# Cracking PGP **URL:** \ **Category:** Factual Questions\ **Created:** [June 14, 2001, 3:10am UTC](https://boards.straightdope.com/t/cracking-pgp/68750 "2001-06-14T03:10:23Z")\ **Posts on this page:** 7\ **Page:** 2
**Author:** ![Joe\_Cool](https://avatars.discourse-cdn.com/v4/letter/j/ecb155/32.png) [@Joe\_Cool](https://boards.straightdope.com/u/Joe_Cool)\ **Post date:** [June 14, 2001, 10:46pm UTC](https://boards.straightdope.com/t/cracking-pgp/68750/21 "2001-06-14T22:46:23Z")
> [@](#): > > \*Originally posted by Chronos \* > **The NSA may well be the single largest employer of mathematicians, but academia as a whole has many more.** True enough, but the NSA recruits the best and brightest. Some are even cultivated as early as high school. > [@](#): > > **Even if an NSA-employed mathematician did make this discovery, though, I doubt it could stay secret for long. An algorithm for easily factoring prime numbers would be the biggest advancement in number theory since Euler, and even the U. S. Gummint would have a hard time getting its discoverer to sit on it.** Classified is classified. A discovery that big would surely be protected by enough threat of prison that they would sit on it as long as necessary. GCHQ employees at Bletchley Park (including Alan Turing) built the first programmable computer, called Colossus, during WWII for the purpose of attacking Enigma. This was significantly prior to the building of ENIAC (1946), but the latter is still widely recognized as the first programmable computer. Another mathematician ([James Ellis](http://www.wired.com/wired/archive/7.04/crypto_pr.html)), also employed by GCHQ, invented public-key cryptography almost ten years before Whitfield Diffie and Martin Hellman came up with it in the private sector. This was, at the time, also the biggest thing since Euler, and it was kept secret until several years following the public unveiling of Diffie-Hellman PKE (this is detailed in The Code Book. A very good read, as **sailor** has already pointed out). The magic words here are “National Security” and I’m almost certain the people employed at NSA will sit on anything they’re told to. > [@](#): > > **Of course, they do have other ways to bypass the encryption, without actually cracking it. One of the more imaginative methods proposed is to attempt to crack the random number generator used to create the keys, rather than the keys themselves. Unless you’re using thermal noise or a lava lamp or some such to produce your random numbers, the NSA can probably use such methods to read your mail.** True as well. It’s much easier to crack a person than to crack good encryption. It’s almost always easier to circumvent the crypto, rather than tackle it head-on. People can be tortured, bribed, or careless, until they give up either the data, the key, their mother’s maiden name, etc. Cameras can be planted to watch your keyboard and monitor. Your hard drive can be swiped, mirrored, and replaced and you’ll never know the difference. Your computer can be monitored with TEMPEST without even entering. Wetware is always the weak link in the security chain. ---
**Author:** ![Joe\_Cool](https://avatars.discourse-cdn.com/v4/letter/j/ecb155/32.png) [@Joe\_Cool](https://boards.straightdope.com/u/Joe_Cool)\ **Post date:** [June 14, 2001, 10:49pm UTC](https://boards.straightdope.com/t/cracking-pgp/68750/22 "2001-06-14T22:49:57Z")
> [@](#): > > \*Originally posted by Joe\_Cool \* > **GCHQ employees at Bletchley Park (including Alan Turing) built the first programmable computer, called Colossus, during WWII for the purpose of attacking Enigma. This was significantly prior to the building of ENIAC (1946), but the latter is still widely recognized as the first programmable computer.** I meant, of course, to say that they were never allowed to reveal their invention, for security reasons. All plans, parts, and working models were destroyed, and it was not even announced until many years later. Working in Intelligence means not gaining public recognition for your discoveries until long after your death, in many cases. They know this going in. But on the other hand, they have the recognition of their coworkers, which can be even better, if you know you’re surrounded by the best of the best. ---
**Author:** ![kgriffey79](https://avatars.discourse-cdn.com/v4/letter/k/2bfe46/32.png) [@kgriffey79](https://boards.straightdope.com/u/kgriffey79)\ **Post date:** [June 14, 2001, 11:39pm UTC](https://boards.straightdope.com/t/cracking-pgp/68750/23 "2001-06-14T23:39:11Z")
I was just wondering, what do they mean by 1024 bit encryption??? ---
