"Code that can't be cracked" -- Toronto Star, January 19th 2004

Well, so they claim. If you do crack it, you get a cool $1 Million CDN and a job. Full Article here

Quote:

---

Want to win a million bucks and a high-paying job for life?

That's what Mississauga-based Certicom Corp. is offering anyone who can crack the code to its products and patents surrounding Elliptic Curve Cryptology (ECC) — a combination of algebra and algorithms that ensure everything from cellphone chatter to wireless e-mail sent and received on an Internet-enabled phone or a Blackberry PDA can't be hacked.

The math is complex, the technology used to apply it confounding. But its aim is simple. It is to give access only to those entitled to it — from mom using a cellphone to stay in touch with kids to military scientists using a computer network and determined to keep their secrets."Our technology is based on a very difficult mathematical problem, so we're challenging people to solve the mathematical problem," said Scott Vanstone, a professor of math and computer science at the University of Waterloo and Certicom's founder, explaining the $1 million challenge.

"That's why we're comfortable having our technology incorporated into mission-critical systems."

---

So, think you're up to the challenge? :D

/me starts building a wolf cluster out of scrap parts....like toasters.

Has any security system or encryption ever remained secure after the parent company issues such a challenge to the world? It seems every time someone makes a statement like this, it is invariably proven wrong in a few months or years. I wonder what MIT student will pull it off?

they must be confident, I wounder if theres a claus in the contract that no goverment organisations with kick ass amounts off gigaflops can claim the money,

anyway im gonna put my uni work on the back burner and make myself a million,

infact im gonna crack it in my head,

i2c

Quote:

---

Originally posted here by Syini666
Has any security system or encryption ever remained secure after the parent company issues such a challenge to the world? It seems every time someone makes a statement like this, it is invariably proven wrong in a few months or years. I wonder what MIT student will pull it off?

---

I agree - inviting people to a challenge like this will only lead to the breaking of the code at some point - it may not be tomorrow, next week, or next year, but it will be broken... I always look at security like this - if someone wants something bad enough, they'll find a way... I think that it's foolish to say you've got an unbreakable app, uncrackable code, hack-proof system, etc.

Maybe I'm thinking of something else but didn't Oracle try this a while back? Wasn't long defenses were broken I believe....

Quote:

---

As for cracking the code, don't start spending the money yet. One team headed by a group of mathematicians at Notre Dame University did manage to crack one of the lower-end "keys" that keep ECC communications secure. It took 10,000 computers running 24 hours a day for a year and a half to do it.

---

Appears to me their claims are a bit ambiguous.
No one can crack our code they say.
But wait this group from Notre Dame University did it.
Am I confused or did they just contradict themselves?
nuff said.

"Easy" come, "Easy" go

nothing is stabil in this life, so we will w8 and se if some will do it...
or some of us(people) have alredy did it?

hehe ;)

Quote:

---

Originally posted here by Maverick811
Maybe I'm thinking of something else but didn't Oracle try this a while back? Wasn't long defenses were broken I believe....

---

Your right Oracle did try and make this claim:

Quote:

---

Larry Ellison, CEO of Oracle, recently revealed a phenomenal aspect of the Oracle architecture that is unique in the world: It is unbreakable! During his keynote address at Comdex, Ellison told the audience that they could "keep their Microsoft Outlook, and we will make it unbreakable; and unbreakable means you can't break it, and you can't break in."

---

You know the funny thing about this is, when I was trying to find information on Oracle's claim, I had to scroll through 26 pages of posted vulnerabilities on Oracle, now how's that for an "unbreakable" system. :p

Cheers:

Quote:

---

A much smaller 224-bit ECC key offers the same level of encryption as 2048-bit key in the competing RSA format

---

That is something special if that is true.

And F*** a bunch of big clusters, I'm going to go find me a couple of savants.

(edit)

oh by the way

http://www.certicom.com/download/aid..._challenge.pdf

Complete rules, info, and they even give you their formulas. Cocky little bastards.

Just A Matter Of Time!!!!

if anyone want to crack it the easy way go to EB games and buy "Uplink: Haker Elite." The ecc is used for banks and other agencies.

Of course it will be cracked in time. The point of the challenge I think is to find a weakness in the alogorithms that would allow someone to crack it before the universe ends. People have been using RSA since 1978 and although its a little older it still holds up pretty good. Somehow I dont think anyone here is going to be cracking it anytime soon. And just because one key has been discovered (apparently through bruteforce, not an algorithim weakness) doesnt mean the encryption has been cracked, it all depends whether there is a weakness in the system that allows for other key discoveries etc.

