6

I've read this TechNet blog post, but I still can't determine how secure BitLocker is against a malicious user that attempts to brute force attack the recovery password. Is anyone familiar with this? Also, how about offline brute force attacks against the recovery password?

enter image description here

7 Answers 7

7

I've done some further analysis, and I believe I have determined that brute force attacking the recovery password would not be a good use of anyone's time....that is assuming my math is correct.

The recovery password is created starting with a 128-bit key, split into 8 groups of 16 bits of entropy, written as a value between 0 and 65,535 (2^16 - 1). Each group of six digits must be divisible by 11, which is used as a check against keys mistyped by the user when entering the groups.

Each of the 8 groups of 6 digits must be less than 720,896 (which is 2^16 *11); indicating that each of the eight groups has 2^16 possible values, and altogether this means that there are (2^16)^8 possible combinations; which is ~3.4028 x 10^38 combinations.

Assuming we could somehow process 500 trillion passwords an hour (which would be 3,623 times more than the ~138 billion passwords per hour capability of a desktop computer in 2008 under 10% load), it would still take us ~7.7 x 10^19 years to brute force crack this 48 character numerical recovery password.

Obviously, attackers would likely not consider brute force attacks against the BitLocker recovery password and would resort to attacking weaker links in the chain.

4
  • sort of. what i was getting at is 1)how many numbers between 0 and 65535 are divisible by eleven? this significantly reduces entropy in each section and 2) the effect is cumulative. each progressive section having less than the original entropy makes this a MUCH less than 128 bit key. if the output of the "test if decrypt key is right" function were predictable and we had the driver ported into a tesla rig capable of petaflops of computing on some mathematical operations...last I don't think this part of the math is valid: Each of the 8 groups of 6 digits must be less than 720,896... Jan 31, 2011 at 15:58
  • 2
    you essentially copy and pasted sections of the article you linked to Jan 31, 2011 at 15:59
  • It isn't how many numbers between 0 and 2^16 (65535) that are divisible by 11, but how many numbers between 0 and 720,896 that are divisible by 11. That happens to be 2^16. It does reduce entropy, but not to a point that it isn't difficult to brute force attack. I do agree that with appropriate hardware (such as the tesla rig with petaflops of computing power) it is defeatable. But so is all encryption. Also, that's cost prohibitive to obtain that much computing power today.
    – Mick
    Jan 31, 2011 at 18:04
  • It doesn't. The limitations on the blobs in the keyspace make it vastly different than bruteforcing AES Jul 16, 2014 at 21:16
2

The numbers are astronomically high. We can't predict with 100% accuracy how powerful computers will be in the future, but at least for now, cracking such a password would be a complete waste of time.

A more useful consideration would be protection against things like cold boot attacks, which most encryption softwares have protected against, but BitLocker is still vulnerable to.

3
  • 2
    BitLocker can be configured to be much less vulnerable to cold boot attacks: "Defense-in-Depth vs. BitUnlocker: How to defeat Cold DRAM attacks using BitLocker, Power Options, and Physical Security" --- bit.ly/hAMFTO
    – Mick
    Jan 31, 2011 at 18:11
  • 3
    To remove this link from bit.ly obscurity: blogs.technet.com/b/staysafe/archive/2008/02/24/…
    – Mick
    Dec 22, 2014 at 23:04
  • "Astronomically" is not infinity :-) Jan 21, 2022 at 19:34
0

It is reasonably resilient in my opinion. The math is sound and without custom bruting tools, manual recovery by key exhaustion would take a long time. I am of the opinion that custom bruting software exists (if a linux driver exists so does a brute forcing tool) and without a TPM to limit retries, it could be done in a reasonable time frame. On the other hand...the BSD full disk encryption system is a BEAST. I don't have much math outside of the limited keyspace(they say it kind of isn't due to the retry limitation, but again linux driver=brute force tool). last note:they are digits not characters so no alpha or symbol

