64-bit RC5 Algorithm Finally Cracked

RSA Security announced that its RC5-64 Challenge was finally finished when the correct encryption key was discovered on July 14. However, due to a glitch in the software running the competition, the winning key wasn't discovered until August 12.

RSA Security launched the RC5-64 Challenge in 1997 to see how long it would take to crack a message encrypted with RC5 using a 64-bit key. Distributed.net provided a software-based tool for the competition, which lets anyone use any unused processor cycles on his or her computers to partake in the challenge. The tool distributed the processing power needed to crack the key across thousands of systems around the world. During unused cycles, the tool tried different encryption keys and sent the results back to Distributed.net for comparison.

Over the course of the competition, some 331,252 users participated by allowing their unused processor cycles to be used for key discovery. After 1757 days (4.81 years), a participant in Japan discovered the winning key. The discovery of the key shows that 64-bit RC5 encryption shouldn't be used for long-term protection of sensitive information.

"We’re very appreciative of all the volunteers who offered their time and computer’s idle processing time to help solve this challenge," said David McNett, Distributed.net co-founder and president. "We have once again shown how collective computing power can be applied to security technology with ordinary PC’s. We look forward to future RSA Security-sponsored challenges that will assist in helping the cryptographic community gauge the strength of an algorithm or application against exhaustive key search."

Previous contests sponsored by RSA Security include the DES Challenge, the RC5-40 Challenge and the RC5-56 Challenge, all of which were successfully cracked in shorter amounts of time than it took to complete the RC5-64 Challenge. A contest is still underway at Distributed.net to crack a 72-bit RC5 key.

Burt Kaliski, chief scientist at RSA Laboratories said, "The various challenges we sponsor are very useful for tracking the state of cryptographic achievements and helping ensure that organizations are maintaining the highest levels of security to protect their most critical data assets."

RSA Security awarded $10,000 to Distributed.net for completion of the RC5-64 Challenge. Distributed.net in turn will award $2000 to the challenge winner, $6000 to a non-profit organization, which is selected by vote, and will keep $2000 for itself for building the network and supplying the code required to conduct the challenge.