From: Adam Shostack <adam@homeport.org>
Date: Sun, 2 Feb 1997 01:56:23 -0800 (PST)
To: Steve Schear <azur@netcom.com>
Subject: Re: "Strong" crypto and export rule changes.
Message-ID: <199702020956.BAA16024@toad.com>
MIME-Version: 1.0
Content-Type: text/plain


Steve Schear wrote:
| >        What the US government will allow to be exported is not "strong
| >encryption."  It is encryption only slightly too strong to be broken
| >by an amateur effort.  For the right investment in custom hardware, it
| >falls quickly.  (500,000 $US = 3.5 hour avg break).
| >
| 
| Considering Ian's feat you certainly seem to have had your crystal
| ball in hand.  

	I wear three around my neck.  Its a new age thing.

	More seriously, that estimate is the cost of breaking DES on
custom hardware, based on Wiener's figures.  Ian got RC4-40 in 3.5
hours on I don't know how much hardware, not a lot of it custom,
AFAIK.

Adam

-- 
Pet peeve of the day: Security companies whose protocols dare not
speak their name, because they don't have one. Guilty company of the
day is now V-One.