With a strong password of 10+ characters, mixed case, etc... is the encryption of an Excel 2007 document secure enough to create reasonably strong defense against a brute force attack?
What encryption method does Excel 2007 employ?
According to the Microsoft whitepaper and a few other MSDN blog sources, the following specs are defined:
Older versions of Office use RC4, which is now deprecated and not recommended.
In summary, I'd say yes, with a good password this is going to be difficult to crack.
Modern GPU hash cracking tools can reach around 3.2 billion hashes per second on a powerful graphics card. With the default options, the KDF used will reduce that to roughly 64k hashes per second.
Assuming ten characters (a-z, A-Z, 0-9) you're looking at a key space of 840,000,000,000,000,000 (8.4x10^17) possible passwords, so that's around 210 thousand years before you hit a 50% likelyhood of cracking the password.
If you're storing financial information, take a look at these registry tweaks for Office 2007 SP2 that allow you to alter some security parameters. For a decent increase in security, set the
CipherKeyBits value to 256, and the
PasswordSpinCount value to 1,000,000 or higher. At that point, I'd personally trust it to be reasonably safe against even determined attackers. If you're super-paranoid, you could always put the files in a TrueCrypt volume too!
Already answered on Super User, so just let me quote that answer:
When I lost my Excel password, I did quite a research only to find out that all password recovery programs can't gurantee successful restoration of lost password. If the password was long and complex, it may take years for them to find it. The only way to reliably remove password from Excel 2007 or later version (I had Excel 2010) that I have found was online service called www.password-find.com. It exploited some new algorithm that allows removing password instantaneously (removed my within several seconds). However it does not work for 100% of documents, so check it by yourself - maybe the developers improved it since then. If your document is saved in old Excel 97-2003 format you may try Free Excel password Recovery that someone mentioned already - it may work if lost password is really simple. I hope my post will save you a huge amount of time I wasted looking for some problem resolution.
So as you see, Excel 2007/2010 protection can be cracked instantaneously, and thus can't be considered strong any more.