# Why does running AES more than one time guard against cracking?

According to the documentation(http://keepass.info/help/base/security.html), keepass runs the AES key transformation round more than once to increase security.

If cracking consists of trying random strings of characters until we find the "right" one, wouldn't running the key transformation over again just result in another "right" one being found with the same probability?

For example, if I protected a file with the password "dog", but the encrypted file was run twice through AES, wouldn't there be another solution to the second round which could be cracked by finding that one? My goal is to find "a" solution, and not necessarily "the" solution. Why is it the case that if something is run through 1 million rounds, that I can't just crack the last one?

• Depending on what exactly you mean, I have the feeling that the answer will be "yes, but the effort required would be $>2^{128}$" – SEJPM Dec 20 '16 at 20:11
• How would you know you succeeded? The result of encryption is indistinguishable from random - when implemented properly anyway. Of course, running encryption multiple times makes no sense if the password is not strong. – Maarten Bodewes Dec 21 '16 at 2:20

keepass runs the AES key transformation round more than once to increase security.

What KeePass calls "key transformation" is in reality PKDF (Password Key Derivation Function). This PKDF mostly relies on AES.

Why is it the case that if something is run through 1 million rounds, that I can't just crack the last one?

Why bother cracking last PKDF round when you can simply crack file encryption? Well, this would require about 2^255 tries to crack key which is used to encrypt database. Exactly same would happen when you would try to break last round of PKDF, except then verification if key is correct would take longer (because you would need to try to decrypt database).

Attacker usually doesn't go harder way. 2^255 is a lot of tries. But a lot of users don't have passwords that are that complex (if you think about it, most passwords don't exceed 2^40 in key strength). That is what attacker would try to break - your password which is far less than 256bit in strength. Then he would need to go for whole PKDF execution, which is designed to be slow. This in turn makes attack against password harder, but still more practical than trying to break AES-256.

So you can crack last PKDF key, except that nobody on this planet had yet managed to break 80bit key, let alone 256bit key. The weak point is user password, which is shorter and of lower entropy than key - this is where attack is most likely to succeed, assuming AES won't get broken.