1
00:00:00,000 --> 00:00:01,640
I get to cheat.

2
00:00:11,310 --> 00:00:12,670
All right.

3
00:00:15,750 --> 00:00:17,630
And we're live.

4
00:00:18,030 --> 00:00:19,190
All right.

5
00:00:19,190 --> 00:00:26,090
So we're here with Mike Stay, another fantastic speaker for virtual DEF CON safe mode.

6
00:00:26,330 --> 00:00:34,250
He is covering how he recovered a six digit sum of worth of Bitcoin from an encrypted zip file.

7
00:00:35,130 --> 00:00:43,250
And I guess if you just want to like quickly go into your talk, spend just like a minute or two, and then we'll start asking you some questions.

8
00:00:43,470 --> 00:00:44,470
Yeah, sure.

9
00:00:44,470 --> 00:00:51,070
So short summary is I used to work as a reverse engineer back in the late 90s.

10
00:00:51,150 --> 00:00:58,690
I broke the zip encryption that was used by InfoZip, which was the open source version.

11
00:00:58,690 --> 00:01:07,990
And so everybody accepts PKZip based their encryption on that, particularly WinZip that had like 95% of market at the time.

12
00:01:08,470 --> 00:01:18,370
And yeah, so then 20 years later, somebody locked up their Bitcoin in a zip file that they made on their Linux box and forgot the password.

13
00:01:18,730 --> 00:01:22,790
So they came to me and said, hey, I found your paper.

14
00:01:22,990 --> 00:01:24,710
What's the current state of the art?

15
00:01:24,710 --> 00:01:25,930
Can you help me with this?

16
00:01:26,890 --> 00:01:29,670
And this is your first time talking at DEF CON, right?

17
00:01:29,670 --> 00:01:30,390
Yes.

18
00:01:30,450 --> 00:01:31,090
Yep.

19
00:01:31,210 --> 00:01:36,370
So we've given him fair warning, but there is a tradition for first time speakers of DEF CON.

20
00:01:36,670 --> 00:01:39,510
They get to take a shot with us on stage.

21
00:01:39,630 --> 00:01:41,850
QA session is the closest thing to a stage.

22
00:01:41,850 --> 00:01:45,910
So thank you, Mike, for providing DEF CON with some wonderful content.

23
00:01:46,050 --> 00:01:47,290
Cheers to you, man.

24
00:01:47,530 --> 00:01:49,350
Thank you for having me.

25
00:01:52,780 --> 00:01:54,220
All right.

26
00:01:58,040 --> 00:02:00,880
Okay, so I was actually kind of surprised.

27
00:02:00,880 --> 00:02:07,920
So I have never thought about zip encryption as being something that would be difficult to get around.

28
00:02:07,920 --> 00:02:10,420
You did go into a couple of different types of encryption.

29
00:02:10,420 --> 00:02:16,620
I was also surprised that like, well, I wasn't surprised that early word was as difficult as it was.

30
00:02:16,620 --> 00:02:22,500
But later on, the 40-bit encryption that was just really difficult to brute force, that one kind of surprised me.

31
00:02:22,500 --> 00:02:33,120
Do you have any other... have you worked with any other type of encryptions that have been surprisingly difficult to get into for being such a legacy, weird proprietary protocol?

32
00:02:34,860 --> 00:02:36,100
Let's see.

33
00:02:38,950 --> 00:02:50,510
There were a couple where they clearly knew enough to be dangerous, but then completely screwed it up.

34
00:02:50,510 --> 00:02:52,750
Like early word perfect.

35
00:02:54,390 --> 00:02:59,390
You know, the founder of the company had broken that one himself.

36
00:02:59,570 --> 00:03:05,870
And then when they released their new version saying, oh, now we're using strong crypto, nobody will be able to break this.

37
00:03:05,870 --> 00:03:18,250
Went in and found that they took the password and then ran it through DES in the wrong way and got out some vector and then just XORed their file with it or something ridiculous like that.

38
00:03:18,250 --> 00:03:21,410
So they had DES, but they didn't use it right.

39
00:03:21,410 --> 00:03:22,710
It was so close.

40
00:03:22,850 --> 00:03:23,170
Yeah.

41
00:03:23,950 --> 00:03:25,550
There were ones like

42
00:03:29,170 --> 00:03:36,990
Microsoft Access 97, I think was one where they had RC4 encryption, but it was a fixed key.

43
00:03:36,990 --> 00:03:46,170
And so they would RC4 encrypt the file with this fixed key and then you'd go to this offset in the file and look up the password and it was just sitting there in plain text.

