The Upcoming DES Challenge

[Steve Reid]

> > It looks like there'll be an ascii-plaintext challenge (we won't
> > know the full plaintext - just that it's ascii, and long enough to
> > be unambigious)
> 
> Ick.  Why overly complexify things?  A known plaintext attack would be
> far more straightforward.  After all, the goal is to recover the key,
> not the message.

I think a completely known-plaintext attack would not impress the
masses. Consider how often crypto illiterate programmers implement
ciphers (such as Vigenere variants) which are obviously vulnerable to
known-plaintext attacks. The idea seems to be that if you know the
plaintext, what do you need the key for? _We_ may know better, but I
think we are in the minority.

For a slight increase in the computational requirements, we could end up
with a break that the "DES is good enough" people would have a _much_
harder time downplaying.