**Author:** ![gazpacho](https://avatars.discourse-cdn.com/v4/letter/g/6f9a4e/32.png) [@gazpacho](https://boards.straightdope.com/u/gazpacho)\ **Post date:** [June 14, 2001, 11:53pm UTC](https://boards.straightdope.com/t/cracking-pgp/68750/24 "2001-06-14T23:53:44Z")
kgriffey79 says: I was just wondering, what do they mean by 1024 bit encryption??? The key which is basically the password is a number so big and accurate they need 1024 bits to represent it. Chronos says: Of course, they do have other ways to bypass the encryption, without actually cracking it. One of the more imaginative methods proposed is to attempt to crack the random number generator used to create the keys, rather than the keys themselves. Unless you’re using thermal noise or a lava lamp or some such to produce your random numbers, the NSA can probably use such methods to read your mail. The PGP implementations I have used do try to use some random processes like time between keystrokes and mouse movements to get better random numbers. This sort of attack has been known for quite some time and PGP does a pretty good job of defeating this. Early versions of netscape for unix and maybe PCs generated random numbers for Secure Socket Link web stuff using Process ID number and time of day to seed the random number generator. Both of these are not very secrete numbers especially time of day so the number of key to search gets cut down to a very manageable number. I believe that this problem has been address in even not so recent versions of netscape. ---
**Author:** ![sailor](https://avatars.discourse-cdn.com/v4/letter/s/a587f6/32.png) [@sailor](https://boards.straightdope.com/u/sailor)\ **Post date:** [June 15, 2001, 1:05am UTC](https://boards.straightdope.com/t/cracking-pgp/68750/25 "2001-06-15T01:05:19Z")
i just thought I’d bring up a thread we had about a year ago: [http://boards.straightdope.com/sdmb/showthread.php?threadid=30433](http://boards.straightdope.com/sdmb/showthread.php?threadid=30433) ---
**Author:** ![sailor](https://avatars.discourse-cdn.com/v4/letter/s/a587f6/32.png) [@sailor](https://boards.straightdope.com/u/sailor)\ **Post date:** [June 16, 2001, 1:58am UTC](https://boards.straightdope.com/t/cracking-pgp/68750/26 "2001-06-16T01:58:36Z")
A [statement by Phil Zimmerman](http://web.mit.edu/network/prz_statement.html) regarding the back door. ---
**Author:** ![Joe\_Cool](https://avatars.discourse-cdn.com/v4/letter/j/ecb155/32.png) [@Joe\_Cool](https://boards.straightdope.com/u/Joe_Cool)\ **Post date:** [June 16, 2001, 6:37pm UTC](https://boards.straightdope.com/t/cracking-pgp/68750/27 "2001-06-16T18:37:38Z")
> [@](#): > > \*Originally posted by kgriffey79 \* > \*\*I was just wondering, what do they mean by 1024 bit encryption??? \*\* It depends on what kind of encryption you mean. Normally when you hear “1024” (or more) bit encryption, you’re talking about public key cryptography, like RSA or Diffie-Hellman. Basically it means you are using a 1024-bit modulus in the calculations. The modulus is P\*Q in the quote below, from [this site](http://world.std.com/~franl/crypto/rsa-guts.html) (which is a VERY useful one on the subject): > [@](#): > > Here’s the relatively easy to understand math behind RSA public key encryption. > > Find P and Q, two large (e.g., 1024-bit) prime numbers. > > Choose E such that E is less than PQ, and such that E and (P-1)(Q-1) are relatively prime, which means they have no prime factors in common. E does not have to be prime, but it must be odd. (P-1)(Q-1) can’t be prime because it’s an even number. > > Compute D such that (DE - 1) is evenly divisible by (P-1)(Q-1). Mathematicians write this as DE = 1 (mod (P-1)(Q-1)), and they call D the multiplicative inverse of E. This is easy to do – simply find an integer X which causes D = (X(P-1)(Q-1) + 1)/E to be an integer, then use that value of D. > > The encryption function is encrypt(T) = (T^E) mod PQ, where T is the plaintext (a positive integer) and ^ indicates exponentiation. > > The decryption function is decrypt© = (C^D) mod PQ, where C is the ciphertext (a positive integer) and ^ indicates exponentiation. > Your public key is the pair (PQ, E). Your private key is the number D (reveal it to no one). The product PQ is the modulus (often called N in the literature). E is the public exponent. D is the secret exponent. > > You can publish your public key freely, because there are no known easy methods of calculating D, P, or Q given only (PQ, E) (your public key). If P and Q are each 1024 bits long, the sun will burn out before the most powerful computers presently in existence can factor your modulus into P and Q. [Previous page](https://boards.straightdope.com/t/cracking-pgp/68750.md?page=1)