Password Cracking

Distributed.net has its roots in the original RSA Labs’ RC5-56 challenge that was launched on 28 January 1997. The challenge was to be the first to crack an encrypted plain text message. RSA has posted a series of such challenges each with increasing encryption key length. For the RC5-56 challenge, a coordinated effort was launched by Earle Ady of New Media Laboratories (genx.net), but this failed because of massive attacks on its servers. This was when a small group decided to take matters into its own hands and launched distributed.net. Through its effort and of other people who joined in, it was able to crack RC5-56 on 19 October 1997, taking 212 days and processing keys at a staggering rate of 5.3 Gigakeys/sec. This is also when RC5-64 started. Since then, distributed.net has also cracked a 56-bit CS Cipher and the DES-III challenge.

Before that, a similar 48 bit challenge was cracked by Germano Caronni, a doctoral student from Switzerland, who harnessed idle time in up to 3250 computers over the Internet. This puzzle was solved in 312 hours.

Distributed.net has three basic goals: the long-term goal of cracking a message encrypted using RC5-64, cracking the DES contests twice a year and finding an Optimal Golomb Ruler. While RC5 and DES are encryption schemes that are cracked by trying each and every possible key, the OGR problem is slightly more complex. The term Golomb Ruler refers to a set of positive integers such that no two distinct pair of numbers from the set has the same difference. Conceptually, this is similar to a ruler constructed in such a way that no two pairs of marks measure the same distance. OGRs have many applications, including sensor placements for X-ray crystallography and radio astronomy. 

All three tasks are performed through client software that must be downloaded from their site. What this software does is that it routinely contacts the central server for work units, processes them and then sends back the result of that processing. It is preferable that you have an ‘always on’ Internet connection, but even a dial-up can serve the purpose. The distributed.net client can be run either as a service or a screensaver. As a service, the software will run as long as the computer is powered on and will use up CPU cycles even when you are working on the computer. As a screensaver, it will be activated only when the computer is idling. 

As of now, over 75% of the RC5-64 keyspace has been checked and keys are being processed at about 200 Gigakeys/sec. This computational power is roughly the same as 160,000 PII 266 MHz computers working 24x7. At this rate, it’ll take approximately 266 days to complete the keyspace, but the correct key could obviously be found before that. A variety of platforms are supported including AIX, BSD, MS-DOS, MacOS, NetWare, QNX and Windows. You can register yourself either as an individual or form/join a team. The top performing individuals and teams are published everyday at their website. The reward for finding the key?

$1000 to the person who finds it, same amount to the team he belongs to, $6000 to a non-profit organization decided by vote and $2000 to distributed.net for building the network and supplying the code.

Anuj Jain