4

Let's say you use a program like Truecrypt or Keepass which allows you to have a password + key file. I understand that passwords can be brute-forced/dictionary-attacked but is the same true for key files?

Improve this question

2 Answers 2

Reset to default
6

Yes, it is the same: keyfiles can be brute-forced.

A key file is like typing your password and storing it somewhere, instead of typing it everytime.

To the program (in your example, TrueCrypt), passwords and keyfiles and every other information is used to feed the encrypt / decrypt algorithm. It doesn't matter where the information comes from. To break the encrypt, one needs to perform the corresponding decrypt step using the same information that was used in the encryption. If it was a password, a password + keyfile, or a password + keyfile + a number that comes from a device that reads fingerprints, it's the same thing.

Keyfiles, in general, make it more secure because they use all the possible bytes inside it, so you have 256 combinations for each "character" inside the keyfile. When someone chooses a password, in general uses just letters, numbers and some symbols. The entropy provided by the key file is, usually, bigger.

Improve this answer
2
  • 1
    I agree, but for any random non-guessable file once you get above ~100 bytes of data its inconceivable for non-quantum computers to brute-force. Remember, 100 bytes = 800 bits of entropy (if 0,1 equally likely) ~ 10^240 potential 100 byte files to try; if every atom in the observable universe (~10^80) tried a trillion (10^12) files every nanosecond (~10^16 ns in a year) since the big bang (13.7 billion years), you would still tried only about ~10^106 by today and have to do this for 10^134 lives of the universe before its likely brute forced. Though the file could be obtained in otherwise.
    – dr jimbob
    Apr 27, 2012 at 19:05
  • @drjimbob agree with you in everything, and was even trying to find those stats to add as a comment in other answer. Wikipedia have them.
    – woliveirajr
    Apr 27, 2012 at 19:08
3

In addition to woliveirajr's answer and dr jimbobs statistical comment, keep in mind that a key file isn't memorized by the user. The key file must be stored somewhere accessible. An attacker, under the appropriate conditions, can use this fact to potentially significantly reduce the attack space from whatever huge number to whatever files they can associate with the user. Of course, if someone is intelligent enough to resort to key files, then it is hopeful they are protecting the key file appropriately.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .