1
$\begingroup$

I'm looking for a type of asymmetric and symmetric encryption that I can crack fairly easily for a school project. I'm looking to compare the difference between asymmetric and symmetric encryption. I have a VPS with (I 8GB of RAM and an Intel Xeon if that helps.

Preferably it should take no more than 8-10 hours to crack.

$\endgroup$
  • $\begingroup$ ever heard of FEAL ? $\endgroup$ – Richie Frame Dec 4 '19 at 23:05
1
$\begingroup$

Assuming that the root source of secrecy is only an average password, then the choice of cipher does not matter so much. Especially if the key derivation step is not handled well.

Direct your computing power to:

  • Guess a password
  • Derive key material using the system parameters
  • Use that key to attempt decryption of the ciphertext
    • Authenticated encryption provides an oracle for verifying the key guess

Which system?

This seems like a nice candidate. It uses PBKDF2, which is better than nothing, but it isn't as resource intensive as bcrypt/scrypt/Argon2. It's implemented in python so it shouldn't be too hard to make any necessary modifications.

You can tune the iterations so that it is breakable with your given amount of computing power. As long as the target password isn't too complex, it should be feasible.

How to guess passwords?

There is plenty of software out there already. Some of it will even have nice features like organized word lists, including commonly used passwords and passwords from real breaches.

Depending on how handy you are as a programmer, it may or may not be easy to write your own basic password cracker.

$\endgroup$
  • $\begingroup$ why not classical ciphers, RSA with small modulus, DHKE with small modulus, A5/1, etc? The key can be created with good entropy source that no need to a password. $\endgroup$ – kelalaka Dec 4 '19 at 21:15
  • $\begingroup$ @kelalaka Instead of giving them a hoard of acronyms, I gave them a concrete implementation of a scheme that is very similar to those in common use. Why should any of those that you listed be the answer instead? At the end of the day they just have to choose one and it doesn't really matter what specific one they choose. $\endgroup$ – Ella Rose Dec 4 '19 at 21:30
  • $\begingroup$ AFAIK breaking encryption is not guessing the password, right? $\endgroup$ – kelalaka Dec 4 '19 at 21:33
  • $\begingroup$ @kelalaka Apparently it's perfectly suitable for their school project, as they accepted the answer. $\endgroup$ – Ella Rose Dec 4 '19 at 22:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.