# How resistant is BitLocker against brute force attacks on the 48 character recovery key?

I've read this TechNet blog post, but I still can't determine how secure BitLocker is against a malicious user that attempts to brute force attack the recovery password. Is anyone familiar with this? Also, how about offline brute force attacks against the recovery password?

-

I've done some further analysis, and I believe I have determined that brute force attacking the recovery password would not be a good use of anyone's time....that is assuming my math is correct.

The recovery password is created starting with a 128-bit key, split into 8 groups of 16 bits of entropy, written as a value between 0 and 65,535 (2^16 - 1). Each group of six digits must be divisible by 11, which is used as a check against keys mistyped by the user when entering the groups.

Each of the 8 groups of 6 digits must be less than 720,896 (which is 2^16 *11); indicating that each of the eight groups has 2^16 possible values, and altogether this means that there are (2^16)^8 possible combinations; which is ~3.4028 x 10^38 combinations.

Assuming we could somehow process 500 trillion passwords an hour (which would be 3,623 times more than the ~138 billion passwords per hour capability of a desktop computer in 2008 under 10% load), it would still take us ~7.7 x 10^19 years to brute force crack this 48 character numerical recovery password.

Obviously, attackers would likely not consider brute force attacks against the BitLocker recovery password and would resort to attacking weaker links in the chain.

-
sort of. what i was getting at is 1)how many numbers between 0 and 65535 are divisible by eleven? this significantly reduces entropy in each section and 2) the effect is cumulative. each progressive section having less than the original entropy makes this a MUCH less than 128 bit key. if the output of the "test if decrypt key is right" function were predictable and we had the driver ported into a tesla rig capable of petaflops of computing on some mathematical operations...last I don't think this part of the math is valid: Each of the 8 groups of 6 digits must be less than 720,896... – hbdgaf Jan 31 '11 at 15:58
you essentially copy and pasted sections of the article you linked to – hbdgaf Jan 31 '11 at 15:59
It isn't how many numbers between 0 and 2^16 (65535) that are divisible by 11, but how many numbers between 0 and 720,896 that are divisible by 11. That happens to be 2^16. It does reduce entropy, but not to a point that it isn't difficult to brute force attack. I do agree that with appropriate hardware (such as the tesla rig with petaflops of computing power) it is defeatable. But so is all encryption. Also, that's cost prohibitive to obtain that much computing power today. – Mick Jan 31 '11 at 18:04
@hbdgaf I think it boils down to brute forcing a random 128-bit AES key. Unless there is some exploitable flaw in the RNG used, I don't suspect anybody would bother trying. – Mark Johnson Jul 16 '14 at 20:08
@hbdgaf There are no "limitations on the blobs in the keyspace". The recovery key is a randomly generated 128-bit AES key. The numeric representation is purely a convenience for entry via the keyboard. Any random string of 128 bits can be represented as a decimal number. That says nothing about the quality of the RNG used to generate them. – Mark Johnson Jul 17 '14 at 17:20

The numbers are astronomically high. We can't predict with 100% accuracy how powerful computers will be in the future, but at least for now, cracking such a password would be a complete waste of time.

A more useful consideration would be protection against things like cold boot attacks, which most encryption softwares have protected against, but BitLocker is still vulnerable to.

-
BitLocker can be configured to be much less vulnerable to cold boot attacks: "Defense-in-Depth vs. BitUnlocker: How to defeat Cold DRAM attacks using BitLocker, Power Options, and Physical Security" --- bit.ly/hAMFTO – Mick Jan 31 '11 at 18:11
To remove this link from bit.ly obscurity: blogs.technet.com/b/staysafe/archive/2008/02/24/… – Mick Dec 22 '14 at 23:04

It is reasonably resilient in my opinion. The math is sound and without custom bruting tools, manual recovery by key exhaustion would take a long time. I am of the opinion that custom bruting software exists (if a linux driver exists so does a brute forcing tool) and without a TPM to limit retries, it could be done in a reasonable time frame. On the other hand...the BSD full disk encryption system is a BEAST. I don't have much math outside of the limited keyspace(they say it kind of isn't due to the retry limitation, but again linux driver=brute force tool). last note:they are digits not characters so no alpha or symbol

