When the Electronic Frontier Foundation and distributed.net broke the DES Challenge III in less than a day, revealing the message See you in Rome (second AES Conference, March 22-23, 1999), what was the actual full value of the key they found?

I wasn't able to find it published anywhere online.


1 Answer 1


I spoke too soon; it seems that distributed.net maintains an IRC channel, irc.libera.chat/distributed; I asked, and a regular there, ertyu, directed me to this blog post — apparently the "blog" and "news" sections of distributed.net are separate, which explains why I wasn't able to find it at first:


At 07:15 am PST (14:15 UTC), just about the time when we all started getting worried about the 24-hour waypoint, the solution to DES-III arrived. The winning key, 92 2C 68 C4 7A EA DF F2, revealed the plaintext message:

The unknown message is: See you in Rome (second AES conference, March 22-23, 1999

The winning key was found by EFF’s Deep Crack hardware, and submitted to the distributed.net servers immediately. RSA confirmation of the success followed shortly thereafter.

This is also available on distributed.net's FAQ page, under “General background information” > “Nine victories for distributed.net so far...”:

Our third victory was on January 19, 1999 at 07:15 PST, when we found the correct key to the RSA Labs DES-III contest, with the help of the Electronic Frontier Foundation's "Deep Crack" customized DES cracker. The correct key was 92 2C 68 C4 7A EA DF F2, and it revealed the following message:

The unknown message is: See you in Rome (second AES conference, March 22-23, 1999)

You can verify this yourself:

from Crypto.Cipher import DES  # https://pypi.org/project/pycryptodome/

# https://web.archive.org/web/20020605233058/www.rsasecurity.com/rsalabs/challenges/des3/index.html

iv = bytes.fromhex('da 4b be f1 6b 6e 98 3d')

ct = bytes.fromhex('''\
bd 0d de 91 99 60 b8 8a 47 9c b1 5c 23 7b 81 18 99 05
45 bc de 82 01 ab 53 4d 6f 1c b4 30 63 3c ee cd 96 2e
07 c6 e6 95 99 9c 96 46 5a 95 70 02 02 70 98 bd 41 c2
88 a9 f0 2f 8b e5 48 20 d2 a8 a0 6b bf 93 de 89 f6 e2
52 fd 8a 25 eb d0 7d 96 83 ee a4 2d c8 8d 1b 71

# https://blogs.distributed.net/1999/01/19/19/03/nugget/

k = bytes.fromhex('92 2C 68 C4 7A EA DF F2')

_result = DES.new(k, DES.MODE_CBC, iv=iv).decrypt(ct)
assert all(c == _result[-1] for c in _result[-_result[-1]:]), 'bad PKCS#7 padding'
result = _result[:-_result[-1]].decode('ascii')

  • 1
    $\begingroup$ It is always better to ask to the source... $\endgroup$
    – kelalaka
    Commented Feb 15 at 21:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.