up vote 0 down vote favorite
share [g+] share [fb]

I've read this TechNet blog post, but I still can't determine how secure BitLocker is against a malicious user that attempts to brute force attack the recovery password. Is anyone familiar with this? Also, how about offline brute force attacks against the recovery password?

enter image description here

link|improve this question
100% accept rate
feedback

5 Answers

up vote 2 down vote accepted

The numbers are astronomically high. We can't predict with 100% accuracy how powerful computers will be in the future, but at least for now, cracking such a password would be a complete waste of time.

A more useful consideration would be protection against things like cold boot attacks, which most encryption softwares have protected against, but BitLocker is still vulnerable to.

link|improve this answer
BitLocker can be configured to be much less vulnerable to cold boot attacks: "Defense-in-Depth vs. BitUnlocker: How to defeat Cold DRAM attacks using BitLocker, Power Options, and Physical Security" --- bit.ly/hAMFTO – Mick Jan 31 '11 at 18:11
feedback
up vote 1 down vote

I've done some further analysis, and I believe I have determined that brute force attacking the recovery password would not be a good use of anyone's time....that is assuming my math is correct.

The recovery password is created starting with a 128-bit key, split into 8 groups of 16 bits of entropy, written as a value between 0 and 65,535 (2^16 - 1). Each group of six digits must be divisible by 11, which is used as a check against keys mistyped by the user when entering the groups.

Each of the 8 groups of 6 digits must be less than 720,896 (which is 2^16 *11); indicating that each of the eight groups has 2^16 possible values, and altogether this means that there are (2^16)^8 possible combinations; which is ~3.4028 x 10^38 combinations.

Assuming we could somehow process 500 trillion passwords an hour (which would be 3,623 times more than the ~138 billion passwords per hour capability of a desktop computer in 2008 under 10% load), it would still take us ~7.7 x 10^19 years to brute force crack this 48 character numerical recovery password.

Obviously, attackers would likely not consider brute force attacks against the BitLocker recovery password and would resort to attacking weaker links in the chain.

link|improve this answer
sort of. what i was getting at is 1)how many numbers between 0 and 65535 are divisible by eleven? this significantly reduces entropy in each section and 2) the effect is cumulative. each progressive section having less than the original entropy makes this a MUCH less than 128 bit key. if the output of the "test if decrypt key is right" function were predictable and we had the driver ported into a tesla rig capable of petaflops of computing on some mathematical operations...last I don't think this part of the math is valid: Each of the 8 groups of 6 digits must be less than 720,896... – aking1012 Jan 31 '11 at 15:58
you essentially copy and pasted sections of the article you linked to – aking1012 Jan 31 '11 at 15:59
It isn't how many numbers between 0 and 2^16 (65535) that are divisible by 11, but how many numbers between 0 and 720,896 that are divisible by 11. That happens to be 2^16. It does reduce entropy, but not to a point that it isn't difficult to brute force attack. I do agree that with appropriate hardware (such as the tesla rig with petaflops of computing power) it is defeatable. But so is all encryption. Also, that's cost prohibitive to obtain that much computing power today. – Mick Jan 31 '11 at 18:04
feedback
up vote 1 down vote

It is reasonably resilient in my opinion. The math is sound and without custom bruting tools, manual recovery by key exhaustion would take a long time. I am of the opinion that custom bruting software exists (if a linux driver exists so does a brute forcing tool) and without a TPM to limit retries, it could be done in a reasonable time frame. On the other hand...the BSD full disk encryption system is a BEAST. I don't have much math outside of the limited keyspace(they say it kind of isn't due to the retry limitation, but again linux driver=brute force tool). last note:they are digits not characters so no alpha or symbol

link|improve this answer
feedback
up vote 1 down vote

Passware Kit Forensic 10.1 claims to be able to crack the password (and ultimately the entire drive) in 20 minutes:

http://blastmagazine.com/the-magazine/technology/tech-news/computers/bitlocker-to-go-thumb-drives-cracked-in-20-minutes/

link|improve this answer
feedback
up vote -1 down vote

It's more about the software that is protecting the encryption key. How much this OS is safe to being hacked? As soon as someone can log into the system, this person has access to the encryption key, even if the key is buried deep into the TPM.

So we are back to how much is Windows seven (or Vista) resilient to account hacking? The answer is that it has already been hacked: http://www.tomshardware.com/news/Windows-7-Hacked-controlled,7619.html

link|improve this answer
Yes, but if you are using TPM + PIN, the "key" is a mixture of the SRK (within the TPM) and your PIN. So I disagree, we are not back to worrying about account hacking in Windows. I am worried about attacking full drive encryption using the Recovery Password, thus bypassing the TPM. – Mick Jan 31 '11 at 15:30
No access to the OS, no access to the boot code, only to the encrypted data, then well... Bitlocker is using an implementation of AES 128 bits. Then brute force attacks of AES 128 have been discussed at length is cryptography books, and wikipedia has a summary at en.wikipedia.org/wiki/Advanced_Encryption_Standard – bitlocked Jan 31 '11 at 17:07
BitLocker supports AES+256 as well, and it uses an Elephant diffuser to ensure that each sector of disk is uniquely encrypted, making attacks more difficult. The creator of BitLocker has some gory details on this: bit.ly/ggZCkH – Mick Jan 31 '11 at 18:14
Nice indeed. I see how to use encryption for USB keys, but what is the additional benefit for fixed HDD? I mean I've tried to answer that for me, and my conclusion is that ATA Security (aka HDD password) remains unbroken and is transparent, no software except small BIOS code, no key to protect, it's all on the drive + it's free. Without being provocative, if someone is able to break an HDD password, he may be able to break Bitlocker too, right? See (scribd.com/doc/44516476/harddisk-ata-security-v1-1-1) – bitlocked Jan 31 '11 at 20:26
I'd say it's apples and oranges. If you crack/bypass the HDD password, you still have all your work ahead of you with attacking BitLocker. – Mick Feb 1 '11 at 18:35
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.