-Maestr0

Attempt#: 2,342,109......Failed
Attempt#: 2,342,110......Failed
Attempt#: 2,342,111......Failed
Attempt#: 2,342,112......Failed
Attempt#: 2,342,113......Failed
Attempt#: 2,342,114......Failed
Attempt#: 2,342,115......Failed
Attempt#: 2,342,116......Failed

Me thinks I need to add a few more PS-2's to the cluster....

Serious.. some time the most complex of formulas can be reversed with the simplest of equations..


Cheers

lol my friend has that game and he allways tries to show me his "L337 H4X0R 5K1LL5", that game is just i candy and nothing real

Come on Und3ertak3r - If those are you latest counts you still have 18,161,817,240,391 more ittelerations to go for the small 79bit challenge..., which has already been broken and the $5,000 or so already claimed... Aparrently this challenge has been going on since 1997 according to Lansing_Banda's post...

I don't understand any of the calculus behind this stuff, seeing that I'm taking that next year in HS, but apparently the reason it is so hard to compute is that the amount of time to compute with all of their formulas is exponental. If that is truely the case, I wonder if the exponentialness of brute forcing it is less than their algorithms? And if it is, then they are more suceptable to brute-force attacks than RSA...Right? (Much smaller key size = Much less combinations to brute force through) Or am I missing something here that is special with these curves...? Again, I don't understand most anything in that paper except that we're lookinf for l, where Q = lP, though I don't see why Q and P are so special... :confused:

When I finally do understand any of the math behind this I'll be sure to look into it. I can probably safely bookmark this for a year or two before visiting it again and still have the potential $1 Million or so to dream about...



Edit:
Q = lP
Q/P = l

I broke it, as long as Q and P are provided... :)
j/k - I don't know what they give you, and surely you don't offer a million $ for something as trivial as that...

Two words. Quantum Computing.

I keep getting site not found...oh well. Must be a bunch of wannna be millionaires. :)

I'd be more interested in seeing the applications they are using the algorithm with (or for which they are using the algorithm) It doesn't do a lot of good to have an uncrackable code if you can bypass the routine that checks for it in the first place.

Well, I think this is an interesting challenge. I think I'll crack it tonight just for fun ;)

Shouldn't take more than a few minutes, I do run Linux after all...

Seriously though, if it's as tough as they say, it's going to be a great thing for people in the US. Since it's a Canadian company, the encryption technology won't be subject to the foolish export laws of the United States.

Don't confuse them being overconfident with brilliant. By making their statement they could very well know it is not unbreakable, but know they will get a much larger fanbase of people testing and trying, eventually pulling out the brightest of the bunch because of their very "I bet you can't do it" move. A very good psychological tactic.

A brilliant move, if you recognize their tactics for tactics and not ignorance.

The only people who could stand a chance at breaking it would be people who had access to thousands of computers to attack the code. Brute forcing is pretty much the only way to acturally "break" this, but that isn't what they are paying $1 Million for. If someone comes up with some simple formula as Und3ertak3r alluded to, they will definately get $1 Million and probably result in the fall of the company (hence not working for it, or being paid to keep hush-hush). But over the last 7 years of the competition, tons of smart people went through it and couldn't find that. Although some smart people did find somewhat faster ways, they aren't quite fast enough. Same goes for RSA. Just as nobody found a faster way to factor huge numbers, nobody has found a faster way to compute this ECC stuff. Since nobody has found any way faster, brute force with the methods in the PDF Lansing_Banda linked to are currently the fastest known. I think the $1 Mill is only if you come up with a faster way, and then crack it with all of the computer HP you can before someone else wins the $20,000 by simply brute forcing with known methods.

Yes, it is brilliant. Getting people to do all of your dirtywork of cracking/testing it. But I think that they are also a bit overconfident, and their overconfidence lies in their thinking that their ECC is better than RSA. It very well could be, and they justified it by saying that it is much easier for smaller devices like cellphones, etc., but that entire story sounds like a sales ad. Since I don't understand the calculus behind this eliptical curve stuff, or what they are trying to find about it (and what is given) I don't really see what they are trying to say is so hard. Obviously, if I knew more of the math behind it I would see the point of the algorithm their ECC crypto is based on, and realize what they are stressing with this competition. But I do not, so until I learn anything related to this topic (and calculus) next year I will have to keep out of this competition.

But even if I did understand it, I doubt I'd find the fast formula, or round up the thousand so computers for it. We probably couldn't get a Team AO Crypto Think-Tank of CPUs going; F@H and Seti@Home has shown that. So I'll just go for that Mars lander thing @ http://www.antionline.com/showthread...hreadid=253661

FYI - I've managed to match some characters with patterns. But I havnen't converted it into numbers yet to get the real work done...

