4
$\begingroup$

So I was wondering about some alternative attack scenario which I thought of when I started to understand KDF's . So lets say you have a cipher like AES and a strong KDF . And the legit user uses a 30 character strong Password :

30-char Pass ---> KDF ( slow stuff : argon2,scrypt ) ----> AES256

And normally the attacker would have to start at the beginning with brute force and then passing through the KDF which slowes him down very much and then finally checking if the final bit string is accepted by AES to decrypt the ciphertext .

But I the attacker knows that the legit user uses a very strong Pasword and a decent KDF , would it not be more efficient to just bypass the KDF and brute force the AES bits directly ( takes longer , but much less slowdown ) like :

wordlist ---> Some random 256 hash ( sha256 ) -----> AES256

With that method the attacker could brutefoce every possible AES key and the length would not even matter . But It would be very difficult because of all the possibilities .

How likely is such a Scenario ? And is it even worth doing so ?

|improve this question|||||
$\endgroup$
6
$\begingroup$

Let's assume a password consisting of 15 random longish words from several books. It's likely then that the password's entropy will exceed 256 bits. (This is actually very difficult to compute accurately as there are linguistic /social /physiological issues to human password creation, but let's skip over those). That's more than that of an AES-256 key. So in this case it seems that it's worthwhile attacking the AES key directly as it's got less entropy.

This would be a brute force attack directly against an AES-256 key. The futility of this is well covered on this site. I'll just add this link and say that you'd need more than all of the batteries on Earth for the energy demand. And a lot of time measured in age of Universe units. It's impossible and really not worth doing.

It also opens up the question of what would KDFs be for if you simply bypassed them and attacked the cipher key directly?

|improve this answer|||||
$\endgroup$
2
$\begingroup$

To give a very short answer:

No, brute forcing an AES key is completely unfeasible.

|improve this answer|||||
$\endgroup$
  • $\begingroup$ … at the time of writing this. (After all, we don't know how the future evolves the next decades.) $\endgroup$ – e-sushi Aug 5 '17 at 21:51
  • $\begingroup$ @e-sushi: There are fundamental physical limits that imply that brute-forcing a 256-bit key using classical computers isn't going to happen on this planet. If quantum computing really took off, so that quantum processors became as fast and energy-efficient as classical processors, that would effectively make brute-forcing a 256-bit key on a quantum computer as fast as brute-forcing a 128-bit key on a classical computer, which might make it almost doable in the foreseeable future. Not holding my breath for that, though. $\endgroup$ – Ilmari Karonen Aug 6 '17 at 10:26
  • $\begingroup$ @IlmariKaronen I'm well aware of that. I was hinting at the “attacks only get better” part of the story. ;) Now, I'm not saying we currently know of something that might break AES (beyond brute forcing), but we don't know how the future evolves the next decades and new weaknesses might be discovered. It happens frequently in modern crypto and I doubt AES is an exception to that rule. But I'm thinking in decades here, while keeping quantum computers out of my perspective until something pratical emerges in those realms. TL;DR All I'm saying is we shouldn't imply “AES will be safe forever”. $\endgroup$ – e-sushi Aug 6 '17 at 15:43
  • $\begingroup$ @e-sushi But we do know that brute forcing an AES key will likely never be possible. Note that this answer specifies brute force, not cryptoanalytic attacks which may very well come be. $\endgroup$ – forest Jan 14 '19 at 3:31
2
$\begingroup$

I see your point, but the fact remains that it's never worth it to brute force a 256 bit key. See this answer and this one.

If the passphrase was so long and complex and/or if the KDF imposed such a cost that guessing it was impossible, a smart attacker would look for an alternative means of getting it, such as placing a keylogger on the target's machine, placing a hidden camera in his house/office, extortion, or torture.

|improve this answer|||||
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.