1,000,000 Bit Encryption?

Full Article [ here ]

Quote:

---

Meganet, an Israeli-U.S. data security company, has developed an encryption technology that appears to be unbreakable, enabling governments and corporations, to keep their data safely out of the hands of competitors, thieves and saboteurs.

Among the clients that believe in their ability to protect sensitive information is the U.S. government


Data security is one of the key concerns for governments and corporate users today as hacking becomes increasingly prevalent. In 2000, an FBI survey showed that 90 percent of participating companies had their computer systems vandalized by rivals, hackers, or even disgruntled employees. In January 2000, hackers stole 250,000 credit card numbers from an online CD store. They tried to blackmail the store. When it refused to pay, the hackers published 10,000 card numbers on the Internet.

Meganet Corporation's founder, Saul Backal, claims that its solution can put an end to these problems. Meganet offers a patented non-linear data mapping technology, called VME (Virtual Matrix Encryption), that creates exceptionally random cipher text and combines it with a one million-bit key, which is unheard of in today's data security markets. Competing solutions offer a maximum of 256 bits.

---

I don't know all that much about encyption, but is a 1 million bit key even feasable to use because of its size? We all know how long encryptions and systems that are claimed to be unbreakable last, but I wonder, would it even be possible to break this one due to its size?

Even a 256 bit encryption requires a hell of a lot of a lot of (usually distributed) processing power to break in any decent amount of time. Even then, it's usually months or even years before it's broken. So for a 1 million bit encryption to be broken, you'd probably need a million computers working for a thousand years or something. However, how much overhead do you think the method is going to put on the system that stores the data. I mean the key itself will be huge. I'm not too coherrent now, too sleepy. Hope I haven't said anything dumb.....
Cheers,
cgkanchi
(snore)

a secure 512-bit key requires 2^512 computations which is greater than the number of atoms in the universe (10^80 give or take a few orders of magnitude). 2^million is for all practical purposes = infinity. current secure keylengths for AES, the new government standard are 128, 192 and 256. this claim by Meganet is basically preposterous and peppered with phony tech-talk. i wouldn't put too much stock in it. check out this link for a discussion on the subject in 1998:

http://www.privacy.nb.ca/cryptograph...8-03/0004.html

here's a link to an informative article on keylengths:

http://www.counterpane.com/keylength.html

also, if you really want to learn some cryptography, read Applied Cryptography by Schneier. some people refer to it as the red book.

http://www.counterpane.com/applied.html

Sure it's feasible. So now your grocery list will be that much more secure from prying eyes.

I think this uses the same principal I mentioned in my tut, Matrix encryptin...basicaly it's like having 256 256-keys....then you swap betwenn them, giving you 3D encryption in a sense.
It's possible for the simple reason that it isn't one file...it's many, how ever...cracking it is impossible, because you have to crack it based on the belief that it is one HUGE file.

- Noia

sorry noia if this is a stupid question but how impossible is impossible?

because as i understand nothing is impossible.

If the encryption technology supposedly isn't breakable, there is probably something else that is... The OS would have to be configured to not save unencrypted data to the HDD, in ways such as disabling hibernation support, etc. If you decrypt a Word file encrypted with this program, and open it with MS Word, your file is as good as done (temp files, backup saves, etc). Since they appear have a suit of programs, they have probably taken some precautions in their programs to prevent things such as that.

When your company isn't noticed, and you know you have some good stuff, you are going to work on it to the best of your abilities, aren't you? And since they had only 9 employies, they probably had a good understanding of their code. But, as mentioned earlier, some things are not under their direct control.

It is up to the Administrators to ensure that the software is implemented correctly. There is a whole lot of stuff to think about here when deciding if you are able to somehow find out what files are on these computers. I'm sure you could find out, even if the encryption was uncrackable...but...do you plan on breaking into the CIA offices and going to the computers in the office down the hall to get the HDD to start searching for these files yourself? Because if you try to do it via the Internet, I'm sure that the person would wonder why their HDD is whirling and the computer is lagging heavily when they get to work in the morning while you are remotely controling their computer from the comfort of your own home...


So, I'm fairly confident that they have developed this encryption and that it works, but I don't think that you'd have to search through 2^1024 different combinations to find a key. To be non-linear, that would mean (in my opinion) that the file is not sequential, IE it is in some order defined by the key. It is possible that the file size changes, but that would be very complex, as you would have a property of the file that existed before (and you might have used it), that changed in the end - File Size. So, if that was used, it would have to be stored somewhere, and the key would tell you where to find it. I'm just theorizing here (with my somewhat limited crypto knowledge), so I am probably wrong, but I may have hit a good point - what exactly is used in this encryption process. They key alone (probably), or some property of the file? If it is the key alone, then it *could* be possible that using the same key over again would compromise the encrypted data, since the key would have to define the order of the file... So, the huge key size would be there to allow enough keys for anyone to use a nearly infinite number of times, each with different keys... And one more thing, is this private or public key encryption?

