78 votes

Why does the FBI ask Apple for help to decrypt an iPhone?

I'll try to take a stab at this. From Apple's iOS Security Guide, we learn that The metadata of all files in the file system is encrypted with a random key, which is created when iOS is first ...
user avatar
74 votes

Password cracking: What if attacker is lucky?

"lucky" is not a property of the attacker. There's no "lucky" attacker nor "normal" attacker. They both have the same probability (low, very low) to guess the key. You can decrease the probability at ...
user avatar
56 votes
Accepted

How to check that you got the right key when brute forcing an encryption?

First, you do not break RSA through brute force. RSA is an asymmetric encryption algorithm, with a public/private key pair. The public key has a strong internal structure, and unravelling it yields ...
user avatar
42 votes

Password cracking: What if attacker is lucky?

Note: This answer assumes that by "lucky" OP meant "able to remove X% of valid answers", because I believe that was intent. Of course you can't measure luck ;) And if he is very lucky, say 90% ...
user avatar
  • 2,910
37 votes
Accepted

Why is OTP not vulnerable to brute-force attacks?

Brute force on OTP will give you all sorts of messages which are meaningful and not meaningful. For example, you have a 4-character encrypted text: weaw. Now brute-...
user avatar
28 votes
Accepted

How is encryption broken today?

Modern encryption can be broken in practice even when the algorithms are theoretically secure. There are a variety of ways this can happen: Side channel analysis could have played a part. The ...
user avatar
  • 19.2k
28 votes

Are longer passwords really safer against brute force attacks?

If we take two password strings of different length and attempt to bruteforce match them, it is obvious that the longer one will take longer to crack on average. Actually, that might be obvious to ...
user avatar
  • 131k
25 votes
Accepted

Password cracking: What if attacker is lucky?

So if at each bit he has a 50% chance, that means that 1 bit is actually only half bit. And if he is very lucky, say 90% chance, that means that 1 bit is actually only 0.1 bit.So in face of a very ...
user avatar
23 votes

How long would it take to brute force an AES-128 key?

I wrote a similar answer in the past, where the assumption was half the key is known. Since then, the bitcoin hashrate almost tripled (it's used in the estimation, as below). The estimation for half ...
user avatar
  • 12.3k
22 votes

Why is OTP not vulnerable to brute-force attacks?

What you are missing is the fact that every resulting message is equally possible. There is no way to verify that any of the resulting messages was indeed the message that was sent. If you have $...
user avatar
  • 84.5k
21 votes

How much would it cost in U.S. dollars to brute-force a 256-bit key in a year?

I don't think anyone has addressed the time issue. According to the Margolus-Levitin theorem the limit on the number of operations per second is $6\times10^{33}$ per Joule. The Sun's energy output ...
user avatar
19 votes
Accepted

Why does Birthday attack work only with random messages and not with chosen messages?

Birthday attacks do indeed work also for messages chosen by the attacker. For example, consider the case that I want to get a collision between a letter of recommendation and a letter that I was fired....
user avatar
19 votes

Are longer passwords really safer against brute force attacks?

There's a 2013 article in Ars Technica that refutes the notion that long passwords are necessarily hard to crack. It details how security researchers Kevin Young and Josh Dustin turned to text from ...
user avatar
17 votes

Why does the FBI ask Apple for help to decrypt an iPhone?

The encryption key isn't derived only from the passcode; it's also derived from a number of cryptographic keys etched directly into the CPU's silicon. These keys are impossible to read out in software—...
user avatar
17 votes

Does one time pad randomness help brute force attacks?

There is no such thing as a random key. There are only randomly generated keys. What I mean by that is that randomness is not a property of the key (or message, or number, or whatever), but of the ...
user avatar
16 votes

Why is OTP not vulnerable to brute-force attacks?

First you have to understand why it is possible to do exhaustive key searches on other systems. Suppose you have a plaintext of length n, ciphertext of the same ...
user avatar
15 votes
Accepted

Practical brute-force attack on 128 bit encryption

n is the exponent. So when n is doubled from 64 to 128 it doesn't mean that you have to try twice as many values. It means that ...
user avatar
  • 84.5k
15 votes

Password cracking: What if attacker is lucky?

I'm not sure what you're trying to understand and if the other answers cover it, so I'm trying a different approach and interpret your question like this: What if an attacker guesses the right ...
user avatar
14 votes

Brute-forcing Symmetric Keys

No, it doesn't help. It doesn't hurt either; as long as you don't repeat keys, the probability of success is always the same. That is, if there are $2^n$ possible keys, and you test $\lambda$ of ...
user avatar
  • 131k
14 votes
Accepted

Why do look up tables speed things up compared to brute force?

Suppose you have an $n$-bit key. Suppose further you have some reliable predicate $P(k,m)$ which decides whether a key $k$ is the key you are looking for given the reference $m$. Furthermore, suppose ...
user avatar
  • 44.6k
14 votes
Accepted

Security levels in NIST Post-quantum project: e.g. AES-128 vs SHA-256

This is due to the Brassard et al.'s method on hash functions. That has $\mathcal{O}(\sqrt[3]{n})$ attack time for n-bit hash function where as the Grover's method has $\mathcal{O}(\sqrt{n})$-time. ...
user avatar
  • 43k
13 votes

How Brittle Are LCG-Cracking Techniques?

This answer addresses Cases 1 and 2 from the question to provide a baseline, leaving Case 3 (which is the one I'm most interested in), unresolved. Case 1, Zero Increment In this case we'll consider ...
user avatar
  • 496
13 votes
Accepted

How many KDF rounds for an SSH key?

I did also tried to find a good value for the -a flag, in a MacBook Pro Mid14 (i7), trying to login in to a Debian 8.5, I had this results: ...
user avatar
  • 262
12 votes
Accepted

AES key reuse and guessing the key

You're missing a piece in your understanding of modern encryption. AES is a symmetrical block encryption cipher. It describes how to use a key (which can be 128, 192 or 256 bits) long to encrypt and ...
user avatar
  • 256
12 votes

How many KDF rounds for an SSH key?

Slower is better, as slow as you can tolerate. Timing for different -a values, each measured 20 times: ...
user avatar
  • 1,376
12 votes
Accepted

Why are asymmetric cryptography keys more vulnerable to brute force attack than symmetric ones?

For your first question: The main point here (at least that comes to mind) is that of how the key is made, used, and subsequently how it is attacked. Good symmetric ciphers are designed so that the ...
user avatar
  • 198
11 votes
Accepted

In the RSA DES challenges, how did the contestants know they had found the right key considering they weren't given any plaintext?

One can still access the challenge rules from the archive.org Each contest is based on a specified cipher. A brief piece of printable ASCII text (containing byte values in hexadecimal notation from ...
user avatar
  • 43k
10 votes

Breaking ZIP 2.0 encryption without password

I will start with all relevant references I found, then tentatively answers the question. Feel free to improve this community wiki. It was originally asked the effort to break PKZIP 2 encryption, ...
10 votes
Accepted

What is the difference between online and offline brute force attacks?

An offline attack require work from the attacker only (or mostly), with no (or little) communication with the system (e.g. server) under attack (holding the key). An online attack requires (typically ...
user avatar
  • 122k

Only top scored, non community-wiki answers of a minimum length are eligible