# How exactly would someone crack a private key passphrase? [closed]

Lets say for a PGP/GPG pair with a passphrase.

-

## closed as off-topic by e-sushi, AFS, DrLecter, figlesquidge, rathFeb 8 '14 at 15:51

• This question does not appear to be about cryptography within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

This question is off-topic because it is asking about practically cracking a private key passphrase. Looking at the previous question and an eye-opening comment, OP obviously seems to be interested in the "dark-side"; meaning: OP is looking for a practical guide which will help him/her decypher a block of data… that's off-topic. –  e-sushi Feb 7 '14 at 5:53
I voted 'close' but have to say I think I voted incorrectly. Just because someone might have malicious intent doesn't mean we can assume it and shouldn't be helpful. That said, it might be prudent for @Andrew to provide a reason for his question to clear the air –  figlesquidge Feb 7 '14 at 11:58
He doesn't have to. Intent is irrelevant, if the question is good it deserves an answer. That said it doesn't show prior research, and it looks like it belongs to Sec.SE more than it does here, so I'll be voting to close at this time. –  rath Feb 8 '14 at 15:50

Typical ways include

1. Dictionary attack
2. Common modifications of dictionary words
3. Concatenation of dictionary words
4. Brute force
-
How would that be done on the command line? –  Andrew Oct 1 '11 at 16:21
@Andrew: You quite likely don't want to input a dictionary from the command line. There might be cracking programs with dictionaries out there int the Internet, but this is off-topic here. –  Paŭlo Ebermann Oct 1 '11 at 17:36
@Andrew: It probably wouldn't be too hard to write your own command-line utility that takes a gpg file and a dictionary and tries all passwords. –  mikeazo Oct 2 '11 at 13:22

The OpenPGP standard (RFC 4880) defines in section 3.7 a number of String-to-Key (S2K) conversion functions, which are used for password-encrypted messages (i.e. ones without using a public key scheme), as well as for (the secret part) in private keyrings.

Most probably the Iterated and Salted S2K will be used. Its specification includes a hash function algorithm identifier, an 8-byte salt, and a count (encoded in a custom one-byte floating point format, a number between $16 ·2^{6} = 1024$ and $31·2^{21} = 65011712$).

To create the key from a passphrase, salt and passphrase will be alternatedly concatenated until a string of length count is reached (but at least once), and this will be hashed using the hash function. (If the output length of the hash is shorter than the needed key length, multiple such hashes are run, where the data is prefixed with one or more zero bytes.) Of course, the larger count is, the longer this takes (both for legitimate use as well for cracking).

The format of the private key rings itself is not documented there, though it is sensible to assume the format given in section 5.5.3.

Assuming the private key is encrypted (otherwise there would be nothing to crack), look at the S2K specifier byte to know which key derivation function is used, and also which salt (if any).

Now you take your dictionary of passwords (or passphrases, or program which generates candidates), and with each candidate password do this:

• Pass the password together with the salt to the key derivation function to get a key for the used encryption algorithm.
• This key you use with the encryption algorithm to decrypt the private key data.
• Look at the private key - is it a valid private key, and does it fit to the accompanying public key?
• If so, you won, you have the passphrase, and you have the private key. If not, repeat with the next password.

Mikeazo's answer includes some ideas on which passphrases to try.

If the passphrase is any good (and the key derivation algorithm is "Salted and Iterated" with an appropriate high count), you will need a long time for this.

Related to this, I found a description of an attack on signature keys stored in this format. It does not need to crack the encryption, but instead does modify the stored (encrypted) private key and then observes one message signed with the modified key.

This does not work on encryption keys (or actually, decryption), and as this attack was from 2001/2002, I suppose it is fixed until now. (I didn't do detailed research on this, comments are welcome.)

-