Page 2 of 3 FirstFirst 123 LastLast
Results 11 to 20 of 25

Thread: Brute Force AES/Truecrypt with a simple password

  1. #11
    Super Moderator lupin's Avatar
    Join Date
    Jan 2010
    Posts
    2,943

    Default

    Quote Originally Posted by vvpalin View Post
    of course ... and anyone that knows anything about security should know that ... or atleast i hope so
    You should meet some of the people I deal with each day

    Some of them have ridiculous levels of faith in anything that's meant to provide "security", and when combined with a general lack of understanding about how that thing actually works its a bit of a problem.

    Quote Originally Posted by vvpalin View Post
    Also if memory serves me there is some sort of way it prevents a bruteforce the way you suggest. "i could be wrong"
    I haven't used any of them myself, but a few of the programs I linked above appear to work by adding a front end to TrueCrypt.

    Its common practice when coding an encryption product that uses passwords to introduce delay into the password validation process - delay of a balanced value that wont be noticed by a legitimate user typing their password in, but that will inconvenience someone trying to gain the password by brute force. TrueCrypt may do this, which could affect efficiency of those front end crackers. The AccessData tools access the file directly I believe, so they may not be affected. There's a very brief reference to the AccessData tools here. The AccessData DNA tool is also capable of conducting a distributed attack on TrueCrypt.

    TrueCrypt is a good product - cross platform, relatively secure and easy to use. I use it both at home and at work.
    Capitalisation is important. It's the difference between "Helping your brother Jack off a horse" and "Helping your brother jack off a horse".

    The Forum Rules, Forum FAQ and the BackTrack Wiki... learn them, love them, live them.

  2. #12
    Super Moderator Archangel-Amael's Avatar
    Join Date
    Jan 2010
    Location
    Somewhere
    Posts
    8,012

    Default

    Quote Originally Posted by lupin View Post
    I The AccessData tools access the file directly I believe, so they may not be affected. There's a very brief reference to the AccessData tools here. The AccessData DNA tool is also capable of conducting a distributed attack on TrueCrypt.

    I don't believe that the access data tool dna is capable of more then bruting 40-bit RC2/RC4 keys.
    I don't believe it will do anything for an AES encrypted block since the minimum block size it 128 bits.
    The access data website also fails to mention support for anything that is AES capable.

    A better approach as of now for messing with AES would be a side channel attack. Take a look at Bruce Schneier for more info.

    I would highly recommend the book Secrets and Lies by the above if you ever get the chance.
    To be successful here you should read all of the following.
    ForumRules
    ForumFAQ
    If you are new to Back|Track
    Back|Track Wiki
    Failure to do so will probably get your threads deleted or worse.

  3. #13
    Super Moderator lupin's Avatar
    Join Date
    Jan 2010
    Posts
    2,943

    Default

    Quote Originally Posted by archangel.amael View Post
    I don't believe that the access data tool dna is capable of more then bruting 40-bit RC2/RC4 keys.
    I don't believe it will do anything for an AES encrypted block since the minimum block size it 128 bits.
    The access data website also fails to mention support for anything that is AES capable.

    A better approach as of now for messing with AES would be a side channel attack. Take a look at Bruce Schneier for more info.

    I would highly recommend the book Secrets and Lies by the above if you ever get the chance.
    Yes, I noticed that the Access Data website doesn't even mention TrueCrypt volumes - the only reference I had for it was one of those other links I posted in my first post to this thread, plus the link in the post above.

    Have a copy of "Secrets and Lies" which I got shortly after it was released, and have also got a copy of "Beyond Fear" which I would also highly recommend. I also read Bruce's blog daily. Bruce is the man, as evidenced by some of these facts.
    Capitalisation is important. It's the difference between "Helping your brother Jack off a horse" and "Helping your brother jack off a horse".

    The Forum Rules, Forum FAQ and the BackTrack Wiki... learn them, love them, live them.

  4. #14
    Super Moderator Archangel-Amael's Avatar
    Join Date
    Jan 2010
    Location
    Somewhere
    Posts
    8,012

    Default

    Yeah I like the facts too especially number 78
    Bruce Schneier cuts meat in prime number lengths.
    To be successful here you should read all of the following.
    ForumRules
    ForumFAQ
    If you are new to Back|Track
    Back|Track Wiki
    Failure to do so will probably get your threads deleted or worse.

  5. #15
    Member imported_vvpalin's Avatar
    Join Date
    Apr 2009
    Posts
    442

    Default

    Quote Originally Posted by lupin View Post

    Its common practice when coding an encryption product that uses passwords to introduce delay into the password validation process - delay of a balanced value that wont be noticed by a legitimate user typing their password in, but that will inconvenience someone trying to gain the password by brute force. .

    .
    I have never heard of that ... so thank you

    I would say i learned something new today however since ive been coming here ive been learning about 100 new things each day.

  6. #16
    Just burned his ISO
    Join Date
    Jul 2007
    Posts
    19

    Default Wow

    Thanks for all the info everyone. As far as travel goes I do use Truecrypt on my laptop, the whole drive is encrypted (I had one stolen). I was just wondering about small containers as for brute force trial and error for myself. And that brute container that you pointed me to worked fine once I made a passlist of the characters my password contained. Was a little slow but it worked.

