9
$\begingroup$

This is an example of a bitlocker recovery key;

820042-335825-646573-481530-265253-688132-339900-822810

İs that key actually strong? It does not have any letters, it uses only numbers, so is it OK?

Improve this question
$\endgroup$

2 Answers 2

Reset to default
12
$\begingroup$

Based on official doc here, unofficial doc there, and confirmed by some experiments:

  • A valid Bitlocker recovery key consists of eight exactly 6-digit decimal numbers separated by seven hyphens (-) or space ( ) signs. Each such number is of the form $11\times k$ with $k\in[0,2^{16})$, thus in $[000000,720885]$. Hence the question's example is not a valid Bitlocker recovery key: the first and last 6-digit numbers are out of range, and only the but-last is a multiple of 11.
  • A valid Bitlocker recovery key thus has (at most) 8×16=128 bits of entropy.
  • It gets slightly stretched, with on-disk salt, by an iterated (not memory-hard) SHA-256 hash with $2^{20}$ loops.

So that if a Bitlocker recovery key is competently and honestly generated (I have no idea), it's like 148-bit strong, which is expected to be very secure for some decades (save for Cryptographically Relevant Quantum Computers, which are quite hypothetical).

Note: When there is a Bitlocker recovery key (which is optional), the AES 256-bit Volume Master Key gets encrypted under that 148-bit strong stretched Bitlocker recovery key, and stored, theoretically reducing the strength of the overall encryption.

Improve this answer
$\endgroup$
5
  • 1
    $\begingroup$ Alright, your Google fu is also strong :P $\endgroup$
    – Maarten Bodewes ♦
    Dec 20, 2022 at 18:31
  • $\begingroup$ yes it's not an actual bitlocker key, i used a pass. generator using only 48 digits and divided it with ''-'' by myself. thanks for the answer. $\endgroup$
    – asd
    Dec 20, 2022 at 18:37
  • 2
    $\begingroup$ If you had to generate a valid key yourself you could just generate 128 bits, split that up into 16 bits, using the unsigned value of each and then multiply that number with 11, printing out the decimal digits, left-padding with zeros where required. I.e. you'd start with the key and then encode it. Of course, it makes much more sense to use the Microsoft environment for the generation. $\endgroup$
    – Maarten Bodewes ♦
    Dec 20, 2022 at 18:43
  • 1
    $\begingroup$ Note the recovery password is optional, it can be added or removed. So Bitlocker is not inherently limited to 148-bit security, just the default setup is. $\endgroup$
    – user71659
    Dec 21, 2022 at 20:25
  • 1
    $\begingroup$ @user71659: Thanks for the correction. I edited the note to reflect that. $\endgroup$
    – fgrieu ♦
    Dec 21, 2022 at 20:46
7
$\begingroup$

I've found this at this GitHub page that tries to specify the Bitlocker format from Microsoft:

A valid recovery password consists of 48 digits where every number is dividable by 11 with a remainder of 0. The result of a division by 11 of a number is a 16-bit value. The individual 16-bit values make up a 128-bit key.

This means that there is some error detection mechanism - this shows the importance of looking at the defined format rather than just a sample key.

If the digits and thus numbers would be fully random - which they are not - then they would be able to encode a $log_2(10^{48}) \approx 159$ bit key. So clearly the size of the password / key makes up for the small amount of possibilities per character. Both the calculated 159 bit and the indicated / correct answer of 128 bit strength are much stronger than a human generated password which averages about 42 bits or so if I remember correctly; such a password could be brute forced.

128 bit symmetric keys - which I assume is used here (apparently after a key stretching algorithm - see the other answer , which is not really needed for this kind of key strength) - are considered strong. They may not be fully protected against a pretty large quantum computer. We currently don't know if quantum computers can scale to that size; currently they are definitely not around, but you could store encrypted information until one becomes available, if ever. Normally Bitlocker uses AES as a block cipher.

Improve this answer
$\endgroup$
3
  • $\begingroup$ Dang, that info was not easy to find. I was somewhat afraid that I would be beaten by sombody posting 159 bit strength as an answer. $\endgroup$
    – Maarten Bodewes ♦
    Dec 20, 2022 at 18:25
  • $\begingroup$ thx a lot for the answer! so it's pretty strong to use a 48 digits only generated password like that one, right? for any of my online account? $\endgroup$
    – asd
    Dec 20, 2022 at 18:39
  • $\begingroup$ If you have to rely on something you have to store in text then it is pretty secure for that. Using devices with additional protection may be even more secure. That later point is more about how the password is stored / accessed than the key strength though; the key strength is fine for most purposes. I'd only be worried if you would store long term or state level secrets with regards to the strength in bits. $\endgroup$
    – Maarten Bodewes ♦
    Dec 20, 2022 at 18:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.