[rc5] key security question

Benedikt Eric Heinen beh at icemark.ch
Fri Jun 6 00:43:54 EDT 1997

> And, anyway, you don't need all this stuff because you can simply have 128
> bit RC5 which will give you the protection you wanted.
As long as 2 keys of 56 bits equal one of 128 bits, than this is true.
Still, I only took this as an example. With all the different
possibilities in bit strenghts of RC5 codes, I'd neither take the highest
nor the lowest number of bits, but rather encrypt the whole thing using
two "medium" sized keys as those will be "more exotic". I guess, that
someone not knowing which key you took will first try the strongest and
then the weakest alternative.

Also, if I only take one key, the "cracker" will find the correct answer
in the first pass. If I use two, he might first check one pass of each key
size before trying double passes.

I'd say - for most security, I'd probably go and encrypt a file using two
different keys (both of which most probably use different encryption
methods and different key sizes), and just for safety prepend the file
with a certain number of bytes containing random garbage, so that any
possible cracker always needs to decrypt a larger portion of the file
(whereas in this approach it is sufficient to decrypt the first 2 or 4
bytes and check those against the known part of the solution sentence). If
those don't match - we skip to the next key).

I'd just be interested in getting to know, how secure people would regard
an approach like:

  [I want to encrypt file]

  - prepend file with 541 bytes of random garbage
  - encrypt the whole thing with an IDEA key
  - prepend the result with another 67 bytes of random garbage
  - encrypt the whole thing with a 128 bit RC5 key.

I guess, the encrypted data would be pretty safe for the next 5-10 years
(mainly due to adding the random garbage to make checks more difficult).
But how safe would you deem this?



          Hiroshima '45           Chernobyl '86           Windows '95

To unsubscribe, send email to majordomo at llamas.net with 'unsubscribe rc5' in the body.

More information about the rc5 mailing list