1

Is this able to be cracked without a brute force? With a long enough password, would I be safe storing my nuclear launch codes in an encrypted excel sheet?

  • 1
    It is not safe, no matter the options used – John Keates Apr 22 '17 at 1:31
3

Current versions of Office hash the password a large number of times to create the key and encrypt using AES-128. I wouldn't protect nuclear launch codes with that, but it's relatively safe.

Can it be brute forced? With today's technology it'd take millions of computers to do it in a reasonable period of time. So, yes it can be brute forced but unless you think NSA, GCHQ or FSB are after your data, you're probably fine - assuming Microsoft didn't do anything stupid in the implementation. As noted on the Matasano Crypto Challenges: "There are tens, probably hundreds, of obscure little things you can do to take a cryptosystem that should be secure even against an adversary with more CPU cores than there are atoms in the solar system, and make it solveable with a Perl script and 15 seconds."

  • Can you link me to some official documentation stating that they use AES-128? – Jens Timmerman Jun 27 '18 at 7:53
1

swashbuckler is mainly correct.

Still, it seems that Office 2016 apps use AES-256 with 100k SHA1 rounds by default.

AES-256 uses 256-bit keys but still has 128-bit block size. It is generally safe unless one is directly targeted by a sufficiently intelligent adversary. For example, some Achilles' heels to the usual applied cryptography today are (a) usage of PRNGs, (b) the exact PRNG spec used, and (c) the more widespread issue of using insecure/guessable human-generated passwords. There is also the possibility of successful algebraic attacks on AES that are well kept secret. Again, these issues only seem to arise when dealing with "sufficiently intelligent" adversaries with access to relatively sufficient metadata.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.