44
00:03:48,230 --> 00:03:50,510
Some of the details might be off.

45
00:03:50,510 --> 00:03:51,610
It's been 20 years.

46
00:03:51,610 --> 00:03:52,330
Fair.

47
00:03:54,110 --> 00:03:56,270
Go ahead.

48
00:03:56,570 --> 00:04:05,850
I want to ask a really, while we wait for people to come up with some really good technical questions to throw at you, I'm going to do one that... all right.

49
00:04:05,850 --> 00:04:09,970
So let's say that I don't know everything there is to know about encryption out there.

50
00:04:10,230 --> 00:04:16,050
Let's say I want you to do... I'm going to ask you to do a similar thing that you did in your talk.

51
00:04:16,050 --> 00:04:22,350
And I know that my password starts with a word and has some unknown thing after that.

52
00:04:22,350 --> 00:04:29,350
Are there things that I can provide you that I might know about the password that will help you get through this?

53
00:04:29,350 --> 00:04:33,230
Or does the encryption work in such a way that that doesn't mean...

54
00:04:33,230 --> 00:04:34,630
Dictionary attack, right?

55
00:04:34,730 --> 00:04:38,010
The product you're using has strong crypto.

56
00:04:38,010 --> 00:04:41,250
The guys that built it knew what they were doing.

57
00:04:41,250 --> 00:04:44,850
Then pretty much a dictionary attack is the only option you've got left.

58
00:04:44,850 --> 00:04:52,490
And so there are specialized attack software that you can get.

59
00:04:52,490 --> 00:04:53,910
One of them is called Hashcat.

60
00:04:54,290 --> 00:04:58,190
It's built for running on GPU farms.

61
00:04:58,190 --> 00:05:03,070
That was what we were originally looking at is maybe writing a Hashcat module for this.

62
00:05:03,070 --> 00:05:06,470
But it's really designed for processing a key space.

63
00:05:07,490 --> 00:05:10,010
And so you can give it a dictionary.

64
00:05:10,010 --> 00:05:18,950
You can then say, take this and then do all alphanumeric strings up to length six after it.

65
00:05:18,950 --> 00:05:22,790
Or take this and try all different capitalizations.

66
00:05:22,830 --> 00:05:25,650
Replace vowels with numbers.

67
00:05:25,650 --> 00:05:29,970
Say, you know, an I goes to a one or an O to a zero and so on.

68
00:05:29,970 --> 00:05:31,030
E to a three.

69
00:05:31,030 --> 00:05:41,410
Whenever you do that sort of thing, you can... there are these rule sets that you can say, okay, Hashcat, this is what you're going to start with and these are the rule sets that I want you to use when processing it.

70
00:05:41,410 --> 00:05:45,830
Because this is best in my memory what the password looked like.

71
00:05:45,970 --> 00:05:52,450
On the other hand, if you're doing something like correct battery horse staple from XKCD, you've got too much entropy.

72
00:05:52,450 --> 00:05:57,590
And that's really the way to protect your files if you're doing something is just make it longer, right?

73
00:05:57,590 --> 00:06:09,650
Because if you go from 26 characters, which is, you know, lowercase letters, to 97, you've roughly tripled.

74
00:06:09,650 --> 00:06:17,190
That's adding two bits per character to the entropy, right?

75
00:06:17,190 --> 00:06:27,410
So if you've got a length eight password, 26 to the eighth has, you know, all possible lowercase letters there.

76
00:06:27,410 --> 00:06:32,410
But if you go up to 97, all printable characters, that's only adding two bits per password.

77
00:06:32,410 --> 00:06:34,430
I'm sorry, two bits per character.

78
00:06:34,610 --> 00:06:41,250
So on a length eight password, that's, let's see, 26 is about five bits.

79
00:06:41,250 --> 00:06:42,750
That's 32.

80
00:06:43,250 --> 00:06:45,530
And two times eight is 16.

81
00:06:45,530 --> 00:06:48,390
So it's adding three characters to the length of your password.

82
00:06:48,450 --> 00:06:55,770
Adding printable characters to a password of the same length, you know, it's just adding a few more.

83
00:06:55,770 --> 00:07:04,250
But if you go and add a whole bunch more characters to your password, make it a long one, that'll make it really secure.

84
00:07:04,750 --> 00:07:08,630
Use a passphrase instead of a short random string.

85
00:07:08,670 --> 00:07:20,990
Yeah, and so if you, even if you're using English words, right, if you make it a passphrase rather than password, that'll make it really so vulnerable to a dictionary attack.

