RFC 3607

RFC 3607 💖 Chinese Lottery Cryptanalysis Revisited: The Internet as a Codebreaking Tool

Okay bestie, this one is from the Network Working Group and it's written by Marcus D. Leech of Nortel Networks. It came out in September 2003 and its category is Informational, so it's sharing info and isn't an official Internet standard 📚. It doesn't obsolete or update anything, since the header has no line for that 🎀.

---

Status of This Memo 🌸

This memo is here to give info to the Internet community. It is not a standard of any kind, and it's not trying to be one 🙈. Distribution is totally unlimited, so share it with everyone you know 🦋.

Copyright Notice 🌈

Copyright (C) The Internet Society (2003). All Rights Reserved.

Abstract 🧚

This doc is a glow-up of the so-called Chinese Lottery massively-parallel cryptanalytic attack ✨. It looks at Internet-based versions of the Chinese Lottery and how seriously bad those could get 💀.

1. Introduction ✨

Okay so in 1991, Quisquater and Desmedt [DESMEDT91] came up with an esoteric attack on DES or similar ciphers that is still technically sound 🧠. They called it the Chinese Lottery 🎰. The vibe was massively-parallel hardware, where the "hosts" running the cipher-breaking hardware were regular consumer electronics 🔌.

The Chinese Lottery was a thought experiment, and the decade since then has been a lot 😭. There's been serious growth in several areas, and that's exactly why this thought experiment deserves a second look 👀.

In 1991, the Internet had around 8 million reachable hosts attached to it. In 2002 it's a staggering 100 million reachable hosts 🤯. Meanwhile, the computing power the average desktop user has access to has grown by a factor of roughly 150 🔥.

2. Dangerous Synergy 💀

Here's the tea: the combined growth of the Internet plus the unstoppable march of Moore's Law have teamed up to create a dangerous potential for brute-force cryptanalysis of existing crypto systems 😬.

Over the last few years, a bunch of widescale attacks by so-called Internet Worms [SPAFF91] have compromised and infected a surprisingly large number of Internet-attached hosts 🪱. In 2001, The Cooperative Association for Internet Data Analysis [CAIDA2001] reported that the Code Red v2 worm infected over 350,000 hosts in its first 14 hours of operation 😱. Its payload was mischief: it defaced the host's website with a political message 📣. It was loud, bold, and got attention almost immediately 💅.

Now picture an Internet worm with a much darker plan, one that's more dangerous: brute-forcing a message to figure out the key used with it 🕵️‍♀️. To pull this off, the worm has to avoid detection long enough to build up a significant number of infected systems, so it has enough aggregate CPU cycles to finish the cryptanalysis ⏳. And it would also need to stay hidden long enough for the cracked key to be useful to whoever owns the worm 🎯. Recent research [USEN2002] on stealthy worms paints a very dark picture indeed 🖤.

Even if such a worm got detected, it would be nearly impossible to tell whose key it was going after. Any realistic attack payload has one or two pieces of ciphertext, plus some known plaintext or probable-plaintext characteristics. That's barely enough to figure out the likely victim 🤷‍♀️.

3. Winner phone home 📞

When one instance of the worm figures out the key, it has to contact the originator to hand it over 📬. It needs to do this in a way that keeps the originator from getting caught, so it's all about being sneaky 🥷.

One option is for the worm to public-key encrypt the key under the originator's public key(s), then stash it in some innocuous spot on the website of the compromised host 🍓. The worm could also back-propagate, so a bunch of compromised websites in the worm's topological neighborhood also hold the data 🕸️. The file with the key would be tagged with a unique keyword that the originators look for now and then using Internet search engines 🔎. To make this more efficient, the worm could use the "keyword registry" services of various Internet search engines 🧚.

Another route is posting a (possibly PGP-encrypted) message to several newsgroups through an anonymous posting service 📰. Internet "chat" services like IRC could work too. Honestly there's already an emerging tradition of using IRC and similar services for real-time, anonymous control of worms and viruses 🫣.

Any of these methods can be used in two directions: the "winning" worm instance sends its results back, and the originator sends new work to the huge army of compromised systems 🪖.

4. Evaluating the threat 🔥

Both Internet growth and CPU performance follow a reasonably predictable doubling interval 📈. Computing hardware performance still seems to be following Moore's Law, where performance doubles every 1.5 years ⚡. Internet growth seems to be doubling every 3 years 🌐.

Once we set a common epoch for both performance and Internet growth, we can work out the likely attack time for any given year using plain arithmetic 🧮.

The simplifying assumption here is that it's possible to build a suitably stealthy worm, and that it can reach a steady-state infection of about 0.5% of all attached hosts on the Internet 🦠.

In 1995, J. Touch, at ISI, published a detailed performance analysis of MD5 [RFC1810] 📊. Back then, software MD5 performance peaked at 87 Mbits/second, which is the equivalent of 170,000 single-block MD5 operations per second 💻. In that same year, peak DES performance was about 50,000 setkey/encrypt operations per second 🔐.

In 1995 the Internet had about 20,000,000 attached hosts. In 2002 there are a staggering 100,000,000 attached hosts 😳.

A simple C program, given in Appendix A (see the next part, bestie 🧚), can predict how our hypothetical worm performs in any given year. Running this program for 2002 gives:

    Year of estimate: 2002
    For a total number of infected hosts of 503968
    aggregate performance: MD5 9.79e+11/sec DES 2.88e+11/sec
    DES could be cracked in about 1.45 days
    DES with 8 character passwords could be cracked in 16.29 minutes
    MD5 with 64-bit keys could be cracked in about 218.04 days
    MD5 with 8 character passwords could be cracked in 4.79 minutes

So what do these numbers tell us? An undetected attack against MD5, using a reasonable key length, isn't likely in 2002 🙅‍♀️. A successful attack against DES, though, looks like a near-certainty 🚨.

Full Copyright Statement ✨

Okay bestie, time for the legal bit 💅 Copyright (C) The Internet Society (2003). All Rights Reserved.

So here's the deal 🎀 Anyone can copy this doc and share it, and they can make derivative works that comment on it, explain it, or help people implement it. Those can be prepared, copied, published, and distributed, in whole or in part, with no restrictions of any kind, as long as the copyright notice and this paragraph are on every copy and derivative work. BUT the doc itself may not be modified in any way, like deleting the copyright notice or the references to the Internet Society or other Internet organizations. The only exceptions are when it's needed for developing Internet standards, where the copyright procedures in the Internet Standards process must be followed, or when it's translated into languages other than English 🌈

These permissions are perpetual, so they won't be revoked by the Internet Society or its successors or assignees 🦋

And the fine print 🙈 This document and the info in it are provided "AS IS", and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. 💀

Acknowledgement 🫶

Funding for the RFC Editor function is currently provided by the Internet Society. Thank you, Internet Society 💖