-Tim_axe

Granted.....Nothing is Impossible, wot I meant was...by the time you'v cracked it....the data would be useless, you'd be dead and the technology to read it would be long gone :)

Maby Impossible is too strong a word...but it's damn near it...

- Noia

Wow that's a big number lol.

I'm not very big in the encryption world, not 100% sure how the entire thing works but I have a very primitive idea. There was a challenge put forth by a math teacher at my last school that told us if we could give him a print out of 1,000,000 Xs then he'd give us an A in the class. Needless to say people tried it. I went home and tried to write a program to do it. The program worked but what I quickly realized that with the computer equipment that I have/had it was not feesible. He liked my method so he bought me a free pizza. :)

How does this relate to encryption? Well as it was said before, you'd be long dead before you could crack that code (that is at this stage in the game).

Ahh class is starting!

I don't think those 1Mbit keys are realy practical..
It's like packing your laptop in a cement block..
or
Using a 16 wheel truck to transport a mouse..

And I'm with Tim_axe on this one..
The security is only as strong as the weakest link.. yeah that'd be you ;)

/me stay's with the 1024kbits ;}

I'm not to 100% certain how it works but would love 2 play with. Wonder how before it becomes so-called
in secure as stated by jinx UR your biggest security leak
which I personally found out to be truth
social -eng ( my wife fell vicitm of it).

Can't wait 2 see how this works out

How powerful do the computers using this algorithm have to be? To be useful the algorithm must run on a commonly used computer.

WELL, MY CONCLUSION (IN SECURENESS) WAS WRONG... :(
Because it was in the news, I was lead to believe that it was correct... *sigh* Well, I might as well not wipe away my work - instead, I'll use it to learn from my mistakes...

My Notes: Reading through all of that made me think of a Dictionary File. My first impression after reading that was that it was some sort of backwards-working WinZip program - that is it makes stuff bigger rather than smaller, and using a dictionary. It was confusing, but I was tricked to believe that it was correct, so I worded my conclusion in a way to support that opinion. I tried to analyze and put together what was said, and as I said earlier, it reminded me of a backwards working dictionary-based compression program. It seemed to be a HUGE waste of space to put a file into *virtural matrixes*.

Since at least some fraction of my observations were impartial, I've decided to keep the original text below. Hopefully, we can learn what to look for based on this... :D


*Original Text Below*




- Be prepared for a BIG read -


OK, I've started reading more into this, and I can answer a few questions, and bring up even more...

First off, to mayhem991 - Their site claims it is faster than RSA (aka - not very computationally intensive):

Quote:

---

From:http://www.meganet.com/Technology/explain.htm

And yet VME is faster than RSA.

---

Now, the keys that are used:

Quote:

---

From:http://www.meganet.com/products/VMEo...office2002.htm

One-million bit key - four 2048 bit keys, four 512 bit keys and a unique 248 bit transaction key.

---

Now, what composes the key? The Date/Time MAY be a factor, judging from:

Quote:

---

From:http://www.meganet.com/products/VMEo...office2002.htm

Date limit
Set a date range and even with the correct keys decryption will be impossible when it expires.

---

Now, that is quite a bit right there. But, there is a whole lot more. This part has me thinking...


They say that the actural encrypted data is NOT sent. Therefore even if you intercept it, it is *useless*. Why? Because the data you got is acturally a list of pointers to values in a Virtural Matrix. The values change after each pass (Continually changing), so the number of combinations will increase (in my opinion). So, my interpertation is that the initial state of this Virtural Matrix (Key?) is transfered, along with a Session Key. Another thing that comes into use is the program's Serial Number. OMG! SERIAL NUMBER???!!!. Well, here this out... You can use it to select a range of audiences [Global, Group, Specific, Private]. You are able to select certain portions of a serial number, and people with that portion can decrypt it. With no serial number, anyone with a valid copy of the program can decrypt the file (With the key, right? - Of course!).

After reading it, other things that affect the encryption process - file name, and save-as name. This is only my interpertation, but take this for example... You encrypt a file (please don't take this seriously, I'm just giving it a reason to use the names options) "P0rN.zip", and you give it to a friend (who has the software). He has the key and everything, and is ready to decrypt. BUT, you've set it so he can only decrypt it correctly if he saves it as "Boring School Play Recital Photos.zip". I'm not too sure if the names of the files has a big impact, but if they do, then it could add an Obscurity layer of extra *security*. But still, most everything else looks pretty hardened, but as mentioned, nothing can be 100% safe.


Well, I'll just put the links below. This would become a serious mess of quotes otherwise. BTW, I have a comment here - they must be very confident in their algorithm, as they post a link to their patent on their site, and *explain* it for you...

Links:
Patent Info - http://164.195.100.11/netacgi/nph-Pa...+encryption%22
Quoted (1) - Explaining VM Encryption - http://www.meganet.com/Technology/explain.htm
Quoted (2/3) - Data Security, Products Section - http://www.meganet.com/products/VMEo...office2002.htm


And my ending comments...

