Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Practical bruteforce of military grade AES-1024 (2021) [video]

media.ccc.de

Post reply on HN
Print view View original

81–90 of 93 posts

Re: Practical bruteforce of military grade AES-1024 (2021) [video]

#81

Post by Terry_Roll »

hatsunearu wrote: post #61
dehrmann wrote: post #56

Earlier quoted context omitted.

To see how insecure a mode of operation can be, Wikipedia has a picture that was encrypted with ECB: https://en.wikipedia.org/wiki/Block_cipher_mode_of_operation...

That picture has become some sort of meme of itself (I've heard it referred as "you can see penguins through ECB") because it's so damn popular. However ECB is a lot worse than "you can see data patterns"--with a chosen plaintext attack (very common scenario in networking and storage applications) any dumbass can decrypt it trivially.

I still havent see a regex for ECB though!

Re: Practical bruteforce of military grade AES-1024 (2021) [video]

#82

Post by hatsunearu »

evh wrote: post #77
hatsunearu wrote: post #61

Earlier quoted context omitted.

That picture has become some sort of meme of itself (I've heard it referred as "you can see penguins through ECB") because it's so damn popular. However ECB is a lot worse than "you can see data patterns"--with a chosen plaintext attack (very common scenario in networking and storage applications) any dumbass can decrypt it trivially.

Those who want to try it for themselves can check out https://cryptopals.com/sets/2/challenges/12 (and that entire set).

Oh man, I loved doing cryptopals back in the day. I should try again.

Re: Practical bruteforce of military grade AES-1024 (2021) [video]

#83

Post by _8j50 »

SAI_Peregrinus wrote: post #39

There is no such thing as AES-1024 specified by NIST. AES is a NIST standard, it has three (and only three) variants: AES-128, AES-192, and AES-256. If you see something other than those three, it's almost certainly proprietary junk. Note that AES is always used in a "mode of operation" to provide any sort of secure encryption. AE-secure modes are AES-SIV, AES-GCM-SIV, AES-OCB, and AES-GCM in decreasing order of safe…

I must disagree with the "proprietary junk" assertion you made. While Your statement about AES is correct, Rijndael cipher of which AES is a subset can have bigger keys and block sizes. For marketing reasons they interchange Rijndael with AES since many have never heard of it.

Re: Practical bruteforce of military grade AES-1024 (2021) [video]

#84

Post by SAI_Peregrinus »

crest wrote: post #47
SAI_Peregrinus wrote: post #39

There is no such thing as AES-1024 specified by NIST. AES is a NIST standard, it has three (and only three) variants: AES-128, AES-192, and AES-256. If you see something other than those three, it's almost certainly proprietary junk. Note that AES is always used in a "mode of operation" to provide any sort of secure encryption. AE-secure modes are AES-SIV, AES-GCM-SIV, AES-OCB, and AES-GCM in decreasing order of safe…

The bullshit "AES-1024" is quoted from the product description and repeated in the title as clickbait.

Yes, I merely want to reiterate as clearly as possible that there's no such algorithm endorsed by NIST. AES is a standard, AES-1024 isn't one of the variants of that standard. For good reason.

Symmetric key sizes larger than 256 bits are pretty much universally snake oil.

Re: Practical bruteforce of military grade AES-1024 (2021) [video]

#85

Post by tgsovlerkhgsel »

_8j50 wrote: post #83
SAI_Peregrinus wrote: post #39

There is no such thing as AES-1024 specified by NIST. AES is a NIST standard, it has three (and only three) variants: AES-128, AES-192, and AES-256. If you see something other than those three, it's almost certainly proprietary junk. Note that AES is always used in a "mode of operation" to provide any sort of secure encryption. AE-secure modes are AES-SIV, AES-GCM-SIV, AES-OCB, and AES-GCM in decreasing order of safe…

I must disagree with the "proprietary junk" assertion you made. While Your statement about AES is correct, Rijndael cipher of which AES is a subset can have bigger keys and block sizes. For marketing reasons they interchange Rijndael with AES since many have never heard of it.

While it is possible to do that, companies that understand what they're doing will generally stick to well-proven, standardized versions and companies that don't tend to also do other dangerous mistakes.

It's not a 100% guarantee that it's proprietary junk, but it's a very good indicator.

Re: Practical bruteforce of military grade AES-1024 (2021) [video]

#86

Post by gray_charger »

SAI_Peregrinus wrote: post #39

There is no such thing as AES-1024 specified by NIST. AES is a NIST standard, it has three (and only three) variants: AES-128, AES-192, and AES-256. If you see something other than those three, it's almost certainly proprietary junk. Note that AES is always used in a "mode of operation" to provide any sort of secure encryption. AE-secure modes are AES-SIV, AES-GCM-SIV, AES-OCB, and AES-GCM in decreasing order of safe…

Is AES-XTS a secure mode? Or is that something else?

Re: Practical bruteforce of military grade AES-1024 (2021) [video]

#87

Post by gamacodre »

mistrial9 wrote: post #18
upofadown wrote: post #6

Earlier quoted context omitted.

