2
$\begingroup$

Doing malware research (simple crypto locker) I found out that it uses AES-128 with weak key - every one of the sixteen bytes is represented by (a-z,A-Z,0-9). Thus simple brute-force attack should iterate through $62^{16}$, that is approximately $2^{96}$ keys. I have a file before encryption and after.

Is it feasible in modern world to brute-force it to find a key with a budget of $3-4k?

$\endgroup$
  • $\begingroup$ Can you post the asm code or pseudocode for the key generation? $\endgroup$ – jonasl Sep 22 '14 at 6:21
  • 1
    $\begingroup$ Note that the term "weak key" also has a different meaning in the cryptographic world. It may also refer to a key that is inherently weak for the specific algorithm. This key is not; it's just badly defined/generated. $\endgroup$ – Maarten Bodewes Sep 22 '14 at 14:06
2
$\begingroup$

No, it's not.

Here, Bruce Schneier estimates the cost of finding a SHA-1 collision. He estimates that this would require approximately 274 CPU cycles and cost about \$700 thousand in 2015. Trying 296 AES keys would require approximately 2100 CPU cycles and cost about \$50 trillion.

$\endgroup$
  • $\begingroup$ Although I am pretty sure that the calculations are approx. in the right ballpark - i.e. not feasible - , it may be a bit tricky for readers to jump from SHA-1 collisions to AES key brute forcing. $\endgroup$ – Maarten Bodewes Sep 22 '14 at 14:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.