Score:0

How difficult is it to break unknown encryption?

eg flag

I found this post on Reddit and was wondering if anyone could provide a more detailed explanation/answer:

Lets say I find a hard drive in a trash can along with a sticky note that says "AES-128, good luck!". I'd setup a computer or if I'm really curious multiple computers to brute force using the AES algorithm. It'll probably take a while but I know for a fact that after a finite amount of time, I'd decrypt the drive. But what if there is no note. And the owner did not use any of the built-in encryption algorithms(usually AES). How much harder would that be to brute force? I'd have to brute force attack with AES and possibly every other known encryption algorithm. Finally, what if the owner of the HD works for some cyber security company and they have their very own encryption algorithm the knowledge of which does not exist outside the company. So, would that be impossible to decrypt since I have no algorithm to brute force with?

ming alex avatar
in flag
Without knowing the encryption method/algorithm of the ciphertext, I think it is impossible to decrypte it by the brute force attack. For instance, encrypting a plaintext by an old Enigma machine, if you don't know how the Enigma works, then the end of WWII would be postponed for many years. For morden cryptograhpy, the design of an encryption scheme should follow Kerckhoffs's principle or Shanon's. that is *the security of a cryptosystem must lie in the choice of its keys only; everything else (including the algorithm itself) should be considered public knowledge*.
Score:3
cn flag

There are serious misunderstandings in the statement you quote. The central one is that breaking cryptography is about brute force. This is in fact a mostly irrelevant threat for many modern cryptographic methods, and especially for encryption. Cryptography tends to be significantly overengineered against brute force.

I'd setup a computer or if I'm really curious multiple computers to brute force using the AES algorithm. It'll probably take a while but I know for a fact that after a finite amount of time, I'd decrypt the drive.

This statement is technically correct except for one word: I'd decrypt the drive. No, you won't. You'll be dead long before that. Let's say you are one of the most powerful entities on earth and you devote as much power as the whole bitcoin mining infrastructure to breaking this encryption. Bitcoin manages about $2^{67}$ hashes per second by consuming about 5% of the world's total electricity production. The cost of trying out an AES key is comparable to a hash. Let's further say you'll be happy with a $1/2^7$ chance of success (almost 1%), so you'll need time to try about $1/2^7$ of the $2^{128}$ possible keys. This will take $2^{128} / 2^7 / 2^{67} = 2^{54} \:\mathrm{s} \approx 6 \cdot 10^8 \:\mathrm{yr}$. That's over half a billion years. That is such a long while that in practical terms, it means it won't happen.

Electronic computers make the gap between the attacker and the defender so huge that the attacker has absolutely no chance with a brute force attack. Attacks on cryptography come from other fronts: design mistakes, implementation mistakes, or insufficient protection of keys and other confidential material.

How much harder would that be to brute force?

About the same, but as we've seen, this question is irrelevant anyway.

I'd have to brute force attack with AES and possibly every other known encryption algorithm.

No, you wouldn't have to brute force. You could find another way to break it, such as a design flaw in the encryption.

So, would that be impossible to decrypt since I have no algorithm to brute force with?

No, it wouldn't be impossible to decrypt. It would just mean that you'd have to find some flaw. Which, once again, is how all encryption is broken. (Any encryption that is vulnerable to brute force has a major design flaw, because it is well-known how to design encryption that's effectively immune to brute-force attacks.)

Designing an encryption mechanism is hard. Schneier's law says that anyone can create an algorithm that they can't break themselves. The difficulty is creating an algorithm that others can't break either. This is difficult even for experts, which is why all serious cryptographic methods are independently reviewed by many experts before anyone puts them into production. Using a well-known, well-respected algorithm is safer than using a home-made one.

tum_ avatar
jp flag
"correct except for one word: **I**'d decrypt the drive. No, you won't. You'll be dead long before that." - +1 for this. :)
Score:2
in flag

A bootable hard drive with full disk encryption will have the encryption algorithm needed to decode it in the clear. So with some reverse engineering the algorithm will be revealed.

When I turn on my computer it loads an.unencrypted part of my hard drive which asks for a passphrase which is used to decrypt most of the drive. This is the common way of doing things.

If you get a data blob which is only encrypted data and no decryption code that could be indeed challnging.

Kerckhoof's principle says we should assume only the key is secret and not the algorithm. This is a good policy, and in the past we have seen algorithms were deduced in various means.

Deducing the algorithm would be much easier if the underlying algorithm is week. Classical algorithms produce data far enough from random we can identify the markers even in cipher text only scenario. In other cases we have some knowledge of the plain text or parts of it and may be able to even do active attacks causing the victim to encrypt/decrypt some stuff for us allowing us to gather more information on the cipher. Finding non random patterns is the key in identifying the cipher as well as later breaking it.

That said not knowing the algorithm on top of a reasonable cipher can make things very difficult, especially in a ciphertext only mode.

P.s. You can not bruteforce a 128 bit cipher. And definetly not 256 bit. at some point the time required makes it not slow or expensive but simply impossible.

P.p.s even with a known cipher you may not always have a clear way of verifying a guessed key. If the plain text was random and there was no authentication code or such. Bruteforce can't be verified.

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.