The complaint is that the user supplied password is easier to guess than it could be. A fast hash is used and not very many times. So you might have to, say, use 5 words rather than, say, 3 words in your diceware generated passphrase if you want to be secure against brute force attacks. This ends up being a common usability issue whenever a user is asked to provide a passphrase for some sort of symmetrical encryption…

> So they end up with a dictionary word with a digit on the end and have no way to know that they have not actually protected anything a dictionary word with common letters substituted with a number, case-sensitive, and one or two punctuation.. that is "not protected anything" ? .. almost any two dictionary words put together, not even case sensitive also "not protected anything" ? the out-of-breath security analysis…

If your threat model is "someone cloned the database and can now perform unlimited attacks against the stored passwords", then yeah, word + digit protects just about nothing. Assuming a lexicon of 5,000 words, word+digit gives you about 50,000 variations to try. Say that L337 substitutions give you another 10x factor, so now you have 500,000 candidates for what the password might be. Now lets assume that instead of the stupid crap they did in this video, the folks storing your password did everything right and used bcrypt with a work factor of 12. A cracking rig from a couple years ago can run something like 10,000 hashes per second under these conditions, so it might take a whole minute to discover your password. (Remember this is if they did it right, most other password storage schemes would yield your password in a fraction of a second.)

Or, we could look at the two-words-separated-by-punctuation case. Same 5,000 word lexicon, maybe 10 different symbols likely to show up between the words. Call that ~250,000,000 possibilities for your password. That'll take up to a day to crack. A day is a long time to spend on one password, but maybe they don't have anything better to do. Maybe they hate you personally. Add another word, suddenly the hackers need years per password, which is obviously uneconomical.

These guidelines don't come out of nowhere, and there isn't really a tower of experts somewhere giggling at the unwashed idiots around them (well, there might be, but I wasn't invited). This is just one of many problems in computing that live around the intersection of math and psychology, where the "natural" thing to do is (unintuitively) quite dangerous.

Re: Practical bruteforce of military grade AES-1024 (2021) [video]

#88

Post by a1369209993 »

SAI_Peregrinus wrote: post #84
crest wrote: post #47

Earlier quoted context omitted.

The bullshit "AES-1024" is quoted from the product description and repeated in the title as clickbait.

Yes, I merely want to reiterate as clearly as possible that there's no such algorithm endorsed by NIST. AES is a standard, AES-1024 isn't one of the variants of that standard. For good reason. Symmetric key sizes larger than 256 bits are pretty much universally snake oil.

> Symmetric key sizes larger than 256 bits are pretty much universally snake oil.

512, actually - some symmetric applications are vulnerable to collision or collision-like attacks, and a cosmological-scale attacker can theoretically get up to about 2^308[0] bit operations at current-ish cosmic microwave background temperatures, so 2^256 bit operations is just about plausible in worst case scenario planning.

But 256-bit keys are probably sufficient for any practical application, and that doesn't excuse 1024 anyway.

0:

  You have: log2(1e80 amu c2 / k 3K ln(2)) 
  # (mass of observable universe / landauer limit)
  Definition: 307.99542

Re: Practical bruteforce of military grade AES-1024 (2021) [video]

#89

Post by mistrial9 »

gamacodre wrote: post #87
mistrial9 wrote: post #18

Earlier quoted context omitted.

> So they end up with a dictionary word with a digit on the end and have no way to know that they have not actually protected anything a dictionary word with common letters substituted with a number, case-sensitive, and one or two punctuation.. that is "not protected anything" ? .. almost any two dictionary words put together, not even case sensitive also "not protected anything" ? the out-of-breath security analysis…

If your threat model is "someone cloned the database and can now perform unlimited attacks against the stored passwords", then yeah, word + digit protects just about nothing. Assuming a lexicon of 5,000 words, word+digit gives you about 50,000 variations to try. Say that L337 substitutions give you another 10x factor, so now you have 500,000 candidates for what the password might be. Now lets assume that instead of t…

the Oxford English dictionary has +200,000 words. Split the difference between your 5000 and that 200,000 and call it 100,000 word possibilities eliminating the 1,2 or three letter ones, case-sensitive with your own case rule .. (capital-S in the middle is fair).

each word, of say at least four characters.. with a "simple substitution of a letter with a number" .. which number? 10x per substitution..

add one or two special characters.. how many special characters are there? lets say numerals plus at least 16 more (counts key caps).. one or two adds means .. up to (10+16) squared more combinations

two words.. square that again? what am I missing? a brute force attack on that many combinations better include the right set of special characters.. because you will never match if you do not have the right set of characters in your brute force, right?

now, "10,000 hashes per second under these conditions" means you have hashed the guess, and compare to the hashed stored answer.. sure that is fast.. maybe you can do it, but did you say that you have a copy of the database and can run constant, undetected brute force in private for "forever" ? is that common? specific answers welcome

Re: Practical bruteforce of military grade AES-1024 (2021) [video]

#90

Post by Nursie »

gray_charger wrote: post #86
SAI_Peregrinus wrote: post #39

There is no such thing as AES-1024 specified by NIST. AES is a NIST standard, it has three (and only three) variants: AES-128, AES-192, and AES-256. If you see something other than those three, it's almost certainly proprietary junk. Note that AES is always used in a "mode of operation" to provide any sort of secure encryption. AE-secure modes are AES-SIV, AES-GCM-SIV, AES-OCB, and AES-GCM in decreasing order of safe…

Is AES-XTS a secure mode? Or is that something else?

XTS is often used in disk encryption (or it was a few years ago when I worked on at-rest data encryption for a storage product at a major vendor).

It uses the sector number and block offset within the sector as input, a little like a counter mode. Its major advantage is zero overhead, so you don't lose disk capacity, or need to map blocks around, you can just sorta use it as a filter layer in your disk reads/writes.

It's not properly authenticated though, as data tampering can result in altered or scrambled plaintext rather than detectable errors, so you need other mechanisms for error detection, which then have to be secure against attacks.

Post reply on HN