Re: "Strong" crypto and export rule changes.

[Adam Shostack <adam@homeport.org>]

Steve Schear wrote:
| >        What the US government will allow to be exported is not "strong
| >encryption."  It is encryption only slightly too strong to be broken
| >by an amateur effort.  For the right investment in custom hardware, it
| >falls quickly.  (500,000 $US = 3.5 hour avg break).
| >
| 
| Considering Ian's feat you certainly seem to have had your crystal
| ball in hand.  

	I wear three around my neck.  Its a new age thing.

	More seriously, that estimate is the cost of breaking DES on
custom hardware, based on Wiener's figures.  Ian got RC4-40 in 3.5
hours on I don't know how much hardware, not a lot of it custom,
AFAIK.

Adam

-- 
Pet peeve of the day: Security companies whose protocols dare not
speak their name, because they don't have one. Guilty company of the
day is now V-One.