Bitcoin Institute
Bitcoin Institute
日本語

Damien Doligez, 'I broke Hal's SSL challenge'

Web Document Damien Doligez (INRIA) · Event · Added · Updated
Figures: Damien Doligez ,  Hal Finney
cypherpunkregulation
Damien Doligez August 9, 2000

This is all my personal point of view. INRIA (http://www.inria.fr/welcome-eng.html) published an official press release (no longer available on-line).

On July 14, 1995, Hal posted his SSL challenge (http://pauillac.inria.fr/~doligez/ssl/ssl-challenge.txt): a record of a “secure” Netscape session encrypted with the RC4-128-EXPORT-40 algorithm.

I succeeded in cracking the challenge, but I was only the second one (http://pauillac.inria.fr/~doligez/ssl/press-conf.html#secondplace) to find the key and read the contents of his session.

If you’re a journalist, be sure to read my virtual press conference (http://pauillac.inria.fr/~doligez/ssl/press-conf.html). If you have more questions, don’t send me email, it’s way too late now.

This is a more-or-less chronological account of what happened:

  • The SSL protocol (http://home.netscape.com/newsref/std/SSL.html) was designed to protect confidential data sent by Web browsers. It has an option for weak encryption, to comply with the requirements of the US government for exportable software.

  • July 14, 1995: Hal posted his challenge in a short version (http://pauillac.inria.fr/~doligez/ssl/ssl-challenge.txt) and a detailed version (http://www.portal.com/~hfinney/sslchallong.html).

  • August 15, 1995: I posted my original announcement (http://pauillac.inria.fr/~doligez/ssl/announce.txt). I also have a revised version (http://pauillac.inria.fr/~doligez/ssl/announce-rev.html).

  • August 16, 1995: I learned that David Byers and Eric Young, working with Adam Back, had cracked the challenge about two hours before me. Adam has a description (http://dcs.ex.ac.uk/~aba/ssl/) of their achievement.

  • August 17, 1995: Netscape sent their official response (http://home.netscape.com/newsref/std/key_challenge.html). I don’t agree with their $10,000 figure, and they badly underestimate the cost of breaking RC4-128 (the US-only version of their system). Still, I do agree with their conclusion.

  • The cypherpunks are putting together a “key cracking ring (http://www.brute.cl.cam.ac.uk/brute/)” to see how fast this can get: they will decrypt example sessions as fast as possible (I expect only about one day per session), by using a lot of machines all over the Internet.

  • August 19, 1995: Hal posted a second SSL challenge (http://www.brute.cl.cam.ac.uk/brute/hal2) to cypherpunks for the “key cracking ring” to tackle.

  • The key cracking ring started working on this new challenge on August 24, 1995, at 18:00 GMT, and got the result in less than 32 hours (http://www.brute.cl.cam.ac.uk/brute/hal2.html).

  • September 4, 1995: Communications Week International wrote that I “enlisted a number of other engineers worldwide to crack the code again - in just 32 hours”. This is not true. I did participate in the effort, but the credits for organizing it should go to Adam Back and Piete Brooks.

  • September 17, 1995: Ian Goldberg and David Wagner broke the pseudo-random number generator of Netscape Navigator 1.1. They get the session key in at most a few hours on a single workstation. Their code is available by ftp. You can get more details on a web page (http://hplyot.obspm.fr:80/~dl/netscapesec/) written by Laurent Demailly.

  • September 20, 1995: Community ConneXion is awarding original T-shirts to people who Hack Netscape (http://www.c2.org:80/hacknetscape/) or Microsoft (http://www.c2.org:80/hackmsoft/).

  • June 4, 1996: Le Monde (http://www.lemonde.fr/), a french newspaper, published a paper with a somewhat garbled story about the Internet, that ends by implying “Damien Rodriguez” is a pirate. I found 15 factual errors in that article.

    The man who reads nothing at all is better educated than the man who reads nothing but newspapers.

    — Thomas Jefferson

  • August 9, 2000: I’m still getting some mail about this, but I’ve stopped replying. All this is not interesting anymore (to me, at least).

  • You can get the source (http://pauillac.inria.fr/~doligez/ssl/sources.html) of the program that I used to break the challenge.
  • A few people also have equivalent programs, for example Andrew Roos and Piete Brookes (http://www.brute.cl.cam.ac.uk/ftp/pub/brute/README.html).
  • There is a lot of research in cryptology being done at INRIA (projects ALGO (http://www.inria.fr/Equipes/ALGO-eng.html) and CODES (http://www.inria.fr/Equipes/CODES-eng.html)), École polytechnique (http://lix.polytechnique.fr/~morain/english-index.html), and École Normale Supérieure (http://www.ens.fr/dmi/equipes_dmi/grecc/index.html).
  • You may want to know more about the ITAR (International Traffic in Arms Regulations), which prevent Netscape from exporting their more secure system. See the EFF ITAR export archive (http://www.eff.org/pub/Crypto/ITAR_export/) or John Gilmore’s crypto export page.
  • The RSA-129 crack used about 50 times more computing power than I did for the SSL challenge.
  • Cryptographic software is export-restricted by the US government even if it didn’t originate from the US (i.e. if imported, it cannot be reexported). Yet, you can find strong cryptography in the form of PGP (all over the world) (http://pauillac.inria.fr/~doligez/ssl/world-pgp.html), and SSLeay (in Australia) (http://psych.psy.uq.oz.au/~ftp/Crypto/).
  • A UK company, MarketNet (https://193.118.187.101/), already has a server with 128-bit security.
  • There are serious restrictions on the use of cryptography in France (http://web.cnam.fr/Network/Crypto/).
  • the cypherpunks
  • Tim May’s Cyphernomicon (http://www.oberlin.edu/~brchkind/cyphernomicon/) is a list of frequently asked questions (with answers) about cryptography.
  • Netscape (http://www.netscape.com)
  • the WWW consortium (http://www.w3.org)
  • my own web page (http://pauillac.inria.fr/~doligez/)
  • Some articles reporting this story are also available on the Web. Here is a game: spot the errors in these articles and report them to their authors.
    • San Jose Mercury News (http://www.sjmercury.com/nav.htm) (no mistakes as far as I can tell)
    • HPCwire (http://www.tgc.com/websec/10111.html)
    • Komputery i Biuro (if you can read Polish; I cannot).
    • Le Devoir (http://www.vir.com/~wily/inforoute/chinfo07.htm) (in French).
  • It should be noted that both MD5 and RC4, two of the (very good) cryptographic components of SSL, were designed by Ron Rivest, of RSA Laboratories (http://www.rsa.com/).
  • For a good introduction to the field of cryptology, read the sci.crypt FAQ.
  • Some information about cryptography (http://www.thur.de/ulf/krypto/index.html) (in German).
  • A good Web page (http://www.cs.hut.fi/ssh/crypto/) on cryptography.

Cute quote:

“Just remember, in 10 years no one will care. In fact most people probably don’t care right now.”

— Conrad E. Muller

Related entries

Original external source

http://pauillac.inria.fr/~doligez/ssl/
Damien Doligez's page at INRIA, as published at the address above (checked October 3, 2026). The page grew from 1995 onward; its last dated entry is August 9, 2000. Relative links point to their original addresses, and two banner images at the foot of the page are omitted.