How Do Brute-Force Attackers Know They Found The Key?

Brute force attackers guess passwords, passphrases, and private keys in an attempt to eventually get the right answer and crack the security of a system, but how do they know when they have the right key?

It depends on the system.

Let’s answer the question three times, once for three different common systems.

Cipher Text With Authentication

In this case, let’s assume we have direct access to an encrypted hard drive (like that of a MacBook) that has been ciphered using AES-256-GCM. Because we have access to the raw encrypted data, we can’t be locked out for too many failed attempts. 😈

Since we are free to guess as hard and as fast as we can, all we need to know is when to stop deciphering. This is easy if the encryption was done using an authentication tag as required by GCM mode. When we get the correct password, the authentication tag will check out.

Web Application

Brute forcing your way through the front door of a web application will prove difficult if not impossible. Because the cryptosystem lives on a server you don’t have control over, they can lock you out after a number of failed guesses.

However, if the server doesn’t have these kinds of protections in place, then it is easy to tell when you have the right password because you will likely be given an HTTP 200 response OK, and perhaps some form of login token.

Public-Private Key Encryption

Symmetric Cipher vs Asymmetric Public Key Encryption

We have data that was encrypted using a private key, and we can decrypt it using the public key that was given to us. Our goal is to find the private key that corresponds to this public key so that we can then trick other users into thinking we are the original owner of the private key.

Ignoring the fact that it is practically impossible to brute force a 256-bit key, let’s pretend that we have an infinite amount of resources and are able to eventually get the correct answer.

How do we know when we have the right answer?

Well, it depends a bit on the algorithm that was used to create the key pair. If we know the algorithm and its parameters, then we can just generate public keys from the randomly generated private keys and see if the public key we already have matches.

If this isn’t reasonable because we don’t have all the algorithm information, then we are likely stuck with encrypting a random string of text with our generated private keys, then trying to decrypt with the public key we have.

Again, this would never work in practicality, the search space is 2^256

Brute-Force Attacks Explained

A brute-force attack in cryptography is when an attacker guesses many passwords in succession hoping to eventually get one right.

For example, the most naive form of brute force attack would be to try every permutation of characters from length 0 to length n.

a, b, c …

aa, ab, ac, … ba, bb, bc

aaa, aab, aac, … aba, abb, abc… bba, bbb, bbc…

Assuming 26 lowercase letters, 26 uppercase letters, 10 digits, and 10 special characters, it would take 66^10 (~1560000000000000000) guesses just to try all the combinations of exactly length 10. Assuming a modest 200 guesses per second, it would take ~247,336,377 years to crack the password.

So I’m Safe Right?

Based on the math above, it certainly seems like 10 digit passwords are impervious to brute force attacks. While that may be true of the most naive attacks, there are other things to watch out for.

Instead of the attacker guess every single combination, instead, they may try every word in the English dictionary, with every three-digit combination appended to the end.

  • apple001, apple002, apple003…

  • baby001, baby002, baby003…

Assuming 50,000 words in the English dictionary, there are only 50,000,000 combinations! Again, assuming 200 guesses per second, it would take ~2.9 days to crack the password… that isn’t very long. It is also trivial for the attacker to throw in special characters for corresponding letters. For example, “@pp1e001“

The post How Do Brute-Force Attackers Know They Found The Key? appeared first on Qvault.



source https://qvault.io/2020/02/11/how-do-brute-force-attackers-know-they-found-the-key/?utm_source=rss&utm_medium=rss&utm_campaign=how-do-brute-force-attackers-know-they-found-the-key

Comments

Post a Comment

Popular posts from this blog

Why is Exclusive Or (XOR) Important in Cryptography?

Image
If you are getting into cryptography, or just trying to understand the fundamentals, you may have noticed that the exclusive-or operation is used quite often, especially in ciphers. What is XOR ( ⊕ )? XOR, or “exclusive or” operates on binary data. It returns true if both of its inputs are opposites (one false and one true), otherwise, it returns false. An example in go code would be something like: func exclusiveOr(a bool, b bool) bool { return a != b } XOR Cipher – The Perfect Cipher The XOR operation can be used as a simple cipher for encrypting and decrypting messages with a single key. This is known as symmetric encryption. It is interesting to note that if: The key is the same size as the message The key is kept secret and generated truly randomly Then the cipher is impossible to crack. This is known as a one time pad . However, a simple XOR shouldn’t be used in production due to the key length needing to be too long to be practical. Cipher Example A...
Read more

Base64 vs Base58 Encoding

Image
By Lane Wagner –  @wagslane  on Twitter Base64 is one of the most popular encoding formats for representing data. Have some binary data? Base64 encode it for convenient readability and parsing. Base58 is just another encoding format (with 58 characters instead of 64, and has gained popularity largely due to Bitcoin and other cryptocurrencies. When it comes to data encoding, there is typically a trade-off made between: Human Readability: Do humans have a good idea of what is being represented at a glance? Efficient data compression: How many bytes are used to represent the same data? Let’s rank Base58, Base64, and ASCII encoding against each other using these metrics! First: A Note on Binary All data is stored in a raw binary format on computers. These encoding formats (Base64, Base58, and ASCII) are just different ways of reading and writing binary data. For example, in Base64 the binary code 000000 represents the letter A , but in ASCII the binary 00000000 repres...
Read more

(Very) Basic Intro to Hash Functions (SHA-256, MD-5, etc)

Image
This is going to be a basic introduction to hash functions. I will assume most of my audience is here to gain an understanding of why hash functions are used and the basic idea of why they work. My goal is to explain it in a general sense, I will be omitting proofs and implementation details and instead focusing on the high-level principles. Why Use A Hash Function? Hash functions are used all over the internet in order to securely store passwords, find duplicate records, quickly store and retrieve data, and more. For example,  Qvault  uses hashes to extend master passwords into private encryption keys. A longer list of uses here:  https://en.wikipedia.org/wiki/Hash_function#Uses I want to focus on several important features of hash functions, arguably the most important features. Hash functions scramble data deterministically No matter the input, the output of a hash function always has the same size The original data can not be retrieved from the scrambled d...
Read more