7
$\begingroup$

In this presentation at the 30c3 (long but extremely interesting and well-documented), Jacob Appelbaum gave this verbal advice (circa 43'30"):

look for the constants that you might find in RC6

I'm trying to make sense out of that; my problem is, there are very few constants that I could find in the description of RC6. Any idea?

Improve this question
$\endgroup$
4
  • 3
    $\begingroup$ I only see constants $P$ and $Q$ in the key schedule and in the paper they are descibed as nothing up my sleeve, i.e.,derived from $e$ and the the Golden ratio, but I didn't check that. $\endgroup$
    – DrLecter
    Dec 30, 2013 at 21:54
  • $\begingroup$ @DrLecter: I missed these constants on first reading! That could well be the answer, or at least part of it. $\endgroup$
    – fgrieu ♦
    Dec 30, 2013 at 22:28
  • 3
    $\begingroup$ I just checked the hex values for $P$ and $Q$ and they are correct as given in the paper as $P=\tt B7E15163$ and $Q=\tt 9E3779B9$ when taking rounding into account :/ $\endgroup$
    – DrLecter
    Dec 31, 2013 at 15:29
  • $\begingroup$ I haven't watched the video, but could he be talking about the fact that RC6 was used by some NSA malware (likely just to evade heuristic detection, since a more popular cipher's constants might set off red flags)? $\endgroup$
    – forest ♦
    Feb 16, 2021 at 2:19

1 Answer 1

Reset to default
1
$\begingroup$

The Key schedule appendix of the RC6 paper (Rivest et al.) defines two arbitrary constants in hexadecimal notation. They also appear in RC5.

  • $P_{32} = \tt{B7E15163}$
  • $Q_{32} = \tt{9E3779B9}$

Be aware that the binary coding of these constants will vary based on the endian-ness of the computer architecture.

There seems to be nothing 'special' about these constants in relation to the construction of the RC6 algorithm. They can be replaced with any random value, producing an incompatible variant of RC6 with presumably identical security properties, and the authors make note of this. (The 'official' constants were chosen based on open criteria, described in the paper, in order to dispel any notion that they induce a back door.) Thus a serious search for RC6 would include RC6-alikes and look for algorithm structure rather than constants.

There are no other arbitrary numeric constants defined in RC6, unless you would go so far as to consider the number of rounds etc. as such.

By the way, Appelbaum's talk wasn't "well documented" enough to provide any justification for this RC6 hunt. Typically of Appelbaum, he takes the position, "Trust me, I've seen the secret documents." Sounds like some senators I know.

Improve this answer
$\endgroup$
4
  • 1
    $\begingroup$ Regarding your last paragraph: These are the Snowden documents, and he is not the only person that processed them. Glenn Greenwald and some authors of Der Spiegel among others agree with Jacob (e.g spiegel.de/international/germany/…). However common sense does the job here, if you just open your eyes and see the manhunt and harassment all those people have suffered. If they were just lying, why all the trouble? $\endgroup$
    – chefarov
    Nov 15, 2018 at 8:50
  • $\begingroup$ Also most of these documents are available online, e.g: eff.org/files/2014/01/06/20131230-appelbaum-nsa_ant_catalog.pdf However it seems that most people in tech community tend to believe anything that supports their ideology and dismiss anything else, regardless the clues... $\endgroup$
    – chefarov
    Nov 15, 2018 at 8:58
  • $\begingroup$ @chefarov The ANT Catalog is not a Snowden document, its source has never been revealed or vetted or even openly discussed, and the Der Spiegel article does not mention RC6. $\endgroup$
    – ruief
    Nov 15, 2018 at 15:37
  • 1
    $\begingroup$ 1) I wasn't talking about RC6, but for your broad generalization (last sentence) about a person that you don't know, and who has been harassed/attacked by US in such a way (I would say top10 in EU/US) that almost proves his sayings. 2) We don't know the source of ANT (although Snowden is still a possible candidate), but I was referring to presentation docs (accepted by eff & dozen researchers). In any case Snowden's docs describe similar things. $\endgroup$
    – chefarov
    Nov 15, 2018 at 16:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.