EFF DES cracker
| Industry | Digital rights, cryptography advocacy |
|---|---|
| Founded | 1990 |
| Headquarters | San Francisco , United States |
Key people | Paul Kocher (project leader for Deep Crack) |
| Products | EFF DES cracker ("Deep Crack") |
| Website | www |
In the field of cryptography, the EFF DES cracker, also known as "Deep Crack", is a device constructed by the Electronic Frontier Foundation (EFF) in 1998. Its function was to carry out a brute force exploration of the entire Data Encryption Standard (DES) cipher's key space, decrypting data by systematically testing every possible key. The machine aimed to prove that the key length used in DES was inadequate for ensuring security.
Comprehensive technical information—including block diagrams, circuit schematics, the VHDL source code for the custom-designed chips, and an emulator—was made available in the publication Cracking DES. The design was released into the public domain, permitting unrestricted copying, utilization, or modification. To circumvent US export controls on cryptographic software, the source code was disseminated as a printed book, safeguarded by the First Amendment. Additionally, machine-readable metadata was embedded to facilitate transcription through OCR technology.
Background
The DES algorithm employs a 56-bit key, corresponding to 256 potential keys—around 72 quadrillion possibilities. Since its introduction in 1975, one of the primary criticisms has been this relatively brief key length. In 1976, Martin Hellman and Whitfield Diffie from Stanford University estimated that constructing a machine capable of exhaustively searching all keys within a single day would cost approximately $20 million, a sum mainly affordable to national intelligence entities such as the US National Security Agency. Over the following twenty years, improvements in chip cost-effectiveness made it feasible for smaller groups like the EFF to launch practical attacks.
The DES challenges
DES was endorsed by the US government as a federal standard for protecting unclassified information. Beginning in 1997, RSA Security challenged the robustness of DES by offering cash rewards through the DES Challenges. The initial challenge was solved after 96 days by the DESCHALL Project, led by Rocke Verser in Loveland, Colorado. Subsequently, DES Challenge II-1 was cracked by distributed.net within 39 days in early 1998.
In 1998, the EFF constructed Deep Crack at a cost below $250,000. On July 15 of that year, Deep Crack successfully decrypted a message encrypted with DES in just 56 hours, earning a $10,000 prize and illustrating that DES could be compromised practically by governmental bodies and large enterprises.
Half a year later, partnering with distributed.net for DES Challenge III, the EFF employed Deep Crack to break another encrypted message in less than a day—22 hours and 15 minutes—securing an additional $10,000 reward. Although DES remained a federal standard later that year, it was recommended to use Triple DES for enhanced security.
Because of DES's limited key space and the substantial computational demands of Triple DES, both algorithms were ultimately replaced by the AES, which became the Federal standard on May 26, 2002.
Technology
The development of Deep Crack involved collaboration between Cryptography Research, Inc., Advanced Wireless Technologies, and the EFF, with Paul Kocher—president of Cryptography Research—leading the project. Advanced Wireless Technologies manufactured 1,856 specialized ASIC DES chips (known as Deep Crack or AWT-4500), which were installed on 29 circuit boards housed within six cabinets inside a Sun-4/470 chassis.
A single personal computer managed key search coordination across these chips at speeds exceeding 90 billion keys per second. This capability allowed an exhaustive search of the entire keyspace in roughly nine days on average—typically requiring half that time to locate the correct key.
In 2006, COPACOBANA (COst-optimized PArallel COdeBreaker), an FPGA-based device offering a more affordable solution for cracking DES, was introduced by leveraging advancements in integrated circuit technology.
By July 2012, researchers David Hulton and Moxie Marlinspike presented a cloud computing platform able to brute-force DES keys utilized in the MS-CHAPv2 protocol within approximately 24 hours. This development broadened public access to recovering DES keys from known plaintext–ciphertext pairs.