This program's weakest link is ultimately you. It offers too many combinations to effectively brute-force, though it sounds straight-forward enough. But, one curiousity is about how it is decrypted - if you get an obviously invalid result, they key is wrong, but you still have many, many, many, many more keys to search through... Using certain data within the key worries me, though. Especially the serial-number part. But, I understand what they were trying to do with the serial numbers. Seeing that they are either used/to be used by the government, there could be a "all us government-wide" serial number prefix. To send to certain people within it, you'd progressively select more of the serial number until you have one specific person's number selected. Seeing that, though, possibly destroys the point of having it in the first place, especially if it is publicly avaliable. Any person could find out Bob's serial number, and if they have the other parts, they could possibly change their serial number to Bob's, and decrypt his stuff... I don't know for sure if this is public key or private key encryption, but it seems to be private key in my perspective, with some possibly public pieces of information - but private key none-the-less. Well, this is becoming a rant or something, so I'll end it here. And BTW, it doesn't seem to be all that expensive ($100 or so) either... Perhaps it is possible to try it out without overly killing your budget...


-Tim_axe

Hmmm, the one thing that has not been mentioned from this company is data integrity protection such as MD5 for instance. Assuming that everything is true and they have this unimaginable encryption scheme. Who cares if my main goal is to cause havock. I can simply modify the file destroying the contents and thus making the info useless to anyone who can unencrypt it. I'm just operating on the weakest link methodology ;)

Anyone agree or disagree?

1Mil bit encryption would be great, but anyone who's had to generate a pgp key for the max (4096 bit, IIRC) keysize knows it takes a little time on all but the fastest consumer pcs. Also remember that unless you have a NSA certified random number generator, or the lavalamp (love it) random number generator, or any other more-than-pseudo-random generator the randomness isn't really 'random' enough to be useful and can be cracked, especially when the patterns start appearing in such a giant key. I think Netscape's early SSL was cracked because their random number generation scheme wasn't strong enough.

this is all i have to say guys--and it hope this ends this thread so we can talk about more interesting topics in cryptography. when Bruce Schneier--that is, THE Bruce Schneier--calls Meganet and VME a bunch of garbage, it is. first, if you don't know who Bruce Schneier is, he wrote Applied Cryptography, is the founder of Counterpane Security, is the author of Serpent among other well-known ciphers, and is one of the most published and well respected experts on cryptography in the world. allow me to quote from

http://www.counterpane.com/crypto-gram-0302.html#4

Quote:

---

Everything Meganet writes clearly indicates that they haven't the faintest idea about how modern cryptography works. It's as if you went to a doctor who talked about bloodletting and humors and magical healing properties of pyramids.

---

i suggest you read the entire article, and then the included links. it will be enlightening for you. perhaps then this thread can be moved to a discussion on pseudo-science.

weird stuff.. if they wrote it, im sure it can be broken eventually, it would just take a hell of a lot of time.

and erm.. drew.. what are AntPoints? is there some sort of ant forums around... or do you get points just for being an ant or what.

my apologies. Bruce Schneier was actually part of the Twofish cipher team, which was one of the top 5 candidates for AES along with Serpent, which was actually written by Eli Biham.

for those of you not in the know, the winner of the AES competition was Rijndael.

i don't think anyhting is impossibele because they said it wasn't possible to hack into the fbi but they did it it just took a long time so it can be broken

The solution to this problem has been turning over in my head for some time. The two trade offs...
A more secure encryption, which will require a longer key, or an easier to remember, and guess, key which means less security.

I got it figured out---I think.

You CAN have a short key, and one that's just as secure as a longer key. How, you ask?

Simple. More characters. Right now, we use the simple ASCII character based system, with 52 letters, 10 numbers, and various symbols, adding up to about two hundred total characters.

However, we could easily add new characters, and have the entire password entired through the monitor.

Add in all Greek letters, basic shapes, and other things...many more characters. We'll have a more complex system, which will be easy to do and remember. A-52-Omega-Square...etc. Pretty simple, no?

Another benefit to this is that if its on the screen, keyloggers wouldn't work as password grabbers anymore.

"But Daniel," you say. "Won't that leave a LOT of characters to scroll through before finding the one you need?" Not really. It wouldn't be any real problem to organize them by categories, and sub-categories. Fairly simple, I think.

What do you all think?

i think you're kind of missing the whole point of keys in cryptography. all information is binary, including keys and ciphertext. adding more characters to an alphabet doesn't do squat--it just makes it harder to read once it's decoded. if you want to encode a language L by transposing it onto another language M, it will make it more difficult for humans to read but the language itself has nothing to do with the secure transmission of that data.

so in short, i think you should read a cryptography book and then come back and see if you what you thought you knew still makes sense.

Point, you are probably correct. As I said, it was just an idea that occured to me and was probably really stupid. Sorry for wastings people's time.