Dr. Dobb's is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them. Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Channels ▼

Book Review: Brute Force: Cracking the Data Encryption Standard

September 2005

Book Review: Brute Force: Cracking the Data Encryption Standard

Reviewed by Ben Rothke

Brute Force: Cracking the Data Encryption Standard
Matt Curtin
Springer, 2005
ISBN: 0387201092

Brute Force: Cracking the Data Encryption Standard is the story of the life and death of DES (data encryption standard). In the early 1970s, the U.S. government put out an open call for a new, stronger encryption algorithm that would be made into a federal standard, known as FIPS (Federal Information Processing Standard.). Numerous solutions were submitted as the DES candidate, including one from IBM. The IBM solution, originally called Lucifer, was chosen to be used as the encryption algorithm. After that, it became known as DES.

DES is the most widely used method of symmetric data encryption ever created. Its 56-bit key size means that there are roughly 72,000,000,000,000,000 (72 quadrillion) possible encryption keys for any given message. DES was always considered a strong encryption method, but strength is relative.

The strength of an encryption system is measured by how resilient it is against attack. From the outset, it was known that DES was susceptible to brute force attacks. A brute force attack, also known as an exhaustive search is an attack against a cryptosystem in which all possible values for the key are attempted — the bigger the key, the more difficult the attack.

It must be remembered that DES was developed long before desktop computers, so the feasibility of a computer that could perform a brute force attack against DES was rendered so expensive and infeasible that the 56-bit key space (in a 64-bit block) of DES was considered strong enough. In reality, Lucifer actually had an original design of a 128-bit block size and 112-bit key size, but politics got in the way, and DES was created in a crippled state from the onset.

By 1997, DES was cracked, and the start of its downfall had commenced. Brute Force: Cracking the Data Encryption Standard is a firsthand account of how DES was broken. Author Matt Curtin was a member of the DESCHALL team, which was created in response to the RSA Security Inc. RSA Secret Key Challenge. The challenge was to break a DES-encrypted message.

Brute Force comprises two interrelated parts. Part 1 is a short overview of cryptography and encryption. It also details how Curtin first became interested in cryptography in the Bexley, Ohio, public library. Part 1 sets the groundwork for the main subject matter of the book, which is Curtins diary of how DES was broken via DESCHALL.

The unofficial mantra of DESCHALL was that friends didnt let friends have idle computers. DESCHALL was led by Curtin, Rocke Verser, Matt Curtin, and Justin Dolske, and used an Internet-based distributed computing infrastructure. Since brute force attacks are naturally suited to distributed computing, it made for a perfect testing ground to break DES.

Part 2 details the ups and downs of the project. Designing a software system to crunch up to 72 quadrillion is not a easy task, combined with key server crashes, competitive foreign groups, and the U.S. government on your back, made the travails of DESCHALL a challenging endeavor. The success of DESCHALL was to get as many hosts involved as possible. Given the fact that the CPUs of most computers sit idle for most of their lives, such CPUs were of extreme value to DESCHALL.

While Brute Force can be dry at times (remember, this is a book about cryptography), it does have its humorous moments. Much of DESCHALL occurred in the summer of 1997, and many universities had powerful computers that would sit idle all summer. DESCHALL members attempted to harness that power and were astounded when the computer lab manager of Yale University refused to allow the labs computer to run DESCHALL client software. He stated that the computers had the newest processors in them and that he did not want to wear them out. Furthermore, the lab manager thought that running DESCHALL software would void the warranty with the computer manufacturer due to the undue strain it would place on the processor.

The DESCHALL team was victorious in June 1997 when they finally cracked the RSA Secret Key Challenge after processing about 25% of the 72 quadrillion keys. The message was encrypted with the appropriate message "Strong Cryptography Makes the World a Safer Place". DESCHALL succeeding in starting the beginning of the end of DES, which has since been replaced by the Advanced Encryption Standard (AES).

Brute Force is about as entertaining a read as you will get on cryptography. It provides a detailed account of how DES was taken down and is a interesting read for any student of cryptography and the crypto wars of the 1990s.

Ben Rothke, CISSP is a New-York based security consultant with ThruPoint, Inc. and the author of Computer Security: 20 Things Every Employee Should Know. He can be reached at [email protected].

Related Reading

More Insights

Currently we allow the following HTML tags in comments:

Single tags

These tags can be used alone and don't need an ending tag.

<br> Defines a single line break

<hr> Defines a horizontal line

Matching tags

These require an ending tag - e.g. <i>italic text</i>

<a> Defines an anchor

<b> Defines bold text

<big> Defines big text

<blockquote> Defines a long quotation

<caption> Defines a table caption

<cite> Defines a citation

<code> Defines computer code text

<em> Defines emphasized text

<fieldset> Defines a border around elements in a form

<h1> This is heading 1

<h2> This is heading 2

<h3> This is heading 3

<h4> This is heading 4

<h5> This is heading 5

<h6> This is heading 6

<i> Defines italic text

<p> Defines a paragraph

<pre> Defines preformatted text

<q> Defines a short quotation

<samp> Defines sample computer code text

<small> Defines small text

<span> Defines a section in a document

<s> Defines strikethrough text

<strike> Defines strikethrough text

<strong> Defines strong text

<sub> Defines subscripted text

<sup> Defines superscripted text

<u> Defines underlined text

Dr. Dobb's encourages readers to engage in spirited, healthy debate, including taking us to task. However, Dr. Dobb's moderates all comments posted to our site, and reserves the right to modify or remove any content that it determines to be derogatory, offensive, inflammatory, vulgar, irrelevant/off-topic, racist or obvious marketing or spam. Dr. Dobb's further reserves the right to disable the profile of any commenter participating in said activities.

Disqus Tips To upload an avatar photo, first complete your Disqus profile. | View the list of supported HTML tags you can use to style comments. | Please read our commenting policy.