0
$\begingroup$

If I am encrypting a file with GCM/AES256 with a weak key (say a sha256), does the fact that it takes time to brute force a long message improve my security?

Example: I use the sha256 of "ARainyDay" to encrypt a 1kB file.

To brute-force it, one must still try and decode my file 5429503678976 times (26^9).

Even considering 1ms/try, it still takes 62841 days. That makes my key more secure then?

$\endgroup$
  • 2
    $\begingroup$ Passwords must not be encrypted. See How to securely hash passwords? from information security. $\endgroup$ – kelalaka Apr 29 at 16:59
  • 1
    $\begingroup$ 9 case-insensitive letters chosen randomly would be 26^9, but those clearly aren't random. 9 letters forming valid words, especially in a grammatically valid sequence, have hugely fewer possibilities; Shannon found less than 2 bits entropy per character in English text, which means 9 letters is less than a million possibilities and takes maybe a few seconds to brute-force. $\endgroup$ – dave_thompson_085 Apr 30 at 8:26
  • $\begingroup$ dave thompson: very good point, thanks! $\endgroup$ – Piero dS Apr 30 at 13:06
2
$\begingroup$

No, it doesn't make weak passwords magically stronger. If they know part of the file (e.g. the header), or even is just able to recognize it, what they can do is, for each plausible password, just decrypt that small area of the file (and ignore everything else), and see if the decryption of that area is plausible. Once the password guess passes that check, they can then do a full decryption and see if everything checks out.

To make brute forcing a weak password more difficult, I would suggest a strong (expensive) password hashing method, such as Argon2.

BTW: the estimated time of 1 msec to decrypt a 1kbyte GCM-encrypted file is far too large; I would expect that an adversary might be able to do it in perhaps within a few microseconds...

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.