4
$\begingroup$

I have a laptop that has the CPU and the RAMs shown below in the images.

My question is that, using this CPU and the RAMs, how much time would it take for me to crack an old school DES algorithm with 56 bit key.

I have read on the web that it was cracked in 56 hours using a 220,000$ machine in 1998. But I believe we are much more advanced in computing speed after 15 years and counting.

I would also highly appreciate if someone can explain the steps of how such a calculation takes place.!

CPU RAM

$\endgroup$
  • $\begingroup$ Brute-force is an embarrassingly parallel problem, so I'd expect a sequential CPU to do pretty badly, even with a bitsliced AVX2 implementation. $\endgroup$ – CodesInChaos Mar 1 '15 at 13:30
  • $\begingroup$ @CodesInChaos what do you mean by 1) parallel problem. 2) sequential cpu and 3)bitsliced AVX2. $\endgroup$ – tony9099 Mar 1 '15 at 13:32
  • $\begingroup$ @tony9099, If you ever heard about DES cracker project, here is a link to explain better: en.wikipedia.org/wiki/EFF_DES_cracker In fact, many years before, the setting of the project, many cryptographers allert the community that the 56 bits of single DES are too short for a massive and parallel attacks. Nowadays single DES in not used for application, unless Triple DES mode is more secure. $\endgroup$ – Robert NACIRI Mar 1 '15 at 14:39
  • 1
    $\begingroup$ @tony9099 It seems that you are missing the required knowledge to explain this thoroughly. Note that you can crack a DES key (if you have enough knowledge about the plaintext). Cracking the DES algorithm is something else entirely. I'm not sure that somebody can explain it better than the answer given. $\endgroup$ – Maarten Bodewes Sep 6 '15 at 12:27
4
$\begingroup$

I can't provide you with good numbers without actually benchmarking on your system.

All I can provide you with are estimates, based on the fact that Serpent is roughly as fast as DES. Of course the figures I can give you aren't actually brute-force figures but rather how much data can be encrypted per time, but this should give a solid estimate of the required time.

The general approach is to measure how many keys per second you can try and then divide $2^{56}$ by this number which will result in the number of seconds you'll need.

So let's estimate for Serpent with 56 bits. Serpent can get up to 0.16 GB/s on your machine as this is mainly computation bound. 0.16 GB is roughly $2^{24}$ blocks for DES, meaning you can roughly try $2^{24}$ keys per second. This means you need $2^{56}/2^{24}=2^{32}$ seconds for this which is equal to 136 years.

I'm sorry but I doubt this is feasible for you.
Note that even the brand-new Intel Core i7 6700K can only do 0.47 GB / s meaning an i7 6700K would also still require roughly 45 years. And to get even more crazy: the Intel Core i7 5960X is the best consumer CPU as of now can only do 0.63 GB / s resulting in 34 years. Now finally consider the currently strongest possible server mainboard running 8x Intel Xeon E7-8890v3 with 18 cores. There's no measured benchmark out there but I assume the performance to scale linearly with the number of cores (75 MB/s per core) and the frequency (62.5 MB/s with E7's freq). This would mean that this board could do 9GB / s of Serpent meaning $2^{30}$ blocks and thereby $2^{26}$ seconds being equivalent to 2.12 years (however this board would roughly cost $56k in 2015).

$\endgroup$
  • $\begingroup$ One may want to note that using GPUs or FPGAs will probably yield much better times due to the higher parallelism... $\endgroup$ – SEJPM Aug 4 '18 at 9:16
  • $\begingroup$ @tony9099 I was doing some field testing myself, CPU is really too low-parallel. However I've hit following site claiming to find a DES key in 26 hours using FPGA $\endgroup$ – gusto2 Apr 4 at 22:09
1
$\begingroup$

The experimental approach is probably the most useful to estimate crack times on any given hardware. Using JohnTheRipper, you can benchmark a hash algorithm with the --test option. In the latest JohnTheRipper (bleeding-jumbo branch), the DES hash algorithm is called crypt, so:

$ john --format=crypt --test
Will run 4 OpenMP threads
Benchmarking: crypt, generic crypt(3) DES [?/64]... (4xOMP) DONE
Speed for cost 1 (algorithm [1:descrypt 2:md5crypt 3:sunmd5 4:bcrypt 5:sha256crypt 6:sha512crypt]) of 1, cost 2 (algorithm specific iterations) of 1
Many salts:     1053K c/s real, 268164 c/s virtual
Only one salt:  1060K c/s real, 267927 c/s virtual

With 4 threads, I get about a million hashes/second. DES has a key space of $2^{56}$, but for most real (UNIX) passwords this can probably be assumed to be $95^{8}$ (for 8 printable ASCII characters). Unfortunately, this is still $95^8 / 1060000 =$ 293 years to exhaust the key space.

So, a CPU (even a modern one) is probably the wrong tool for this job.

$\endgroup$
0
$\begingroup$

Here is a simple calculation time for brute force 56 bits DES key with a laptop.

Imagine your laptop execute one DES operation in $1 \mu s$, which is very optimistic. Exploring the entire $2^{56}$ key space would costs $2^{56}$ operations. This equates to approximately $0,72. 10^{17}\; \mu sec$. Converting this quantity in hours, days and years, you would need approximately $2. 10^9 $ years.

This calculation doesn't take attacks on the DES algorithm in consideration.

$\endgroup$
  • 1
    $\begingroup$ 5000 CPU cycles per block sounds quite slow to me. $\endgroup$ – CodesInChaos Sep 6 '15 at 12:58
  • $\begingroup$ @CodesInChaos, the given estimation ,is related to a core i5 processor running at 2.5 GHz, wiith no special DES Hardware, and executing a DES code. Even if the code is efficiently optimized by a ratio of $10^3$ it would take about $10^6$ years on a single DES. $\endgroup$ – Robert NACIRI Sep 6 '15 at 19:41
  • 1
    $\begingroup$ I think you forgot the step of converting microseconds to seconds, because you're off by a factor of a million. 0.72*10^17 μs is only 2283 years. $\endgroup$ – Macil Mar 16 '17 at 23:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.