86
00:07:20,990 --> 00:07:26,530
There may be other attacks if the crypto is bad, but if the it'll protect you.

87
00:07:26,790 --> 00:07:30,130
So just this is entirely for my own curiosity.

88
00:07:30,130 --> 00:07:36,570
So after you broke through this zip file, you got the password that you could use to decrypt the zip file?

89
00:07:36,570 --> 00:07:37,830
No, we didn't recover the password.

90
00:07:37,830 --> 00:07:39,050
Oh, you didn't recover the password.

91
00:07:39,050 --> 00:07:39,350
Okay.

92
00:07:39,350 --> 00:07:39,550
Yeah.

93
00:07:39,550 --> 00:07:44,950
So the way the way zip works is it derives a 96 bit key from the password.

94
00:07:44,950 --> 00:07:47,410
And it was 96 bit key that we recovered.

95
00:07:47,410 --> 00:08:00,010
Now, if we wanted the password, we could take those 96 bits and then go launch a hashcat attack using dictionary and and some other stuff that that others have have worked out to get a few of the initial characters.

96
00:08:00,290 --> 00:08:05,130
That's where it fits into the type of password cracking that many of us are familiar with.

97
00:08:05,130 --> 00:08:06,490
Hashcat or John the Ripper.

98
00:08:06,490 --> 00:08:07,150
Okay.

99
00:08:07,290 --> 00:08:15,830
So if you've got the 96 bits, then there's something you can do with the dictionary attack that'll see whether the initialization process gives you those bits or not.

100
00:08:15,830 --> 00:08:16,790
That's great.

101
00:08:16,790 --> 00:08:25,770
Yeah, what I was going to ask is if you got far enough to see if like a dictionary attack would actually work against the zip file in less time than you spending all this time to brute force it.

102
00:08:26,610 --> 00:08:39,570
But if you didn't... He suspected it was on the order of, you know, 20 something characters or more, so it took him quite a while to to brute force.

103
00:08:39,570 --> 00:08:43,570
Would this technique that you went through work for any encrypted zip file?

104
00:08:43,930 --> 00:08:45,030
Yeah, yeah.

105
00:08:45,030 --> 00:08:47,410
This will work on any zip file with...

106
00:08:47,970 --> 00:08:56,290
So my original attack back in the late 90s required five bytes, five files in the archive with the same password.

107
00:08:56,290 --> 00:09:04,130
This one we were able to get away with two because we also knew the the timestamp.

108
00:09:04,150 --> 00:09:10,530
So if you've got the timestamp and you've got two files, then this will work on any of them.

109
00:09:10,530 --> 00:09:15,030
So how does the number of files affect the craftability of the zip file?

110
00:09:18,770 --> 00:09:21,450
When... Suppose you don't have the timestamp.

111
00:09:21,450 --> 00:09:21,970
Okay.

112
00:09:22,190 --> 00:09:27,770
In InfoZip, it was meant to run on Unix machines as well as Windows machines.

113
00:09:27,770 --> 00:09:32,250
So on PKZip, they just allocated some memory and used whatever bytes were there.

114
00:09:32,250 --> 00:09:34,090
Those random bytes.

115
00:09:34,090 --> 00:09:39,270
In InfoZip on many Unix machines, it would initialize the bytes to zero.

116
00:09:39,270 --> 00:09:41,250
And so there would be no randomness there.

117
00:09:41,250 --> 00:09:52,630
So they used the process ID and the timestamp to get a little bit of entropy and then fed the XOR of those two into C's RAND function and generated a bunch of bytes.

118
00:09:52,630 --> 00:09:55,710
But they thought maybe that's too weak, right?

119
00:09:56,050 --> 00:09:59,170
There were some known plain text attacks.

120
00:09:59,170 --> 00:10:08,670
And they're like, well, if they brute force the timestamp and the process ID, then they can derive the rest of these bytes.

121
00:10:08,670 --> 00:10:12,690
And so they took the password and encrypted those bytes once.

122
00:10:12,810 --> 00:10:17,570
And that's what they used as the random bytes when they encrypted that and the rest of the file.

123
00:10:17,990 --> 00:10:26,070
But when they encrypted it twice, because of the way the ZipCypher works, it produced the same stream byte twice at the beginning.

124
00:10:26,070 --> 00:10:31,590
So it encrypted it once and then it decrypted it for the first byte of each file.

125
00:10:31,590 --> 00:10:34,470
So when you say that, is it files in the archive?

