1
$\begingroup$

As some password manager, such as KeyPassXC allows a user to create a master password using a HMAC response from a YubiKey concatenated with a password entered by user, I was wondering something.

Assuming that:

*The encryption key is created with PBKDF2 HMAC-SHA256 from the YubiKey HMAC result and a user-provided input"

*With 150,000 iterations

*The HMAC response has 160 bits of entropy

*The user-provided response has 40 bits of entropy

If an attacker acquired the YubiKey and now knows the first 160 bit of the master password, could they crack the remaining 40 bit using brute force? And if yes, would one need to concatenate the 2 secrets randomily in order to combat this?

Improve this question
$\endgroup$
0

1 Answer 1

Reset to default
2
$\begingroup$

The other answer mentions $n!$ which is strange. The answer has nothing to do with factorials.

You can brute force 40 bits in $2^{40}$ attempts. And $2^{40}$ is feasible today, no need to be a government agency.

For example, https://crack.sh/ (which may be slightly dated) states that using FPGAs, they can brute force DES keys which takes $2^{56}$ attempts in the worst case in 9.2 days. Divide that by $2^{16}\approx 65,000$ and you get $9.2 \times 24 \times 60 / 65,000 \approx 0.2$ minutes.

They say their system is equivalent to 1800 GPUs, so if you had 10 GPUs, you could brute force this hash in $180 \times 0.2 = 36$ minutes.

Improve this answer
$\endgroup$
3
  • 1
    $\begingroup$ With the key stretching from PBKDF2 (and keeping in mind that HMAC hashes the input twice), that's about $2^{58}$ SHA-256 evaluations. Thay should still be doable with sufficient resources, though. $\endgroup$
    – Ilmari Karonen
    Commented Aug 20, 2022 at 8:23
  • 1
    $\begingroup$ @Ilmari Karonen: that's assuming the 40 bits of entropy are input to PBKDF2. But "an attacker acquired the YubiKey and (thus) now knows the first 160 bit of the master password" combined with "master password is generated with PBKDF2-HMACSHA-256" does not support that. I think the question can't be answered as is. $\endgroup$
    – fgrieu ♦
    Commented Aug 20, 2022 at 10:14
  • 1
    $\begingroup$ @fgrieu what I mean is, the attacker knows what the 160 bit HMAC is, which is used in the master password. And yea you're right, I meant the encryption key is created with PBKDF2 HMAC-SHA256. My bad. $\endgroup$
    – romes
    Commented Aug 20, 2022 at 13:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.