是时候破解 DES 了吗？ 这是一个适合脚本小子的任务吗？
已经了解 AES 是首选的加密方法，如果可能的威胁达到脚本小子的级别，是否应该重写使用 DES 的现有代码？ （例如，非计算机专业人士可以使用免费实用程序破解 pkzip 密码，那么 DES 也是这样吗？）快速的 google 搜索似乎意味着，即使已弃用的 DES 仍然需要一台超级计算机和大量时间——或者时代已经改变？
特别是，这个 CAPTCHA 库 使用 DES 来加密在视图状态下发送给用户的质询字符串。
Already understanding that AES is the encryption method of choice, should existing code that uses DES be re-written if the likely threat is on the level of script kiddies? (e.g. pkzip passwords can be cracked with free utilities by non-computer professionals, so is DES like that?) A quick google search seems to imply that even deprecated DES still requires a super computer and large quantity of time--or have times changed?
In particular, this CAPTCHA library uses DES to encrypt the challenge string which is sent to the user in viewstate.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
就存储敏感数据而言，DES 已经被破坏了，所以我肯定不会在任何新的东西中使用它，并且会在用于长期存储任何感兴趣的信息（某人会为了国家安全利益而获利的数据）的任何东西中替换它。在偷窃中）。
目前，使用价值不到 100,000 美元的定制硬件，可以在几天（或更短时间内）通过暴力破解 DES 消息。
但其中有一些关键因素：
硬件是定制的 - 用于快速破解 DES 密钥的芯片不是您在 PC 中找到的通用处理器。 话虽这么说，今天可能有空间使用 Playstation 3 集群或带有 GPGPU 的当前一代显卡在合理的时间内破解 DES 消息，或许可以将成本降低到 15,000 美元左右。
另一个因素是时间 - DES 消息可以在一天内破解，但是如果您的 CAPTCHA 库有一个时间戳，为任何给定的 CAPTCHA 响应指定 30 分钟的超时，它仍然有效（您可以扩展您的硬件，但是那么你说的是数百万）。
总的来说，我想说，对于非长期存储，DES 仍然可以安全地抵御“脚本小子”。
DES is broken so far as storing sensitive data, and so I would certainly not use it in anything new, and would replace it in anything used for long term storage of any information of interest (data that someone would have a profit for national security interest in stealing).
At the moment a DES message can be broken by brute force in a couple of days (or less) using under $100,000 worth of custom hardware.
But there are some key factors in that:
The hardware is custom - the chips used to quickly brute a DES key are not the general purpose processor you'd find in a PC. That being said there is probably room today for using a cluster of Playstation 3s or current generation graphics cards with a GPGPU to crack a DES message in a reasonable amount of time, perhaps bringing down the cost to maybe $15,000.
The other factor is time - a DES message can be cracked in a day, but if your CAPTCHA library has a timestamp that specifies a 30 minute timeout for any given CAPTCHA response, it would still be effective (you could scale up your hardware, but then you're talking millions).
Overall I'd say that for non-long term storage, DES is still secure against "script kiddies".
不，DES 破解不适合脚本小子，而且在不久的将来可能也不会出现。
它需要如此巨大的处理能力，我们谈论的是 FPGA 处理器的负载。
例如 COPACOBANA 中的 CHES 2006 密钥挑战 使用 128 个处理器中的 108 个处理器耗时 21 小时 26 分 29 秒，每秒吞吐量为 431.852 亿个密钥，并且 在搜索 4.73507% 的密钥空间后找到了密钥
现在，如果我们查看 摩尔定律 我们看到，如果我们目前建造一台类似的机器，则当前需要花费 1/4 的时间来获得相同的资金，或者花费 1/4 的资金来获得相同的时间。
no, DES cracking is not suitable for scriptkiddies and won't probaly be in the near forseeable future.
it requires such enormous processing power, we're talking about a load of FPGA processors.
for example the COPACOBANA in the CHES 2006 secret key challenge took 21 hours, 26 mins, 29 secs using 108 of it's 128 processors, at a troughput of 43.1852 billion keys per second, and found the key after searching trough 4.73507% of the keyspace
now, if we look at moores law we see, that if we currently build a similar machine, it'll currently take 1/4th of the time for the same amount of money, or 1/4th of the money for the same amount of time.
DES 被加密社区的标准所破坏； 但打破它所需的时间通常足够长，因此用于此类应用程序是“安全”的。 一个假设是：DES 密钥在会话之间发生变化。 如果密钥没有改变，那么它很容易受到非常专注的个人的攻击。 现在的问题是，您的网站是否会受到那些愿意花费 10 多天时间破解 DES 的人的影响，而不是应用垃圾邮件行业中其他人通过图像识别方式获得的经验教训。
DES is broken by the standards of the crypto community; but the time required to break it is generally large enough that it would be 'safe' to use for this kind of application. On one assumption: the DES key changes from session to session. If the key doesn't change, then it is open to attack by a very very dedicated individual. Now, the question is, is your website subjected to people that will spend 10+ days cracking DES, rather then applying lessons learned by the rest of the Spam Industry in the way of Image Recognition.
对于大多数用例来说，DES 可能仍然足够好。 但关键是，通常有理由使用已知相当弱的算法（或者在本例中更确切地说：关键优势）。
维基百科指出，即使使用特殊硬件，详尽的密钥搜索也需要大约 9 天的时间。 我认为脚本小子不会花费那么多 CPU 时间（即使他们有僵尸网络）只是为了破解验证码。 （实际上，有了足够的智能图片识别能力，破解验证码通常会容易得多……）
DES is probably still good enough for most use cases. But the point is, there is normally reason to use an algorithm (or in this case rather: a key strength) which is known to be rather weak.
Wikipedia points out that even with special hardware around 9 Days are needed for an exhaustive key search. I don't think the script kiddies are likely to spend that many CPU time (even if they have a botnet) only to crack a captcha. (Actually, cracking captchas is normally A LOT easier with sufficient intelligent picture recognition...)