126
00:10:34,470 --> 00:10:47,270
I have every 10th output of that C's RAND function and 40 bits were enough to figure out the 31-bit internal state of C's RAND function.

127
00:10:47,270 --> 00:10:53,270
So once I knew the internal state of C's RAND function, I could generate those first 10 bytes of each file.

128
00:10:53,270 --> 00:10:56,590
And then I would do a bunch of bit guesses.

129
00:10:56,590 --> 00:11:04,810
And because of the way the Cypher was designed, not all 96 bits were used when producing each output byte of the stream.

130
00:11:05,130 --> 00:11:08,790
So I guess like 40-something bits up front.

131
00:11:09,070 --> 00:11:14,930
And then because I had five files there, and I knew what those bytes had to be, I could filter all of those bits.

132
00:11:14,930 --> 00:11:22,050
I could say, I've got to know which of these 40-bit guesses are correct before moving on to the next stage.

133
00:11:22,050 --> 00:11:22,250
Got it.

134
00:11:22,250 --> 00:11:33,370
And so by having five files, I could both derive the internal state of C's RAND function and filter my guesses and finish one stage before moving on to the next one.

135
00:11:33,370 --> 00:11:35,850
And so it was a parallel divide-and-conquer attack.

136
00:11:35,850 --> 00:11:38,830
In this case, I only had two files.

137
00:11:38,830 --> 00:11:44,070
So even though I was making a 40-something-bit guess, I only had two bytes to filter it with.

138
00:11:44,070 --> 00:11:51,630
So I, you know, that meant 2 to the 24th wrong key guesses went to the next stage, and I had to guess more.

139
00:11:51,630 --> 00:11:59,330
And so it just kept getting bigger and bigger and bigger up to 2 to the 60-something before I could start paring it down at the other end.

140
00:11:59,330 --> 00:12:05,550
So just for clarification, it's resetting the stream cipher every single time it encrypts a separate file, and that's why you're able to do this?

141
00:12:05,710 --> 00:12:06,690
Yes , yeah.

142
00:12:06,690 --> 00:12:11,630
So it starts over again with the same password, resets it to the original state, and starts from there.

143
00:12:11,630 --> 00:12:17,190
Because you want to be able to extract a single file from the zip file without having to extract all of them.

144
00:12:17,190 --> 00:12:17,650
That makes sense.

145
00:12:17,650 --> 00:12:23,590
I think you just answered one of the questions we got with the new attack, is there an acceleration in having more files in the archive?

146
00:12:23,590 --> 00:12:24,890
Absolutely.

147
00:12:24,890 --> 00:12:29,050
I mean, in the original attack, the more files you had, the faster it went.

148
00:12:29,990 --> 00:12:33,450
And so this is just a refinement of the original attack.

149
00:12:34,650 --> 00:12:40,670
But certainly having more files means more bits to filter with, and getting rid of false positives earlier.

150
00:12:40,910 --> 00:12:50,090
And sort of closely associated with that, do you know if this kind of attack works with the other encrypted archives like 7-zip and RAR?

151
00:12:50,090 --> 00:12:56,070
Most archival software now uses AES, like RAR5 switched to AES-256.

152
00:12:56,070 --> 00:12:59,450
So this isn't going to work against anything except zip files.

153
00:12:59,690 --> 00:13:02,330
Going for best standards, I like to see that.

154
00:13:02,490 --> 00:13:06,370
Even WinZip switched to AES a while ago.

155
00:13:06,370 --> 00:13:07,470
Fair enough.

156
00:13:08,330 --> 00:13:10,370
We had another question.

157
00:13:10,770 --> 00:13:15,090
Do you know if your client was the legit owner of the Bitcoin?

158
00:13:15,970 --> 00:13:23,690
I can't be certain, but we looked him up online.

159
00:13:23,710 --> 00:13:29,310
We knew his real name, and we looked him up online and found that he had reason to be owning Bitcoin.

160
00:13:29,870 --> 00:13:31,350
It didn't seem too shady.

161
00:13:31,350 --> 00:13:34,610
It wasn't someone reaching out across the dark web from...

162
00:13:35,470 --> 00:13:38,610
It was part of his employment that he would be dealing with Bitcoin.

163
00:13:38,610 --> 00:13:39,610
Fair enough.

164
00:13:43,250 --> 00:13:45,070
No, that makes sense.

165
00:13:45,070 --> 00:13:47,530
So this is really interesting.

166
00:13:48,510 --> 00:13:59,010
Do you expect with putting this out here and providing this talk, do you expect to get more of these requests to crack more things?

