java.security and javax.crypto packages Used Austrian IAIK version of the JCE Contains classes which simplify encryption process E.g. factory methods to return instances of a class as: Cipher cryptObject = Cipher.getInstance(“DES”);

17 th June 2003Java implemented DES attack3 Data Encryption Standard (DES) DES is a symmetric block cipher Same key for encryption and decryption Works on blocks of fixed length DES has 2 56 different keys =

17 th June 2003Java implemented DES attack4 Birthday Paradox Brute force attack: Try all 2 56 possible keys Birthday attack: Reduces complexity of attack to 2 28 i.e. sqrt(2 56 ) ~ For a set with n (2 56 for DES) possible keys In two subsets of randomly generated keys of size sqrt(n) (2 28 for DES) Probability of a match is 0.63 [Stallings, 2003]

17 th June 2003Java implemented DES attack5 The Biham Algorithm A known plaintext header is used E.g. Postcript file header: “%!PS-Ado” This plaintext header is encrypted using 2 28 different random DES keys Resulting (ciphertext, key) pairs stored in a table Compare 2 28 incoming ciphertexts of the same header whose keys are unknown with table When a match is found the corresponding key is returned The key can be used to decrypt the message or even substitute a favourable message

17 th June 2003Java implemented DES attack6 Implementing the Attack Used the JCE to generate the keys as: KeyGenerator keyGen = KeyGenerator.getInstance(“DES”); keyGen.init(new SecureRandom()); Key key = keyGen.generateKey(); Stored (ciphertext, key) pairs in Hashtables Searching complexity of O(1)

17 th June 2003Java implemented DES attack7 Memory Considerations Unable to keep a Hashtable with 2 28 pairs in memory Even using a Pentium 4, 2 GHz, 1 GB RAM, 60 GB HD With virtual memory set to 4 GB Despite increasing Java heap size to max using switch at runtime: C:\>java –Xms 1640m –Xmx 1640m CrackDES

17 th June 2003Java implemented DES attack8 Multiple Hashtable Approach 2 14 Hashtables each containing 2 14 (ciphertext, key) pairs were generated During generations pairs were allocated to a particular Hashtable based on the mod of the hashCode() of the ciphertext Hashtables were finally stored on disk as files bightable ser to bightable ser after various merging operations

17 th June 2003Java implemented DES attack9

17 th June 2003Java implemented DES attack10 Finding a Key Arrays of ciphertexts of the same plaintext header were generated to simulate incoming ciphertexts with unknown keys Each ciphertext was examined as follows: Its hashCode() mod was obtained The corresponding Hashtable was read in and searched If a matching ciphertext was found the corresponding key was returned

17 th June 2003Java implemented DES attack11

17 th June 2003Java implemented DES attack12 Time Considerations To speed up the search process the “incoming” ciphertexts were split up into arrays such that Each array contained ciphertexts whose hashCode() mod were the same Thus only one Hashtable needs to be read in for each array This reduced the estimated time needed to find a key from 6.2 years to 2.3 hours!

17 th June 2003Java implemented DES attack13 Space Optimisation Storing only the key value as a Long object rather than a Key object reduced the space required for the Hashtables from an estimated 55 GB to 8 GB This necessitates creating a Key object from the returned key value using SecretKey methods from the JCE

17 th June 2003Java implemented DES attack14 Conclusions Biham algorithm implemented successfully in Java Use of JCE in cryptanalysis demonstrated Space and time optimisations mean that DES can now be cracked in 2 hours on a single PC using Java Possible future work on implementation of a parallel search using a distributed system

17 th June 2003Java implemented DES attack15 Website This presentation and the full text of the thesis including references and appendices can be downloaded from my website:-