16

I am considering attacks on Two-Key Triple-DES Encryption assuming $2^{32}$ known plaintext/ciphertext pairs (that's a mere 32GiB of ciphertext) by the method devised by Paul C. van Oorschot and Michael J. Wiener: A Known-Plaintext Attack on Two-Key Triple Encryption (in proceedings of Eurocrypt 1990), or another published method not requiring significantly more DES computations.

As a synthetic information for decision makers, I am looking for an independent estimate of how much time this is expected to require, assuming all the RAM ever built by mankind to that day (of April 2012) was put to full use.

Note: I'm purposely not asking when the attack could become feasible using all the RAM ever built by mankind, because estimates on the amount of RAM mankind will build, and when, are less falsifiable.

Update: I am not considering cost; neither of RAM, power, logic including DES engines (as long as the number of DES operations remains within $2^{90}$). I am willing to assume that the amount of RAM used, and its effective speed, are the only factors to account for in determining the expected duration of the attack. This is similar to the hypothesis made by the authors of the linked paper, that their attack is limited by the amount (or cost) of RAM used, with all other factors of secondary importance.

Update: sadly, nobody dared answer the question and the bounty period is over. Thus here is a first order answer to criticize.

fgrieu
  • 140,762
  • 12
  • 307
  • 587
  • Am I correct in assuming that part of the problem is deriving an estimate the total RAM built to date? – B-Con May 03 '12 at 04:41
  • Is this question really correctly put? If you refer to the Oorshot-Wiener paper originally published in 1990, it seems the memory requirements are fixed by the amount of known plain text, and with $2^32$ known plain text the largest of the two tables requires $2^40$ bits, i.e. just one terabit. Or am I missing something? – Henrick Hellström May 03 '12 at 05:31
  • Yes, part of the problem is estimating the total amount of RAM built to date, and its usable access rate in the context of the attack. $2^{32}$ blocks is here to match the conditions assumed by the authors. 32 Giga Bytes puts that number in perspective. Yes in the simplest setup the attack needs only $2^{40}$ bits in the biggest table, but runtime is horrific; thus I assume we can put to full use all the RAM built to date, and ask for the runtime. Which is the best way that I could devise to make the result graspable as a single number. – fgrieu May 03 '12 at 05:57
  • The reason the large table was set to $2^{40}$ bits, was that it is supposed to contain a hash table of the known plain text. AFAICS you have no use for more RAM, unless you also have more known plain text to fill it with. – Henrick Hellström May 03 '12 at 06:07
  • Yes, but the parameter $n$ equals the number of known plain text-cipher text pairs. They also discuss how to arrange the memory chips in a way that enables parallel computing, but that should be less of a problem with modern hardware, considering that the main table is read-only. – Henrick Hellström May 03 '12 at 07:05
  • @HenrickHellström: Part of the problem is: what is the speedup achieved with several independent machines? (25 are considered by the authors at end of page 7) – fgrieu May 03 '12 at 07:21
  • I am no hardware expert, but I assume the speedup is proportional to the number of CPU cores you add to the computer, presuming each gets its own bus to the RAM memory (which should be perfectly possible considering the table is read-only for the duration of the attack process). – Henrick Hellström May 03 '12 at 07:35
  • @HenrickHellström: it is impractical to share memory across independent machines; rather, one can duplicate the memory, getting a near-linear speedup with the amount of memory (and other hardware). According to the authors, most of the investment for the attack is that of memory (they neglect power cost, and I'm willing to do the same; they neglect the cost of DES engines, with a rationale that holds up to some point). – fgrieu May 03 '12 at 09:16
  • That's right, but each machine might e.g. have 2TB of memory and 4 CPUs with 10 cores each (which is something you can buy from e.g. HP today), corresponding to 40 "peripheral components" with the terminology of the original paper. Each one of those machines might have one copy of the large P-table each. One server might manage the smaller and less frequently probed B-table. – Henrick Hellström May 03 '12 at 10:52
  • IOW: Is it cheaper to double RAM and CPUs, instead of replacing the CPU with one with the double amount of cores, or replacing the motherboard and double the number of CPUs? The number of DES engines are doubled in each case. ISTM getting a motherboard with 512 DES engines would probably be more expensive than 128 GB of RAM. – Henrick Hellström May 03 '12 at 16:23
  • @HenrickHellström: my reading of the article is that the authors assume the DES engines (your CPUs) saturate memory with requests. They disregard all cost but that of memory. – fgrieu May 04 '12 at 06:09
  • 1
    Yes, but I reckon you wanted a semi-realistic lower bound of the time required for the attack, and clearly that depends not only on the amount of RAM ever built, but also on engineering questions and a lot of other costs; not only the cost of other hardware, but how many CPU cores and DES engines you might physically wire to a single instance of memory, what it would cost to manufacture such a circuit, and the cost of energy for both running the thing and cooling it? Simply put: Is it really still the amount of memory available that puts a limit to the attack, rather than other factors? – Henrick Hellström May 04 '12 at 08:07