If anyone stands a chance of cracking this particular code without brute force (which, let's face it, is an option open to people with money rather than the mathematicians who really understand what's going on) I'd bet on it being Andrew Wiles if he wanted to try. If I recall correctly, his PhD involved eliptical curves, and he went on to apply these in his proof to Fermat's Last Theorem - a puzzle that baffled mathematicians for years.

I don't know, have you seen some of the stuff that the guy Rainman was based off of can do? He computed the day of the week of a date like January 1 123132423 in a matter of seconds.

Other stuff:
http://users.lk.net/~stepanov/mnemo/kimpeeke.html

And Undertaker, I got some alarm clocks you can add to your cluster.

Interesting. I'm going to get this PDF to see the formulas. But I think that formulas are just drawback. If you want to use encription in cellphones and other "small" stuff, it has to be fast, and not CPU demanding. That is where is the key. If anyone want to brake this stuff, take the app which is using it... and remeber, everything has a hole, the only difference is size of it.

Quote:

---

Originally posted here by Lansing_Banda
I don't know, have you seen some of the stuff that the guy Rainman was based off of can do? He computed the day of the week of a date like January 1 123132423 in a matter of seconds.

---

Perhaps, but being able to find the modulus of two numbers extremely quickly (which is essentially what he is doing - seeing as he would know what day January 1st was this year and then just do 123... mod 7) does not make him an expert in eliptical equations.

I think there's an easy way to do it anyway because someone I know had to write a Pascal program to figure out what day you were born on.

Personally, I think they are using the old reverse pscychology to guaruntee that their project continues to stay safe. Anyone cracks it, then they know where the weak points are. That is why even though companys hate places like packetstorm, they wouldn't survive without them.

Much apologies to pooh sun tzu and Tim_axe for the double post. I missed a page.

all code can and will be eventually cracked.....

you want security.... unplug your computer

That still wouldn't give you security. The following techniqe is to pick up the phone and so some social enginering into having the person on the other end of the phone to simply plug the computer back in. Because in order for one extreme to exist an equal but opposite one must be present - there is no love without hate, and there is no security without hackers.

Quote:

---

you want security.... unplug your computer

---

LOL :D

agreed

Bah! I bet the guy from swordfish can break it... while recieving fellatio...

yes, or some Korean Techie. Jeez, those guys are smart. And if your Korean and your on here, you totally rock! :D

Quote:

---

Originally posted here by Syini666
Has any security system or encryption ever remained secure after the parent company issues such a challenge to the world? It seems every time someone makes a statement like this, it is invariably proven wrong in a few months or years. I wonder what MIT student will pull it off?

---

To all other posters who didn't seem to understand the previous posting on the same subject in this thread:

- It's not about *whether* you can crack it, but crack it sufficiently quickly for anyone to care. If cracking some key takes 6 months on a government supercomputer, they won't be able to justify its use to crack any key (unless it belongs to Mr. Bin Laden himself and was used to encrypt something which definitely contains a list of 10,000 Al Qaeda members)
- The time scales even with government supercomputers for cracking these things by brute force make it pointless.

---

On another note, if a government (Say the UK government for the sake of argument) *DID* discover a fundamental weakness in the algorithm that allowed the key to be quickly broken, it would *DEFINITELY NOT* tell anyone about it, much less attempt to claim the prize.

Those boys in GCHQ would keep it to themselves and quietly intercept everyone else's military traffic - whilst ensuring that their own could not be broken by the same method (That's if they're not too busy eavesdropping on the Secretary General of the UN http://news.bbc.co.uk/1/hi/uk_politics/3488548.stm )

Slarty

People don't need to crack code like this and never have done. But in a comp seems like summin gd to look at and not to get in duke for it.

Days, months, years, it's only a matter of time. The ONLY unbreakable code is the one that hasn't been written yet.

Every code is mathematically possible. The only unbreakable code is one that brute force can't decipher. Which we go back to our first theory.

On a side note, if this code cannot be desciphered by Brute Force. Cryptography will no longer exist...

Book review:

- Digital Fortress - 14.95 (book cover)
* "The NSA is being held hostage-not by guns or bombs, but by a code so complex that if released would cripple U.S. intelligence."

*You can't put it down!*

Digital Fortress is a good book (written by Dan Brown, author of the Da Vinci Code

Quote:

---

Originally posted here by MsMittens
Well, so they claim. If you do crack it, you get a cool $1 Million CDN and a job. Full Article here



So, think you're up to the challenge? :D

---

You cannot generate true random numbers on a computer system. Point is, any type of algorithm you will ever devise will always be crackable.

These people might have a chance if they decided to take on this project: http://www.distributed.net