-
You have not provided any math to support your reasoning. – Mark Johnson Jul 15 '14 at 20:56
The math is that each "word" in the keyspace is limited in and of itself. I can't find the research paper that expresses that, but I'm sure I read it. Mathematically limiting each word exponentially reduces the keyspace when you stack one after another. Conversely, if you don't have the key, in the BSD keysystem, you don't even know if you're testing against accurate key material. Percentages aren't necessarily required once you grasp those two concepts. – hbdgaf Jul 15 '14 at 21:00
I find terms like "reasonably resilient", "a long time", "reasonable time frame" and "is a BEAST" to be so non-specific that they're of very little value. I would find something like this to be valuable: "A brute force attack on system X would be expected to succeed on average after Y attempts, with each attempt having cost Z." – Mark Johnson Jul 15 '14 at 21:12
Then you run the numbers. When you find out I'm right, come back and remove the downvote :) – hbdgaf Jul 15 '14 at 21:29
I think your NSA GPU datacenter attack is also a fantasy. Even the entire world Gross Domestic Product for a year would be insufficient to cover the cost of just the electricity to brute even a 128-bit AES key. See: crypto.stackexchange.com/a/1148 – Mark Johnson Jul 16 '14 at 20:30

Passware Kit Forensic 10.1 claims to be able to crack the password (and ultimately the entire drive) in 20 minutes:

http://blastmagazine.com/the-magazine/technology/tech-news/computers/bitlocker-to-go-thumb-drives-cracked-in-20-minutes/

-
That sounds like a cold boot attack and has nothing to do with a brute force attack on the recovery key. – Mark Johnson Jul 10 '14 at 17:31
The Passware kit explains on their website that they are just recovering the key from memory or hiberfil.sys and are not cracking anything. The 20 minutes thing is a complete red hearing meant to give some kind of credulity to an outlandish and unsupportable claim. I suppose we should expect as much from a source named "Blast Magazine". – Chris S Jul 7 at 14:46

It's more about the software that is protecting the encryption key. How much this OS is safe to being hacked? As soon as someone can log into the system, this person has access to the encryption key, even if the key is buried deep into the TPM.

So we are back to how much is Windows seven (or Vista) resilient to account hacking? The answer is that it has already been hacked: http://www.tomshardware.com/news/Windows-7-Hacked-controlled,7619.html

-
Yes, but if you are using TPM + PIN, the "key" is a mixture of the SRK (within the TPM) and your PIN. So I disagree, we are not back to worrying about account hacking in Windows. I am worried about attacking full drive encryption using the Recovery Password, thus bypassing the TPM. – Mick Jan 31 '11 at 15:30
No access to the OS, no access to the boot code, only to the encrypted data, then well... Bitlocker is using an implementation of AES 128 bits. Then brute force attacks of AES 128 have been discussed at length is cryptography books, and wikipedia has a summary at en.wikipedia.org/wiki/Advanced_Encryption_Standard – bitlocked Jan 31 '11 at 17:07
BitLocker supports AES+256 as well, and it uses an Elephant diffuser to ensure that each sector of disk is uniquely encrypted, making attacks more difficult. The creator of BitLocker has some gory details on this: bit.ly/ggZCkH – Mick Jan 31 '11 at 18:14
Nice indeed. I see how to use encryption for USB keys, but what is the additional benefit for fixed HDD? I mean I've tried to answer that for me, and my conclusion is that ATA Security (aka HDD password) remains unbroken and is transparent, no software except small BIOS code, no key to protect, it's all on the drive + it's free. Without being provocative, if someone is able to break an HDD password, he may be able to break Bitlocker too, right? See (scribd.com/doc/44516476/harddisk-ata-security-v1-1-1) – bitlocked Jan 31 '11 at 20:26
I'd say it's apples and oranges. If you crack/bypass the HDD password, you still have all your work ahead of you with attacking BitLocker. – Mick Feb 1 '11 at 18:35