IT Baseline Protection Manual - The Information Warfare Site

Threats Catalogue Deliberate Acts Remarks
____________________________________________________________________ .........................................
- In the application of cryptographic processes, random numbers are often
required. Poor generators of random numbers could cause the values
produced to be predictable. This could, for example, cause cryptographic
check sums, which are supposed to guarantee the integrity of a message, to
become worthless.
For example, these criteria affect the DES algorithm for symmetric coding,
which is used frequently world-wide. This uses an effective code length of 56
bits. The so-called triple DES algorithm, carried out three times in a row with
two codes, has an effective code length of 112 bits and can be considered
sufficiently secure at the moment. The RSA algorithm, an asymmetric
procedure based on the factorisation problem, is also affected. If this is
operated with a code length of under 512 bits, potential insecurities are to be
expected. For the next few years, a code length of over 1024 bits is seen to be
sufficiently secure.
A common example of an insecure but extremely fast algorithm is what is
known as the XOR function, which uses a simple method of linking constant
values to the original plain text. This is a high-performance algorithm which,
however, can be cracked extremely quickly. The XOR function can, on the
other hand, be the most secure coding algorithm there is, if the data to be
encoded are XOR-ed with unpredictable random values (One-Time-Pad).
For inexperienced users it is practically impossible to determine whether a
cryptographic algorithm is sufficiently secure. Therefore, you should only use
algorithms that are known to have been developed by experts or have
undergone years of scientific investigations.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000