Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am interested in understanding what the process would be if an attacker wished to attempt to decrypt data secured by common tools such as OpenPGP, Truecrypt or the like. Are there any documented records of such undertakings, or papers I can read to understand how a cryptanalyst approaches breaking an implementation? What would happen to break such a system? Can such systems be brute forced realistically?

share|improve this question

From the perspective of someone who is a non-cryptographer but runs penetration tests against, well, anything really, there is a very simplistic answer that is generally correct in the real world:

Assuming the implementation of the encryption algorithm is not flawed (I know, not always a good assumption, but the common open source tools get a lot of peer review so it is an assumption I use) and a strong algorithm is used with a strong passphrase or shared secret, the reality is that breaking such a system is usually successful through misconfiguration or lax procedures on the part of operators.

This may lead to finding a copy of a passphrase on paper, in shared memory, in a backup, through a keylogger or even used for something else with weak password protection. So a real world attacker will usually take the easy route and look for wetware failure.

A strong passphrase and strong algorithm, by their very nature, are used to make the average time for a brute force attack beyond any useful time (caveat - the tool could get it on the first try, which is why we use averages, but as @Thomas says - you could win the lottery this week. Odds are just very very low!)

share|improve this answer
To put things into perspective: the tool could get it on the first try in the same way that I could win millions of dollars at the lottery twice the same week. Which is why averages are not a bad way of thinking about this situation: in everyday life, we already rely on very improbable events not happening. – Thomas Pornin Sep 28 '11 at 12:20
@Thomas - updated for you. You are absolutely right. – Rory Alsop Sep 28 '11 at 12:41

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.