Let's say you use a program like Truecrypt or Keepass which allows you to have a password + key file. I understand that passwords can be brute-forced/dictionary-attacked but is the same true for key files?
Tell me more
×
IT Security Stack Exchange is a question and answer site for
IT security professionals. It's 100% free, no registration required.
|
|
|
Yes, it is the same: keyfiles can be brute-forced. A key file is like typing your password and storing it somewhere, instead of typing it everytime. To the program (in your example, TrueCrypt), passwords and keyfiles and every other information is used to feed the encrypt / decrypt algorithm. It doesn't matter where the information comes from. To break the encrypt, one needs to perform the corresponding decrypt step using the same information that was used in the encryption. If it was a password, a password + keyfile, or a password + keyfile + a number that comes from a device that reads fingerprints, it's the same thing. Keyfiles, in general, make it more secure because they use all the possible bytes inside it, so you have 256 combinations for each "character" inside the keyfile. When someone chooses a password, in general uses just letters, numbers and some symbols. The entropy provided by the key file is, usually, bigger. |
|||||
|
|
In addition to woliveirajr's answer and dr jimbobs statistical comment, keep in mind that a key file isn't memorized by the user. The key file must be stored somewhere accessible. An attacker, under the appropriate conditions, can use this fact to potentially significantly reduce the attack space from whatever huge number to whatever files they can associate with the user. Of course, if someone is intelligent enough to resort to key files, then it is hopeful they are protecting the key file appropriately. |
|||
|
|
