# Tag Info

## Hot answers tagged brute-force-attack

78 votes

### Why does the FBI ask Apple for help to decrypt an iPhone?

I'll try to take a stab at this. From Apple's iOS Security Guide, we learn that The metadata of all files in the file system is encrypted with a random key, which is created when iOS is first ...
74 votes

### Password cracking: What if attacker is lucky?

"lucky" is not a property of the attacker. There's no "lucky" attacker nor "normal" attacker. They both have the same probability (low, very low) to guess the key. You can decrease the probability at ...
56 votes
Accepted

### How to check that you got the right key when brute forcing an encryption?

First, you do not break RSA through brute force. RSA is an asymmetric encryption algorithm, with a public/private key pair. The public key has a strong internal structure, and unravelling it yields ...
• 84.5k
42 votes

### Password cracking: What if attacker is lucky?

Note: This answer assumes that by "lucky" OP meant "able to remove X% of valid answers", because I believe that was intent. Of course you can't measure luck ;) And if he is very lucky, say 90% ...
• 2,910
37 votes
Accepted

### Why is OTP not vulnerable to brute-force attacks?

Brute force on OTP will give you all sorts of messages which are meaningful and not meaningful. For example, you have a 4-character encrypted text: weaw. Now brute-...
• 486
28 votes
Accepted

### How is encryption broken today?

Modern encryption can be broken in practice even when the algorithms are theoretically secure. There are a variety of ways this can happen: Side channel analysis could have played a part. The ...
• 19.2k
28 votes

### Are longer passwords really safer against brute force attacks?

If we take two password strings of different length and attempt to bruteforce match them, it is obvious that the longer one will take longer to crack on average. Actually, that might be obvious to ...
• 131k
25 votes
Accepted

### Password cracking: What if attacker is lucky?

So if at each bit he has a 50% chance, that means that 1 bit is actually only half bit. And if he is very lucky, say 90% chance, that means that 1 bit is actually only 0.1 bit.So in face of a very ...
• 374
23 votes

### How long would it take to brute force an AES-128 key?

I wrote a similar answer in the past, where the assumption was half the key is known. Since then, the bitcoin hashrate almost tripled (it's used in the estimation, as below). The estimation for half ...
• 12.3k
22 votes

• 43k
13 votes

### How Brittle Are LCG-Cracking Techniques?

This answer addresses Cases 1 and 2 from the question to provide a baseline, leaving Case 3 (which is the one I'm most interested in), unresolved. Case 1, Zero Increment In this case we'll consider ...
• 496
13 votes
Accepted

### How many KDF rounds for an SSH key?

I did also tried to find a good value for the -a flag, in a MacBook Pro Mid14 (i7), trying to login in to a Debian 8.5, I had this results: ...
• 262
12 votes
Accepted

### AES key reuse and guessing the key

You're missing a piece in your understanding of modern encryption. AES is a symmetrical block encryption cipher. It describes how to use a key (which can be 128, 192 or 256 bits) long to encrypt and ...
• 256
12 votes

### How many KDF rounds for an SSH key?

Slower is better, as slow as you can tolerate. Timing for different -a values, each measured 20 times: ...
• 1,376
12 votes
Accepted

### Why are asymmetric cryptography keys more vulnerable to brute force attack than symmetric ones?

For your first question: The main point here (at least that comes to mind) is that of how the key is made, used, and subsequently how it is attacked. Good symmetric ciphers are designed so that the ...
• 198
11 votes
Accepted

### In the RSA DES challenges, how did the contestants know they had found the right key considering they weren't given any plaintext?

One can still access the challenge rules from the archive.org Each contest is based on a specified cipher. A brief piece of printable ASCII text (containing byte values in hexadecimal notation from ...
• 43k
10 votes

### Breaking ZIP 2.0 encryption without password

I will start with all relevant references I found, then tentatively answers the question. Feel free to improve this community wiki. It was originally asked the effort to break PKZIP 2 encryption, ...
10 votes
Accepted

### What is the difference between online and offline brute force attacks?

An offline attack require work from the attacker only (or mostly), with no (or little) communication with the system (e.g. server) under attack (holding the key). An online attack requires (typically ...
• 122k

Only top scored, non community-wiki answers of a minimum length are eligible