167
00:13:59,010 --> 00:14:06,190
If you do get more of these requests, do you have an answer pre-built of how you might respond?

168
00:14:06,190 --> 00:14:19,090
As far as breaking into Bitcoin wallets, yeah, when I first wrote this up on my blog, we got a whole bunch of requests.

169
00:14:19,470 --> 00:14:25,090
And for most of them, I had to say, nope, sorry, the best you can do is a dictionary attack.

170
00:14:25,090 --> 00:14:30,730
Many of them said, you know, I bought Bitcoin with a credit card ages ago, but now I can't find my wallet.

171
00:14:30,730 --> 00:14:31,450
Can you help me?

172
00:14:31,450 --> 00:14:33,470
I've got my credit card records.

173
00:14:33,830 --> 00:14:35,570
No, we need a little more than that.

174
00:14:36,250 --> 00:14:46,210
The one that was most interesting was a guy who claimed that his hard drive had crashed, that had Bitcoin on it.

175
00:14:46,210 --> 00:14:48,650
And so we were working with him to get some data recovery.

176
00:14:48,650 --> 00:15:00,090
But after a while, it became clear that he was perhaps schizophrenic or delusional, that he believed that someone was cheating him out of his Bitcoin and had stolen.

177
00:15:00,090 --> 00:15:03,190
Anyway, it was interesting.

178
00:15:03,190 --> 00:15:10,670
That said, there are about four situations where we could potentially recover software.

179
00:15:10,670 --> 00:15:20,710
One of them is if you printed out or wrote down the seed phrase for generating the 128-bit key, right?

180
00:15:20,710 --> 00:15:25,550
When you generate it, the wallet software always says, keep this in a secure place, right?

181
00:15:25,550 --> 00:15:32,150
And it's this 30-odd word phrase that'll generate the 128-bit key.

182
00:15:32,150 --> 00:15:35,570
If you've got that, you can recover the key, you can recover all your Bitcoin.

183
00:15:36,210 --> 00:15:44,050
The next case is if you have had damage to your hard drive, right?

184
00:15:44,050 --> 00:15:49,190
If the hard drive crashes, then the data in the sector is probably okay.

185
00:15:49,270 --> 00:15:57,090
And even if the data in the sector is bad, we only need eight bytes to be okay, that has the encrypted key in it, right?

186
00:15:57,090 --> 00:16:01,030
So if we can recover that data, then we can probably recover your wallet.

187
00:16:01,790 --> 00:16:12,290
If you have the wallet software, you don't have the original phrase, but you know you used a weak password, then we can try and do the dictionary attack approach.

188
00:16:12,930 --> 00:16:23,670
And then the least probable, there have been wallets with security flaws that make them susceptible to breaking more easily.

189
00:16:23,670 --> 00:16:32,530
And if you happened to use one of those back when they were being used, most of them have been fixed since then.

190
00:16:32,530 --> 00:16:36,830
But if you happen to use one that had a flaw, then we could try to exploit that flaw.

191
00:16:36,830 --> 00:16:44,750
Yeah, so this was an attack on a zip file, but you're talking directly about Bitcoin wallets.

192
00:16:44,750 --> 00:16:49,530
Do they also use some zip-like structure?

193
00:16:49,530 --> 00:16:52,230
Have you attacked the Bitcoin wallets themselves?

194
00:16:52,890 --> 00:17:08,650
The Bitcoin wallet takes the key, the private key information that you sign your transactions with, and a password, and generates a symmetric key from the password and some salt, and then encrypts the private key.

195
00:17:08,830 --> 00:17:12,050
So that private key is really what gets you access to the Bitcoin.

196
00:17:12,050 --> 00:17:20,270
What we can do is try to either recover the private key by means of that really long phrase, regenerate that same private key.

197
00:17:20,890 --> 00:17:27,090
Or we can attack the password, if you've got the wallet, so that we can decrypt the private key that you had stored.

198
00:17:27,090 --> 00:17:40,370
Or we can attack some flaw in the cipher where, for instance, when they were coming up with the symmetric key, they didn't use the entropy properly.

199
00:17:40,370 --> 00:17:43,590
And so there's a much smaller key space that we would have to brute force.

200
00:17:43,750 --> 00:17:47,970
There are very few of those that were out there, but there were some.

201
00:17:48,550 --> 00:17:50,930
There's a possibility we could do that.

202
00:17:52,450 --> 00:17:57,890
So I like asking this question to people who know this technology really well.

