Re comments that I should re-read the paper, here is what Wiener's paper says about estimated costs of a specialized DES key breaker: $100,000 for a machine to break DES in an average of 35 hrs $1 mil for a machine to break DES in an average of 3.5 hrs $10 mil for a machine to break DES in an average of 21 mins It was as Peter says published in 1993. Wiener also budgets for $500,000 in design costs (wages, parts, fab etc). Another interesting part of the design is that it is based on a pipelined chip, clocked at 50Mhz which can try 50 Million keys/sec. 35 hours sounds a reasonable amount of time to break a Swift banking transfer key protecting trillions of dollars of funds. Perhaps $10,000 isn't too far off the current day costs of breaking DES after all. (500Mhz chips? You can get dec alphas at that speed, and thats a general purpose CPU) (If anybody is short of a copy, I've put the one up I've got (no idea where I got it from) here: http://www.dcs.ex.ac.uk/~aba/crypto-papers/des_key_search.ps ) Adam -- Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc`