RSA Data Security is trying to drive home a very simple point: The US government's standard for securing sensitive data from prying eyes is far too weak.
The encryption technology vendor launched another encryption challenge Tuesday. RSA's DES Challenge III invites hackers and computer experts to illustrate the main point repeatedly made by opponents of US encryption policy.
RSA claims messages and data secured with the Data Encryption Standard, or DES, can be cracked in a few days. Therefore, it argues, the government should replace DES with more modern, stronger encryption technology.
The government established the 56-bit DES as a standard in 1977. It claims that the vast difficulty and expense in cracking DES makes it sufficiently safe. Allowing the use of stronger encryption, the government maintains, would only help terrorists and other criminals communicate without government monitoring.
The export of 128-bit "strong" encryption without "key recovery" is illegal. Key recovery allows third parties, such as law enforcement, to retrieve encrypted information. The US policy has long angered privacy advocates and the computer industry, which is eager to sell its encryption wares overseas.
"Coordinating this around a public challenge reminds people that [fast DES cracks] are possible," said Burt Kaliski, chief scientist at RSA Labs. "This is going to become a more routine sort of occurrence. Letting it be done in public view calls attention to that."
The winners of RSA's last challenge cracked DES in just 56 hours. So now RSA is calling on contestants to crack open an encoded message in 24 to 48 hours, and there's money in it for whoever does.
"The target we're looking for is to get down to one day," Kaliski said. "We've set the threshold so that basically anything less than two days wins US$5,000, and one day [or less] wins $10,000."