203
00:17:57,890 --> 00:18:06,410
Feel free to tell me, no, you're not going to answer this question, but do you yourself hold any value in any cryptocurrencies?

204
00:18:06,410 --> 00:18:08,790
Because you seem to understand how it works.

205
00:18:09,430 --> 00:18:17,750
Um, I don't, because I have... I mean, there's no inherent...

206
00:18:22,400 --> 00:18:28,260
When you pay taxes, you pay taxes in dollars, because the government says you have to pay taxes in dollars.

207
00:18:28,260 --> 00:18:33,520
So there is this built-in necessity to own dollars at some point.

208
00:18:33,520 --> 00:18:39,320
There is no built-in necessity to own Bitcoin or any other cryptocurrency, right?

209
00:18:39,320 --> 00:19:03,940
There's... and for Bitcoin and Ethereum, I think that proof of work has shown itself to be susceptible to attacks like Sybil attacks, 51% attacks, like Bitcoin Cash and Ethereum Classic have both suffered 51% attacks.

210
00:19:03,940 --> 00:19:12,720
They were, you know, rebuffed eventually, but, you know, if Google wanted to deploy their whole infrastructure, they could completely own Bitcoin.

211
00:19:12,760 --> 00:19:19,480
There are existing companies that could do that, not to mention nation states, right?

212
00:19:19,480 --> 00:19:29,080
If the US wanted to take it down, they've got this thing in Tooele here in Utah that they could deploy against taking down Bitcoin.

213
00:19:29,080 --> 00:19:43,280
So my personal take, and we designed a system to do this, is that you need to use a consensus algorithm with true finality, that proof of stake and bandwidth.

214
00:19:43,780 --> 00:19:49,740
And then after a certain point, when you have enough witnesses, you say, this block is finalized and it can't ever change.

215
00:19:50,280 --> 00:19:55,660
Ethereum is trying to move in that direction with their proof of stake algorithms, but...

216
00:19:56,680 --> 00:20:02,220
Yeah, I've heard of proof of stake, but the finality piece is new to me.

217
00:20:02,880 --> 00:20:06,860
You've definitely given me a few pieces already that I'm going to need to go Google.

218
00:20:07,320 --> 00:20:10,680
So we got another question.

219
00:20:10,720 --> 00:20:12,920
It's sort of a meta question.

220
00:20:14,960 --> 00:20:19,400
One of the people that watched your talk had a little bit of struggle following your math.

221
00:20:19,400 --> 00:20:27,800
They understood all the aspects individually that you talked about, but zooming back out, they seem to lose pieces in their head.

222
00:20:27,800 --> 00:20:32,000
And they want to know, how do you juggle this?

223
00:20:32,000 --> 00:20:38,880
Are you aware that some people that follow your talk might have difficulty zooming in and out like that?

224
00:20:39,080 --> 00:20:39,680
Yeah.

225
00:20:39,680 --> 00:20:46,380
So I had some options when doing this talk.

226
00:20:46,380 --> 00:20:50,780
One was to go really deep and really hard on the technical stuff.

227
00:20:50,780 --> 00:20:58,860
Another one was to give enough background and the basic idea of how this attack played off and the challenges we faced.

228
00:20:58,860 --> 00:21:07,320
So I chose to be less detailed for the sake of the story rather than go deep into it.

229
00:21:07,600 --> 00:21:11,400
If anyone has any technical questions, take them offline.

230
00:21:11,400 --> 00:21:15,720
I'll be happy to talk through them with you and point at lines of code and that sort of thing.

231
00:21:15,720 --> 00:21:16,540
That's great.

232
00:21:16,540 --> 00:21:17,140
That's awesome.

233
00:21:17,420 --> 00:21:25,240
As far as keeping it in my head, I would have to wake up and then come down and reload everything.

234
00:21:25,240 --> 00:21:28,540
I had stuff on whiteboards all over my office, pictures.

235
00:21:28,540 --> 00:21:29,900
It was a process.

236
00:21:29,900 --> 00:21:35,640
I would even have to remind myself about what was going on because I couldn't keep it all going at once.

237
00:21:35,640 --> 00:21:45,900
And it was a months-long process of trying to think through over and over again how things are going wrong and what I might be able to do to fix it.

238
00:21:45,900 --> 00:21:52,340
So if you don't get it from one short 45-minute talk, I certainly don't blame you.

239
00:21:52,640 --> 00:21:53,980
Makes sense.

240
00:21:56,620 --> 00:21:58,580
Did we discuss this at the end?

241
00:21:58,580 --> 00:22:00,520
I'm sorry, I missed this point.

242
00:22:00,540 --> 00:22:03,660
Did you actually get any compensation for this work?

243
00:22:03,960 --> 00:22:04,760
We did, yeah.

244
00:22:04,760 --> 00:22:08,880
So when he first talked to us, we said we'd like so much up front.

245
00:22:09,180 --> 00:22:12,120
We estimate that the total cost will be about this much.

246
00:22:12,680 --> 00:22:15,460
We took longer than we said we would.

247
00:22:15,600 --> 00:22:19,240
We expected it to be done in three months.

248
00:22:19,360 --> 00:22:22,340
That was October, so November, December, January.

249
00:22:22,340 --> 00:22:28,220
It was April before we actually, late March, before we actually got the key back.

250
00:22:28,240 --> 00:22:35,920
But because of all of the extra cryptanalytic work that I did, it took a tenth of the time on the hardware.

251
00:22:35,920 --> 00:22:45,060
So the hardware cost ended up being only roughly 10, 15 grand as opposed to the 100 grand that we thought it would take at the beginning.

252
00:22:45,060 --> 00:22:47,840
So we gave us a bonus afterwards, which was nice.

253
00:22:47,840 --> 00:22:50,400
I actually missed this.

254
00:22:51,180 --> 00:22:55,880
Another one of the speaker goons mentioned that it was on AWS.

255
00:22:57,220 --> 00:23:03,740
And they want to know if the 10 to 15 was about what you were expecting from compute cost.

256
00:23:04,240 --> 00:23:07,180
No, we were expecting it to take far more.

257
00:23:07,180 --> 00:23:18,460
The original estimate was around 2 to the 64th work, which is comparable to finding a collision in SHA-1, which is 100...

258
00:23:20,240 --> 00:23:22,260
Sorry, SHA-1 was 160.

259
00:23:22,260 --> 00:23:25,740
MD5 was a 64-bit thing.

260
00:23:26,140 --> 00:23:37,500
And there were some recent work where to find a collision, they had to deploy an enormous amount of work to do it.

261
00:23:37,500 --> 00:23:43,460
I guess MD5, they were able to do because of flaws in the hash function.

262
00:23:44,200 --> 00:23:51,280
SHA-1 took roughly 100k of GPU time to break.

263
00:23:51,280 --> 00:23:55,760
And so we were estimating it would be comparable to do this.

264
00:23:55,760 --> 00:24:00,280
And this is what your company does, like data recovery?

265
00:24:00,280 --> 00:24:01,660
Or is it specific to...

266
00:24:01,660 --> 00:24:03,120
Not originally.

267
00:24:03,120 --> 00:24:08,660
Originally, we were working on a distributed operating system.

268
00:24:09,980 --> 00:24:19,240
And we could get clients interested if we can get in the door, but it was right at the time when cryptocurrency was taking off, and we didn't have to talk to anybody to get them in.

269
00:24:19,900 --> 00:24:28,980
We started doing some consulting work there, built up a team of about 20 scholarly developers that were top of the...

270
00:24:30,840 --> 00:24:33,300
cream of the crop, top of their field.

271
00:24:33,940 --> 00:24:39,780
And then built the rChain cryptocurrency platform.

272
00:24:40,220 --> 00:24:42,920
rChain started having some financial troubles.

273
00:24:42,920 --> 00:24:46,560
We allowed them to hire the devs early.

274
00:24:46,560 --> 00:24:52,180
We had a contract that we'd hold on to them for a while, and then they could hire them after they'd worked for us for a year.

275
00:24:52,180 --> 00:24:54,020
But we let them hire them early.

276
00:24:54,160 --> 00:24:56,820
So they've taken over the dev team.

277
00:24:56,860 --> 00:24:59,180
And then we started working on some other things.

278
00:24:59,180 --> 00:25:03,280
And this particular consulting job came up at a nice time.

279
00:25:03,280 --> 00:25:04,540
It was a whole lot of fun.

280
00:25:04,540 --> 00:25:10,240
But right now we're looking for any interesting consulting work that people have.

281
00:25:10,240 --> 00:25:14,900
That was exactly what I wanted to segue into now that you've done this talk.

282
00:25:15,300 --> 00:25:21,460
Do you have another research item on your to-do list that you're trying to aim at?

283
00:25:22,220 --> 00:25:23,100
Sure.

284
00:25:23,820 --> 00:25:30,260
At the moment, I'm doing some consulting work for the Ethereum Foundation.

285
00:25:30,260 --> 00:25:38,140
I've got some consensus algorithm research that I'm working on.

286
00:25:38,730 --> 00:25:48,920
We got access to GPT-3, so we're building an adventure game, kind of like AI Dungeon, but with more structure using GPT-3.

287
00:25:49,300 --> 00:26:02,240
We've got various ideas for voice assistants that will be able to call somebody at a restaurant rather than figure out every different restaurant's online ordering system.

288
00:26:02,240 --> 00:26:06,920
You just have your assistant call them up and have a conversation.

289
00:26:07,140 --> 00:26:11,000
GPT-3 seems to be able to have conversations, so maybe we can use that.

290
00:26:11,100 --> 00:26:17,660
This is probably a really small piece of what you're doing, but I used to be incredibly into MUDs.

291
00:26:17,700 --> 00:26:22,160
So an adventure game that's generated by GPT-3 sounds interesting.

292
00:26:22,160 --> 00:26:28,460
Yeah, so we're working on the room generation for quests.

293
00:26:28,460 --> 00:26:32,100
You have to convince this character to give it to you.

294
00:26:32,100 --> 00:26:34,920
He's got desires and needs.

295
00:26:34,920 --> 00:26:41,580
So you'll have to be role-playing while you're doing this game, interacting with these characters.

296
00:26:41,580 --> 00:26:49,360
There is a person that goes by the handle Evil Mog, is running a DEF CON CTF MUD right now.

297
00:26:49,360 --> 00:26:52,180
Just a shout out to him.

298
00:26:52,300 --> 00:26:54,440
We are really close to being out of time.

299
00:26:54,440 --> 00:26:59,400
There are a lot of questions over here about specific pieces, specific technologies.

300
00:26:59,400 --> 00:27:05,540
I think I'd like for people to bring those to you on a less moderated basis.

301
00:27:05,540 --> 00:27:07,880
So we'll let those go for now.

302
00:27:08,060 --> 00:27:14,920
Before I let you go, I want to know, what is the thing that you would like us to take away from this?

303
00:27:14,920 --> 00:27:20,660
If there is a final idea that we should walk away from your talk.

304
00:27:25,260 --> 00:27:28,020
That attacks on cryptography only get better.

305
00:27:29,340 --> 00:27:37,200
At the time MD5 was proposed, 128 bits for a 64-bit attack was inconceivable.

306
00:27:37,200 --> 00:27:42,020
And yet, within 5 to 10 years, they were able to attack that one.

307
00:27:42,020 --> 00:27:44,700
And then SHA, there are attacks.

308
00:27:44,920 --> 00:27:52,840
AES with the bi-click attack, they've now broken, I think, seven or eight of the 10 rounds.

309
00:27:53,140 --> 00:28:03,540
If there is something that you need to keep secure, choose the best software and have a plan for upgrading your crypto and any products that you put crypto into.

310
00:28:03,660 --> 00:28:05,520
Because the attacks are going to get better.

311
00:28:05,520 --> 00:28:10,260
You'll need at some point to transition from the broken system to a new one.

312
00:28:10,980 --> 00:28:15,360
And so that will come up during the lifetime of your product.

313
00:28:15,360 --> 00:28:17,400
So be thinking about it.

314
00:28:17,680 --> 00:28:19,460
That's definitely good advice.

315
00:28:19,460 --> 00:28:19,740
Yeah.

316
00:28:23,880 --> 00:28:26,440
Falvo, you got any more questions you want to sneak in under the hood?

317
00:28:26,880 --> 00:28:28,120
No, I think I'm good.

318
00:28:28,120 --> 00:28:30,560
I really appreciate the work that you've done here.

319
00:28:30,560 --> 00:28:35,900
And thank you for coming to present and giving your time to this Q&A session.

320
00:28:36,420 --> 00:28:40,880
There are some more people that have some more questions coming in, if you're willing to do so.

321
00:28:40,880 --> 00:28:47,980
If you would put your contact information in the TrackOne channel on Discord here, we will get that out there.

322
00:28:47,980 --> 00:28:52,600
Folks can look you up if you're willing to be available to that.

323
00:28:52,600 --> 00:29:02,060
I also recommend you put all of your company information, if you're willing to do so, because that's a good way for people to find you for those contracts you were talking about.

324
00:29:02,440 --> 00:29:03,000
Great.

325
00:29:03,000 --> 00:29:04,220
Thank you very much.

326
00:29:04,220 --> 00:29:05,020
All right.

327
00:29:05,600 --> 00:29:06,300
Take care.