Issue 27 Part Two Update

9 posts / 0 new
Last post
C B Wright
Issue 27 Part Two Update

Comments are closed in I27 Part Two, so I figured I'd start a thread here. I've updated part of the text in I27P2 in an attempt to clarify exactly what the heck they were trying to use CB to do to crack the encryption on the file. People who actually understand encryption found the old description confusing. Hopefully this one is a bit clearer.

In technical writing parlance, this is what is known as "iterative documentation" :-)

Overzealous Pro... (not verified)
I finally found the forums,

I finally found the forums, so here we go.

TL;DR: you're right about the complexity, but the text makes it look like you're asking CB to guess most of the key, if not all of it. Don't bother reading the next comment (below this one) if my suggestion in this comment makes sense.

As written, it seems as if you're asking him to guess almost all of the bits in Liberty's key, and that problem seems trivial, because it's not obvious how many guesses that would be, nor that CB would get bored too quickly. If you clarify that, I think you'll have dealt with the immediate cryptogeek response of "oh, just guess the whole dang key then!" Something along the lines of "guess a few hundred times, just to narrow down the problem space to something our awesomely powerful computers, which also happen to never get bored, can handle in the time we have" should satisfy anyone. Then, throw in that it's just dumb luck that it was the 5th number in that space, instead of the 5 hojillionth. Or even make it the 5 thousandth guess.

Note that I have not bothered to address whatever space is reasonable for a computer to search, as that changes more or less daily, and I applaud you not identifying it in the text either. I think your example of 32768 bits in the key in the comments for the update is illuminating, as it got me thinking about how many guesses CB could make, and also reminded me that he has a low tolerance for boredom. As an author, keep in mind that I use a few thousand bits in my keys, and I think they're good enough for use right now -- and most HTTPS encryption uses way fewer bits all the time.

I grant that Liberty might well be worried about nation-states, or those with that kind of power. On the other hand, Thorpe probably rivals, if not surpasses, nation-states in computing power, and that's all the more reason to assume that CB could trivially reduce it to something breakable by Thorpe's resources. This is exacerbated by the key being the 5th key they tried, which makes it read as if the reduced bit space for possible keys ended up with somewhere less than 8 bits of freedom (especially as most of those numbers are bad choices for keys, because of math).

Overzealous Pro... (not verified)
Believe it or not, that was

Believe it or not, that was the short version.

Here's the long version, in case you don't think the text, as written, makes it look trivial for CB, which I think is the source of my objection to an otherwise technically excellent, and enjoyable, chapter.

Let's assume that when Liberty created the encryption key he was using OpenSSH, and decided to spend four hours creating a 32768 bit encryption key (which last I checked was the maximum it supported). That gives a range of ...

The specific numbers don't matter, so I left them out. Nor does whether or not Liberty could use OpenSSH for encrypting a file on disk (he can't, in a meaningful way, but he could use OpenSSL, which is similar enough for this discussion, or something else that Thorpe wrote).

So, there are a lot of numbers between 0 and 2 to the 32768th power, which is part of your point. But if you're dividing and conquering, you're doing what is known as a "binary search." Children play this game with "higher or lower" - I'm guessing a number between 1 and 10; the optimal 1st guess is 5 or 6 because that halves the number space if you're wrong (if you're right, the game is over).

Let's assume Liberty only had 8 bits available to him, because of Federally Declared Bit Shortage. Then, his key would be any number between 0 and 255 (or 0x00 and 0xFF in hex, or 00000000 and 11111111 in binary). He chooses 7, because it's his favorite number (which also makes it a bad key, but he never listened when Jenny told him these things). Jenny, who thinks Liberty listened to her, says "what do you think of 128?" CB says "Lower." He's now reduced the space from 0-255 or 0x00-0xFF or 00000000-1111111 to 0-127 or 0x00-0x7F or 00000000-01111111.

Let's count the one bits in that last one. There are 7. Every time CB bisects the number space, he throws away half of them.

He'll progress all the way down to 7, at which point Jenny and Robert break the key. Or maybe he'll stop at 15, because he's bored, and Jenny and Robert will try all the keys. As alluded to above, there are only a few good choices for a key in that space, once you ignore the problem that these keys are what most brute force systems will try first: 2, 3, 5, 7, 11, and 13.

You're shaking your head right now and saying "That's just what I said! After a hojillion guesses, CB would zero in on the right number, but no one has time for a hojillion guesses."

The important part, that we do both agree on, is that he doesn't have to guess all the possible numbers (256 of them in my set, a "hojillion" of them in 2^32768). If the key is 32Kbits long, he only (only) has to make 30 thousand guesses or so. At one guess every second, which is about how long it would take me to carefully identify a whether a square on a screen is red or blue, and press the correct key, over and over again, that's about 9 hours. Given your gentle reminder, he is obviously going to lose interest in that - but that's not clear from the text.

If we assume the conversation was 5 minutes long, which is a totally arbitrary number, he dropped the problem from 1 in 2^32768 to 1 in 2^32468, which still got rid of a gigantic number of keys.

Ultimately, having talked it through, what you need to emphasize is that the brute force of the existing computers is pretty good, but not good enough, and they think it will take a week to break - a week they don't have! Also, with Curveball playing "guess the number," he'll get bored (9 hours, as above, 18 hours if he slows down, or twenty minutes if he gets pissed and just holds down the space bar, right or wrong). So, emphasize that they need him to reduce the problem space, but not to the point of absurdity.

Overzealous Pro... (not verified)
And here's some more. :-)

And here's some more. :-)

It looks like you updated the text to avoid my complaint about adding up digits, so I will not continue to flog that horse.

Instead, I'll address the text pasted below, which I think was there all along and is what triggered my discomfort:

“So picture this: I’ll set up a program that asks you to guess if the number is between zero to four billion, or between four billion and one to eight billion. Once you choose, it’ll then ask you if the number is between the lower half of the range you just chose, or the upper half. And then again, and again, until we’ve got it narrowed down to a small enough range of numbers that it’ll be faster for a computer to do the rest of it. Could you approach it that way?”

Eight billion is 8E9 (8 times 10 to the 9th). This is about 2 to the 33rd power (8,589,934,592). That is not even close to a long enough key, and having Jenny tell CB that was the number space causes disbelief in the technical reader. If she says that Thorpe can break the (really long) key once CB gets rid of the first 8 billion choices, just by guessing high/low on them, and then we have something - and something it needs CB for because a computer can't just break the 1st 33 bits and then break the rest!

This is probably the shortest and sweetest version of my commentary so far. :-)

C B Wright
The paragraph before the one

The paragraph before the one you quoted had Jenny saying 8 billion was not the actual number, and that the range they were working with was much larger. At this point if that's not sufficient I'm going to have to shrug and move on because this is interfering with my work on issue 28.

--
Writer, former musician, occasional cartoonist, and noted authority on his own opinions.

C B Wright
OK, this is the new-new

OK, this is the new-new revision of that section. I'm putting it here before I put there because I'm getting tired of constantly revising it there:

“Yes,” Robert says. “I think so. What we'd need to do is narrow the search. Do we know the length of the encryption key?”

“Yes,” Jenny says. “4096 bits.”

Robert nods. “Then we know the range of possible values the encryption key might be. So all we need to do is come up with a program that allows CB to systematically discard portions of that range until we pare it down to a small enough range of possible values—a few billion or so should do it—that we can use our computers to brute force it.”

“Binary,” Jenny says. “Binary is essentially flipping a coin—zero or one—so we have CB guess the binary string, one bit at a—“

“That’s not going to work,” CB says.

“Why not?” Jenny asks. “It’s exactly the same thing as flipping a coin.”

“No it isn’t,” CB says. “I understand flipping a coin. I don’t understand binary numbers. I mean, I know what they are, but it’s not ingrained. I wouldn’t know what to focus on when I was pushing. I doubt it would do what you want.”

Jenny stares at Robert blankly. Robert shrugs. “It’s not my power.”

“OK,” Jenny says, “what about counting. You understand counting, right?”

CB gives her a flat look.

“So what if I Put it this way: we’re trying to find a specific number between zero and… well, it’s a big number, it’s…” Jenny fumbles as she tries to find a way to put the top value of that range in context.

“It’s one thousand, two hundred and thirty-four digits long,” Robert says.

CB looks from Jenny to Robert. “A thousand doesn’t seem that big.”

“That’s not the number,” Robert says. “That’s the number of digits in the number.”

CB blinks. “OK. That’s a big number.”

“Right,” Jenny says. “Big. So picture this: I’ll set up a program that asks you to guess if the number is between zero to half of that top value, or between ‘half that plus one’ to the end. Once you choose, it’ll then ask you if the number is between the lower half of the range you just chose, or the upper half. And then again, and again, until we’ve got it narrowed down to a small enough range of numbers that it’ll be faster for a computer to do the rest of it. Could you approach it that way?”

CB thinks it over. “Yeah, I think I can manage that. I’ll have to smoke though. Sorry Robert.”

Robert shakes his head. “You and your crutches.”

* * *

The unpleasant smell of burning nicotine and tar fills Robert’s office as CB sits in front of Jenny's laptop, cigarette dangling from the corner of his mouth, large headphones covering his ears. An empty ceramic cup serving as a makeshift ashtray is a quarter full of ash and spent cigarettes. His right hand hovers over the keyboard, thumb resting on the space bar, middle finger lightly touching the I. CB mutters a string of curses quietly to himself as he alternates between pressing the space bar and the I key in an apparently random order.

It’s been an hour so far. Jenny thinks she might scream.

“I hate waiting,” she says. It’s not the first time she’s said it, and every time she says it again her frustration climbs.
Robert laughs. “Before you came up with this idea our best course of action would have taken years.”

