3 ms·

So, for the layman, does this mean, the encryption can be practically cracked or not?

by _ph_ 10y ago

lima 10y ago
No. He just made a brute forcing tool.
Tuna-Fish 10y ago
If you almost know the right passphrase, it can be. If you don't, and the passphrase is good, it can't.
- _ph_ 10y ago
  Thats, that is reassuring :). Would have been a good addition to that article. Of course, if you are lacking just a few letters in the password, brute forcing gets much more applicable.
- mistercow 10y ago
  To be clear, it's if you know more or less the right passphrase. This is why your passphrase should be randomly generated. Word based passwords are still fine (for memorability, a la xkcd), but you need real entropy that can't be guessed. For example, if you choose your daughter's middle name your favorite animal, and the street you grew up on, then you have a small amount of entropy, and you'll be screwed in an offline attack scenario like this. The attacker can narrow it down to combinations of words and numbers related to you, and the brute force becomes feasible. If you use four randomly chosen words from a dictionary of 2000 words, then cracking it is roughly equivalent to cracking 13 random digits. Side note: cycling through multiple random pass-phrases of this type until you find something memorable has difficult-to-analyze negative effects on the final entropy. Ideally, you should be using the first output it gives you.
- bigiain 10y ago
  Yeah - this solves the "I know I used 'correct horse battery staple', but can't remember if it was correct-horse-battery-staple or correct_horse_battery_staple or c0rrect+h0rse+battery+staple or c0rr3cth0r53b4tt3ryst4pl3 or whatever... None of this would have helped if he wasn't sure exactly which error he'd made with a password like %)]5ZJ'HDb]n.'Y&4P-dMZMvS
ww520 10y ago
He probably just misremembered a few characters of his password, like mypass1234, mypass1235, mypass4321, etc. It would be time consuming for human to try all the 4 digits but trivial for computer to try out the 9999 enumeration. The complication is finding out the algorithm used and the parameters applied to the algorithm. Once figured out, he wrote the small program to brute force the small enumeration. This is a very good illustration of the need for long and non-trivial password; otherwise, it can be easily guessed.

So, for the layman, does this mean, the encryption can be practically cracked or not?

by _ph_ 10y ago

So, for the layman, does this mean, the encryption can be practically cracked or not?

lima 10y ago

No. He just made a brute forcing tool.

Tuna-Fish 10y ago

If you almost know the right passphrase, it can be. If you don't, and the passphrase is good, it can't.

_ph_ 10y ago
Thats, that is reassuring :). Would have been a good addition to that article. Of course, if you are lacking just a few letters in the password, brute forcing gets much more applicable.
mistercow 10y ago
To be clear, it's if you know more or less the right passphrase. This is why your passphrase should be randomly generated. Word based passwords are still fine (for memorability, a la xkcd), but you need real entropy that can't be guessed. For example, if you choose your daughter's middle name your favorite animal, and the street you grew up on, then you have a small amount of entropy, and you'll be screwed in an offline attack scenario like this. The attacker can narrow it down to combinations of words and numbers related to you, and the brute force becomes feasible. If you use four randomly chosen words from a dictionary of 2000 words, then cracking it is roughly equivalent to cracking 13 random digits. Side note: cycling through multiple random pass-phrases of this type until you find something memorable has difficult-to-analyze negative effects on the final entropy. Ideally, you should be using the first output it gives you.
bigiain 10y ago
Yeah - this solves the "I know I used 'correct horse battery staple', but can't remember if it was correct-horse-battery-staple or correct_horse_battery_staple or c0rrect+h0rse+battery+staple or c0rr3cth0r53b4tt3ryst4pl3 or whatever... None of this would have helped if he wasn't sure exactly which error he'd made with a password like %)]5ZJ'HDb]n.'Y&4P-dMZMvS

ww520 10y ago

He probably just misremembered a few characters of his password, like mypass1234, mypass1235, mypass4321, etc. It would be time consuming for human to try all the 4 digits but trivial for computer to try out the 9999 enumeration. The complication is finding out the algorithm used and the parameters applied to the algorithm. Once figured out, he wrote the small program to brute force the small enumeration. This is a very good illustration of the need for long and non-trivial password; otherwise, it can be easily guessed.