From: smb@research.att.com (Steven Bellovin)
Subject: Re: Off the shelf cheap DES keyseach machine
Organization: AT&T Bell Laboratories
Lines: 16

In article <7020.Apr2207.05.3993@silverton.berkeley.edu>, djb@silverton.berkeley.edu (D. J. Bernstein) writes:
> In article <1993Apr21.132318.16981@ulysses.att.com> smb@research.att.com (Steven Bellovin) writes:
> > And key size is one of the things that can be
> > verified externally.
> 
> Gee. Say they feed the 80-bit key through Snefru-8 and take the first 60
> bits of the result, then use those 60 bits as the real key. How do you
> figure out that each key is one of 2^20 ``equal'' keys? You can try a
> birthday attack, but if the key can be changed only once a second then
> you will need several lifetimes to get reliable statistics.

You're right, and I retract the suggestion.  Still, I wonder.  That
there are only 60 bits of key information should, in principle, be
detectable.  Maybe some variant of the tests Rivest et al. did to
demonstrate that DES was probably not a group?  It should make an
interesting paper -- a black-box analysis of a cryptosystem.
