I am interested in understanding what the process would be if an attacker wished to attempt to decrypt data secured by common tools such as OpenPGP, Truecrypt or the like. Are there any documented records of such undertakings, or papers I can read to understand how a cryptanalyst approaches breaking an implementation? What would happen to break such a system? Can such systems be brute forced realistically?
- Anybody can ask a question
- Anybody can answer
- The best answers are voted up and rise to the top
From the perspective of someone who is a non-cryptographer but runs penetration tests against, well, anything really, there is a very simplistic answer that is generally correct in the real world:
Assuming the implementation of the encryption algorithm is not flawed (I know, not always a good assumption, but the common open source tools get a lot of peer review so it is an assumption I use) and a strong algorithm is used with a strong passphrase or shared secret, the reality is that breaking such a system is usually successful through misconfiguration or lax procedures on the part of operators.
This may lead to finding a copy of a passphrase on paper, in shared memory, in a backup, through a keylogger or even used for something else with weak password protection. So a real world attacker will usually take the easy route and look for wetware failure.
A strong passphrase and strong algorithm, by their very nature, are used to make the average time for a brute force attack beyond any useful time (caveat - the tool could get it on the first try, which is why we use averages, but as @Thomas says - you could win the lottery this week. Odds are just very very low!)