5
  • The math is that each "word" in the keyspace is limited in and of itself. I can't find the research paper that expresses that, but I'm sure I read it. Mathematically limiting each word exponentially reduces the keyspace when you stack one after another. Conversely, if you don't have the key, in the BSD keysystem, you don't even know if you're testing against accurate key material. Percentages aren't necessarily required once you grasp those two concepts. Jul 15, 2014 at 21:00
  • How about - While a datacenter grinding Windows bitlocker credentials would be exponentially more likely to succeed than a datacenter grinding BSD FDE solution credentials. The scope of datacenter and reasonable timeline are both inspecific, but comparatively one is clearly superior to the other. Given something like an NSA datacenter, CPU-years on current hardware are no longer valid given parallel programming acceleration through a given GPU or a GPU farm. Jul 15, 2014 at 21:15
  • 2
    Then you run the numbers. When you find out I'm right, come back and remove the downvote :) Jul 15, 2014 at 21:29
  • If you made a separate answer with math that went to the same place, I would upvote yours and delete mine. It was just something that needed saying. Jul 15, 2014 at 21:34
  • Good luck. I hope you prove it wrong intead :) Jul 15, 2014 at 22:03
0

From a Moore's Law perspective: if computing power continues doubles every two years, then an N-bit key can be considered crackable within 2*N years - starting around, say, 1950.

So for a 128-bit key, we can perhaps hope to be routinely brute-forcing Bitlocker keys by the year 2200.

For a 256-bit key, probably by the time we reach the year 2500.

(Give or take a wide margin of error, and depending on Moore's Law continuing to hold.)

-1

Passware Kit Forensic 10.1 claims to be able to crack the password (and ultimately the entire drive) in 20 minutes:

http://blastmagazine.com/the-magazine/technology/tech-news/computers/bitlocker-to-go-thumb-drives-cracked-in-20-minutes/

1
  • 1
    The Passware kit explains on their website that they are just recovering the key from memory or hiberfil.sys and are not cracking anything. The 20 minutes thing is a complete red hearing meant to give some kind of credulity to an outlandish and unsupportable claim. I suppose we should expect as much from a source named "Blast Magazine".
    – Chris S
    Jul 7, 2015 at 14:46
-1

If its about bruteforce only, it can resist during years and years cause you have billions of possiblities, but this video can show you how to hack it without brute-force (i think) https://www.youtube.com/watch?v=ZfqqUh7YB8I

1
  • 3
    Dislocker is simply a tool that provides Bitlocker support on Linux. You can see the recovery key being entered at 6:45.
    – gronostaj
    Jun 2, 2022 at 10:36
-3

It's more about the software that is protecting the encryption key. How much this OS is safe to being hacked? As soon as someone can log into the system, this person has access to the encryption key, even if the key is buried deep into the TPM.

So we are back to how much is Windows seven (or Vista) resilient to account hacking? The answer is that it has already been hacked: http://www.tomshardware.com/news/Windows-7-Hacked-controlled,7619.html

5
  • Yes, but if you are using TPM + PIN, the "key" is a mixture of the SRK (within the TPM) and your PIN. So I disagree, we are not back to worrying about account hacking in Windows. I am worried about attacking full drive encryption using the Recovery Password, thus bypassing the TPM.
    – Mick
    Jan 31, 2011 at 15:30
  • No access to the OS, no access to the boot code, only to the encrypted data, then well... Bitlocker is using an implementation of AES 128 bits. Then brute force attacks of AES 128 have been discussed at length is cryptography books, and wikipedia has a summary at en.wikipedia.org/wiki/Advanced_Encryption_Standard
    – bitlocked
    Jan 31, 2011 at 17:07
  • 1
    BitLocker supports AES+256 as well, and it uses an Elephant diffuser to ensure that each sector of disk is uniquely encrypted, making attacks more difficult. The creator of BitLocker has some gory details on this: bit.ly/ggZCkH
    – Mick
    Jan 31, 2011 at 18:14
  • Nice indeed. I see how to use encryption for USB keys, but what is the additional benefit for fixed HDD? I mean I've tried to answer that for me, and my conclusion is that ATA Security (aka HDD password) remains unbroken and is transparent, no software except small BIOS code, no key to protect, it's all on the drive + it's free. Without being provocative, if someone is able to break an HDD password, he may be able to break Bitlocker too, right? See (scribd.com/doc/44516476/harddisk-ata-security-v1-1-1)
    – bitlocked
    Jan 31, 2011 at 20:26
  • I'd say it's apples and oranges. If you crack/bypass the HDD password, you still have all your work ahead of you with attacking BitLocker.
    – Mick
    Feb 1, 2011 at 18:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .