# DES Crack simulation

I wish to simulate an implementation of a DES Cracker using verilog. But every paper I read give only abstract hints but no concrete steps or how really to go about it. How is it usually done? For example for DES encryption there exists a sequence of steps with ordered connection of known blocks.

-

A DES cracker just tries out keys until a matching key is found.

So, with Verilog, you design a circuit which includes:

• a counter, which enumerates possible keys in a fixed order;
• a DES encryption engine, which, given a plaintext block and a key, computes the corresponding ciphertext block;
• a comparison engine, which compares the ciphertext block obtained from the DES engine with the expected ciphertext block, and raises a flag if a match is found.

The outer system (say, the PC which controls the experiment) just has to measure the exact time at which the flag is raised, to infer the counter value at that time -- depending on the precision of the measure, this will narrow down the set of possible keys down to a few millions at most, and the PC can finish the work in a fraction of a second.

Of course, there are $2^{56}$ possible DES keys, which is a quite huge number. A complete DES cracking engine will include many copies of the DES encryption and ciphertext comparison engines, each engine exploring a given fraction of the set of possible keys (to some extent, counters may be shared).

If you read French, my PhD thesis contains a description of a DES-cracking engine with FPGA.

-

A great deal here depends on what sort of attack you want to mount. If you have a known-plaintext, then Thomas's answer is covers the majority of the problem. Nearly all you need to add is an actual DES core.

If, however, you don't have a known plaintext, you need to add some statistical analysis of the result to figure out whether you've succeeded. In a typical case (e.g., Deep Crack) this is handled in two parts: one does a simplistic but fast analysis to basically see if the result looks like it might be non-random at all. If that produces a positive result, you pass that result to a control processor that can do a much more thorough analysis to see if it looks like real plain text.

The obvious place to look for details about that would be Cracking DES.

-