“I still hate waiting,” Jenny says. “It's just the way it goes. Also I'm a little afraid CB will get bored and quit.”
Robert laughs again. “You'd better hope he can't hear you through those headphones. He might do it just to spite you.”
She stares at CB's back, watching him choose between the space bar and the I key over and over again. “Is he doing his… is he using his whatever the heck it is he does? To 'make things happen?'”

“I assume so,” Robert says.

“I don't feel anything,” Jenny says. “I mean, when I've seen him in action in the past, I didn't feel anything then, either, but I always figured it was because I wasn't paying attention, or I was too busy being shot at, or something like that. But there's actually nothing. No electricity in the air, no feeling of power.”

“There never is. He claims he feels something when he's using it, but I've never been able to record anything. He doesn't even register as a metahuman.”

“It sounds like you tested him a lot,” Jenny says.

“When the Guardians were active I tested all of us. I thought if we understood how our abilities worked we could coordinate better, and if we understood what our limits were we might be able to work around them when necessary. And it was. It saved our lives more than a few times. But CB's tests were always the least useful of the batch.”

Robert studies Jenny for a moment. “Red Shift told me a bit about how he helped you train after you cocooned. One of his regrets was not being able to help you determine your physical limits. If you're interested, I have facilities here that allow me to conduct the kind of testing I did back then. It would provide some of those answers, and do it relatively quickly.”

Jenny shifts her weight uncomfortably.

“Only if you're interested,” Robert says. “I can understand why you wouldn't be. It is testing, and I would keep a record of it. I don't share that information—too many people would be tempted to misuse it—but there's still a certain amount of risk in letting someone keep it on file, even if that someone is me. Consider it a standing offer.”

“I'll think about it,” Jenny says. “Do you do this a lot?”

“When I have the opportunity, I make the offer,” Robert says. “I've made the offer to everyone else in your group. CB and Roger, of course, from way back. Red Shift accepted, which surprised me. Scrapper Jack declined, which didn't surprise me at all. Vigilante is thinking it over, which is more than I expected in his case. Both of the agents—Mr. Grant and Ms. Hu—have accepted, which will probably complicate their lives a little, but Travers tells me they're pretty cheerful when it comes to making things more complicated.”

“Red Shift accepted?” Jenny shakes her head. “I didn't think anyone in Crossfire would trust anyone enough for that.”

“He's a scientist,” Robert says. “That helps a bit.”

“Done.” CB stands up, takes off the headphones, and puts them on the table. He turns to face them, sticking a finger in his right ear and rubbing furiously. “That tone you used as a signal itches like crazy…”

Jenny and Robert stare at CB in surprise. Jenny looks up at the flat panel display, watching the clock continue to count down.

“The program says you aren’t finished yet,” Jenny says.

CB shrugs. “You said it would start beeping like crazy when I was done. Well… it’s beeping like crazy. I'm done.”

Robert looks at the terminal on his desk. “He's right. The sample is small enough for us to take over.”

“It was supposed to take a lot longer than that,” Jenny says. “You broke it.”

CB grins. “Jenny, I’ve been pushing nonstop for the last few hours, I have the mother of all headaches, and if I had to do this much longer I was going to pick up your damned laptop and throw it across the room as hard as I could manage, so I think we should call it a win. If this works, I only broke it a little.”

“I just don't see how—” Jenny starts to respond, then stops when Robert utters a cry of mild surprise. He stares at the terminal on his desk in bemusement.

“It worked,” Robert says.

Jenny's complaint dies on her lips. “Already?”

“There was a match on eighty-third combination,” Robert says. He looks at CB, eyebrow raised. “Are you still pushing?”

CB shakes his head. “I stopped as soon as I heard the tone.”

“Well,” Robert says, turning back to the terminal, “I guess we got lucky. The file is open.”

--
Writer, former musician, occasional cartoonist, and noted authority on his own opinions.

Overzealous Pro... (not verified)
This is both fabulous and

This is both fabulous and technically accurate. I think you nailed it.

I'm a little worried about

“Yes,” Jenny says. “4096 bits.”

but you don't name an algorithm, so there's nothing to say it's not a "secure" 4 kilobit key. That strength key might not stay strong, and maybe key length might not matter in the future, but you can't fix everything unless you are so vague nothing means anything.

Anyway, although I would naturally write 4096, I think you should put a comma after the 4. :-)

I feel like you nailed it. My advice: put it in front of someone non-technical, if you can, and make sure that the reader is not conflating previous versions automatically. I think this stands on its own, but I didn't go back and do an A-B test with the one on the site, partially because I thought that might make the blind spot bigger.

Upon reread, I might change "the sample is small enough" to "the sample space is small enough" but that's really minor.

C B Wright
I'm very relieved, because I

I'm very relieved, because I couldn't wait to publish the February issue any longer (it's early March! gah!). I can live with the minor issues at this point. :-)

--
Writer, former musician, occasional cartoonist, and noted authority on his own opinions.

Overzealous Pro... (not verified)
Hooray February issue!

Hooray February issue!