1 Answers1

9

The original article rightfully neglects the cost of DES computations (there are less than $2^{90}$) and everything except memory accesses to its Table 1 and Table 2. I go one step further: considering that Table 1 is initialized only once and then read-only, it could be in ROM, and I neglect all except the accesses to Table 2. The attack requires an expected $2^{88}$ random writes and as many random reads to Table 2, organized as $2^{25}\cdot 24$-bit words.

The cheap PC that I bought today (of May 2012) came with 4 GByte of DDR3 DRAM, as a single 64-bit-wide DIMM with 16 DRAM chips each $2^{28}\cdot 8$-bit, costing about \$1 per chip in volume. Bigger chips exists: my brand new 32-GByte server uses 64 chips each $2^{29}\cdot 8$-bit, and these are becoming increasingly common (though price per bit is still higher than for the mainstream $2^{28}\cdot 8$-bit chips).

Two mainstream $2^{28}\cdot 8$-bit chips hold one instance of Table 2, and one 124-bit word can be accessed as 8 consecutive 8-bit locations in each of the two chips simultaneously (consecutive accesses are like 15 times faster than random accesses). One $2^{29}\cdot 8$-bit chip would be slightly slower.

Assuming DDR3-1066 with 7-cycles latency (resp. DDR3-1333 with 9-cycles latency), 8 consecutive access require at least $(7\cdot 2+7)/1066\approx 0.020$ µs (resp. $(9\cdot 2+7)/1333\approx 0.019$ µs). This is a decimal order of magnitude less than considered in the original article. For each instance of Table 2, that is 0.5 GByte, we can perform at most $365\cdot 86400\cdot 10^6/0.019/2\approx 2^{49.6}$ read+write accesses per year to Table 2 using mainstream DRAM. Thus with $n$ GByte of mainstream DRAM, and unless I err somewhere, the expected duration is $2^{37.4}/n$ years.

Based on press releases of a serious reference, there are less than $2^{31}$ PCs around, and assuming that my cheap PC is representative, that's $2^{33}$ GByte. Another way to look at that is that each 0.25-GByte chip cost about \$$1$; and the DRAM revenues in 2011 is less than \$$2^{35}$, thus enough for $2^{33}$ GByte (but notice that most of the revenue is from chips that are not optimized for cost per bit). I'll guesstimate all the RAM ever built is equivalent to at most $2^{35}$ GByte of mainstream DRAM for the purpose of the attack.

Thus at the end of the day, my answer is: the attack in the original article, updated to use all the RAM chips ever built by mankind to mid 2012 at the maximum of their potential, has an expected duration of at least 5 years; or equivalently has odds at best 20% to succeed in one year.

Update: as noted by the authors of the original article, "the execution time is not particularly sensitive to the number of plaintext/ciphertext pairs $n$ (provided that $n$ is not too small) because as $n$ increases, the number of operations required for the attack ($2^{120-\log_2 n}$) decreases, but memory requirements increase, and the number of machines that can be built with a fixed amount of money decreases". By the same argument, our required amount of RAM is not much changed if we get more known plaintext/ciphertext pairs.

fgrieu
  • 140,762
  • 12
  • 307
  • 587