How to brute force sqlcipher encrypted file with MD5 hash of a 7 bit key?

Question

I have a database file that is encrypted using sqlcipher and MD5 hash. Sqlcipher to my understanding provides 256 bit AES encryption. The key is 7 bits long. How do I brute force it?

Answer 1

As SEJPM already hinted at in his comment, a 7 bit key is short enough to allow a plain and simple brute-force attack because there are merely 128 different keys to be tested.

Hint: 7 bit = 1111111 = 127, + 1 for the 0000000 key = 128 possible keys.

Even when using a low-resource device, testing 128 different keys to find the correct one should be a pretty quick and easy task to handle.

If the key would be longer than that – for example: 7 bytes – the time to brute-force all keys would rise exponentially to the number of bits. Staying with the example: 7 bytes = 7 * 8 bits = 56 bits, which would mean that a plain brute-force attack would need to test up to a maximum of $2^{56}$ keys, boiling down to $7.2057594037927936e16$ (= 72,057,594,037,927,936) different passwords to check… which makes brute-forcing things rather infeasable compared to brute-forcing a simple 7 bit key.

For more information about brute-force attacks, you might want to check the Q&As listed under the brute-force-attack tag and/or read the related Wikipedia article.

How to…

Practically, you only need to create a list of all possible keys and try decrypting the ciphertext by going through that list one by one until the plaintext resembles/fits the decrypted file data you are expecting. (Since you haven’t mentioned what kind of file you are trying to decrypt, I assume you are able to compare a decryption result to see if the decrypted data indeed fits the expected plaintext.)

The steps are easy, no matter the programming or scripting language you use. In this case, you could even do this manually due to the fact that you’ld only need to test a maximum of 128 different keys:

• ciphertext $\rightarrow$ decrypt using key with 7-bit-value0000000 (hex: 0x00)
  Does decrypted data fit expected plaintext? If “yes”, you found the key. If “no”, test next key.

• ciphertext $\rightarrow$ decrypt using key with 7-bit-value0000001 (hex: 0x01)
  Does decrypted data fit expected plaintext? If “yes”, you found the key. If “no”, test next key.

• ciphertext $\rightarrow$ decrypt using key with 7-bit-value0000010 (hex: 0x02)
  Does decrypted data fit expected plaintext? If “yes”, you found the key. If “no”, test next key.

• …

• ciphertext $\rightarrow$ decrypt using key with 7-bit-value1111111 (hex: 0x7F)
  Does decrypted data fit expected plaintext? If “yes”, you found the key. If “no”, either the correct decryption key is not 7 bit, or you made a mistake when creating the testing keys (Ask yourself: Are you sure you’re feeding 7-bit keys and not something else?), or you have simply missed the correct key and decryption result while comparing the decryption result with the plaintext you expect. After all, this is the maximum key value a 7 bit key can have.

That’s all there is to it.

EDIT

As you’ve updated your question and added the info that the 7-bit key is hashed using MD5… be sure not to test a pure 7-bit key but MD5(potential-key) instead. Besides that, it does not influence the approach I’ve described above.

Pseudo-code:

for(i=0;i<128;i++)
{
    t = sqlcipherDecrypt(ciphertext, MD5(potential-7-bit-key[i]));
    if(verifyDecryptionResult(t) === TRUE)     
    {
        output("Found valid key:" + potential-7-bit-key[i]));
        exit;
    }
}

Where verifyDecryptionResult strongly depends on what file format you expect the plaintext to be. This function can bluntly be trying to open the decryption result with some program, or comparing the decryption result with already available plaintext, or alike functionality. Anything that helps you check if the decryption result fits what you’re looking for. Listing all options would be too broad, but this should help you grasp the general idea behind the pseudocode and how to brute-force things.