    Here's another question I have been pondering, Is it better to have a insane password, 40 characters or more or to have a fairly strong password and have either a key file or a hidden container to go along with it? From what I understand on the TC documentation is that If you access a hidden container in certain ways it will leave a log in the file system that can shatter your plausible deniability.

  7. #17
    Super Moderator lupin's Avatar
    Join Date
    Jan 2010
    Posts
    2,943

    Default

    Quote Originally Posted by JohnMa69 View Post
    Thanks for all the info everyone. As far as travel goes I do use Truecrypt on my laptop, the whole drive is encrypted (I had one stolen). I was just wondering about small containers as for brute force trial and error for myself. And that brute container that you pointed me to worked fine once I made a passlist of the characters my password contained. Was a little slow but it worked.

    Here's another question I have been pondering, Is it better to have a insane password, 40 characters or more or to have a fairly strong password and have either a key file or a hidden container to go along with it? From what I understand on the TC documentation is that If you access a hidden container in certain ways it will leave a log in the file system that can shatter your plausible deniability.
    Depends on who you're trying to hide your information from really. The main benefit of the hidden volume feature is that it protects against someone coercing you out of your password. If that concerns you, then use that feature, but otherwise I probably wouldn't, as it has some additional usability constraints.

    If you're not worried about coercion, a long complicated password with multiple keyfiles scattered in various locations will probably be your best bet.

    If you give some thought as to how your adversary might go about accessing your TrueCrypt containers, it will probably help you to make a better decision about this. I can mention some specific attack techniques if that will help...
    Capitalisation is important. It's the difference between "Helping your brother Jack off a horse" and "Helping your brother jack off a horse".

    The Forum Rules, Forum FAQ and the BackTrack Wiki... learn them, love them, live them.

  8. #18
    Member imported_vvpalin's Avatar
    Join Date
    Apr 2009
    Posts
    442

    Default

    Quote Originally Posted by JohnMa69 View Post
    Here's another question I have been pondering, Is it better to have a insane password, 40 characters or more or to have a fairly strong password and have either a key file or a hidden container to go along with it? From what I understand on the TC documentation is that If you access a hidden container in certain ways it will leave a log in the file system that can shatter your plausible deniability.
    Thats why you make a hidden operating system.

    Trust me on this, go take an hour and read all the docs on there site about hidden containers and hidden operating systems. Its WELL worth the time as they explain everything. Even plausible deniability and what to say if you are caught.
    Using backtrack for the first time is like being 10 years old again with the keys to a Ferrari.

  9. #19
    Super Moderator Archangel-Amael's Avatar
    Join Date
    Jan 2010
    Location
    Somewhere
    Posts
    8,012

    Default

    Quote Originally Posted by vvpalin View Post
    Thats why you make a hidden operating system.

    Trust me on this, go take an hour and read all the docs on there site about hidden containers and hidden operating systems. Its WELL worth the time as they explain everything. Even plausible deniability and what to say if you are caught.
    A good piece of advice there vvpalin.
    Making hidden containers inside one another is a great way to protect your data if you are very paranoid.
    To be successful here you should read all of the following.
    ForumRules
    ForumFAQ
    If you are new to Back|Track
    Back|Track Wiki
    Failure to do so will probably get your threads deleted or worse.

  10. #20
    Just burned his ISO
    Join Date
    Apr 2009
    Posts
    4

    Default ^_^

    What could truecrypt do to make the containers insusceptible to a password bruteforce?

    A tc file is different than, say, a server that you're trying to gain shell access on. The server can be configured to only accept a log-in attempt for USER every X seconds, thereby rendering bruteforcing extremely tedious and time consuming or damn near impossible. But a server is actively running; it has processes monitoring I/O and can be configured to respond to stimuli in real time.

    I haven't read all the docs so I have no idea what I'm talking about, but let's suppose that a truecrypt file has some sort of code that checks against the system time and is capable of refusing password attempts until a certain time has expired. A very simple script could be written that tries a random password, sets the system time forward, and then tries the next password thereby defeating a timing mechanism.

    Or, let us suppose that after a number of failed login attempts the tc file is somehow able to change the password to a a random string of N characters where N is some astronomical number. In addition to leaving the tc extremely vulnerable to a side channel attack (as it would have to generate entropy for the pseudo-random number generator from the client computer attacking the file), a script could be written that copies the original container from some other location before each attempt and then deletes the copy if the attempt is failed.

    My understanding is that tc containers are resistant to cryptanalysis wherein the key is deduced by interpreting the structure of the container. Cascading doesn't make bruteforcing the password itself more difficult, it simply means that if a vulnerability were found in AES and Twofish tomorrow then the tc container would still be as strong as the Serpent encryption.

    The OP has deliberately created a scenario wherein some user is not using keyfiles and is using a weak password of relatively low entropic value. AFAIK Truecrypt doesn't have a mechanism to safeguard sensitive data when the user is inept or doesn't have an understanding of proper security practice. That doesn't really have anything to do with the strength of Truecrypt's implementation of encryption ciphers.

    BUT, to throw my own two cents in, simple password attempts prove futile when keyfiles are used. Also, it's a good idea to disguise containers as appropriately sized common files such as an iso, jpeg, or some random binary file. Who has the time to check the hash of every file in /usr/bin ?

Page 2 of 3 FirstFirst 123 LastLast

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •