3

Long story short, I share a server with a few other people and store my backups there. All these backups are archived to a .7z file using AES-256 encryption, using a randomly-generated password of about 100 bits of entropy. Assuming my backups became public, how hard would it be to access their contents in 2018 and beyond?

  • 1
    @kelalaka AES-256 is encryption, not a hashing function. OP, this post might interest you: crypto.stackexchange.com/questions/46559/… – Ian Dec 13 '18 at 15:19
  • 2
    @Ian I've given only for comparison. The real numbers will be only a ratios SHA-1 vs AES-256 speed. This might more interest crypto.stackexchange.com/questions/1145/… – kelalaka Dec 13 '18 at 15:22
  • 2
    in the end, the attacker will try to find the passphrase if nothing else included in the key generation. It is easier than to break the full AES-256 keys. – kelalaka Dec 13 '18 at 15:31
  • 1
    @kelalaka Keep in mind that these figures are for hashes not for password hashes which are a completely different thing despite the confusingly similar name. What matters most for this question is how 7z hardens the password. I remember from a previous question on this site that zip does it properly (excluding some antique versions). I don't know about 7z, I would hope that it does but I can't state this as a fact. – Gilles Dec 14 '18 at 8:03
  • 1
    @Gilles Yes, I've found this At least from version 3.x, 7-Zip has been using a strong AES algorithm, which doesn't allow any attacks more effective than the brute force. Besides, the key derivation function is very similar to RAR one, and uses more than 130000 SHA-256 transformations and brute force rate on modern CPU is very low, only several hundreds of passwords per second. This carries inference that 7-Zip password encryption is one of the strongest between popular encryption systems in the context of brute force rate. – kelalaka Dec 14 '18 at 13:03
1

All of the comments assume a brute force attack against the encrypted file. In cryptography, however, this is far from the only attack to consider.

As an example, AES-256 is generally considered 'computationally secure' by modern standards but there a lot of assumptions in just saying that. Computationally secure means that while it's secure by modern standards, history has proven it won't always be secure. AES operates in different modes (CBC, ECB, CFB, OFB, CTS) -- each with their own targeted attacks against each mode.

As an example in Cipher Block Chaining, after the first round, the cipher text from the previous round is xor'd with the plaintext in the current block but circling back to the first round, the encryptor must be provided the first bits of randomness (called the Initialization Vector or IV). If this isn't done properly, this can be used to systematically derive the ciphertext that's xor'd in all for each subsequent blocks and thus, providing the unCBC'd ciphertext that can be statistically analyzed or brute forced to derive the key.

Additionally, your password can be targeted. You already leaked some interesting information about it.

  • You said it was randomly generated with 100-bits of entropy and around 20 chars. With that, I can roughly derive the keyspace and probably make an educated guess as to the randomness (uppers, lowers, numbers, and a handful of common specials).
  • You said it was randomly generated... was it cryptographically randomly generated or did it use a pseudo-random number generator? Most PRNGs have significant weakness (e.g. based on atomic clock values) -- so if I know when the file was created, file metadata or in the filename itself, I might be able derive the seed and generate the same value you did at that time, thus significantly limiting the effectiveness of the 'randomness' almost to the point of negating it.
  • You said it was a passphrase, and not a password. This also leaks information. If true, it means your password probably isn't really cryptographically secure (e.g. 1r5%vb9*?_ad!@KLvnd) and probably something closer to I<3G0ldenR3tri3v3rs!!. L337 speak is not cryptographically secure and good cracker will have dictionary files with common l337 speak variations on common words to significantly lower the time to crack.

So... to answer your question on how hard would it be to access their contents in 2018 and beyond? -- it highly depends on a number of factors.

  • "the encryptor must be provided the first bits of randomness (called the Initialization Vector or IV). If this isn't done properly, this can be used to systematically derive the IVs for each subsequent block and thus, elluding to the initally supplied randomness (e.g. password/passphrase/etc.)" - It's a bit hard to tell, but are you actually claiming that a predictable IV would both completely break confidentiality and reveal the key used? – AndrolGenhald Dec 13 '18 at 19:19
  • "You said it was randomly generated with 100-bits of entropy and around 20 chars. With that, I can roughly derive the keyspace and probably make an educated guess as to the randomness (uppers, lowers, numbers, and a handful of common specials)." - 100 bits in 20 characters is 5 bits per character, which means a character space of 32. Your educated guess of uppercase, lowercase, digits, and special characters makes no sense. – AndrolGenhald Dec 13 '18 at 19:21
  • @AndrolGenhald, first comment: no, in CBC, only the first block in interesting for cryptanalysis because of how CBC works with using previous blocks on each subsequent round. But if the IV can be derived, then the an attacker can remove the CBC additional protections and just get to the ciphertext of just the password. – thepip3r Dec 13 '18 at 19:29
  • "this can be used to systematically derive the IVs" is what is confusing me, by definition the IV is only used for the initial block. For CBC sometimes people call block n the "IV" for block n+1 since it's what is xored with it, but that doesn't make sense either because there's no need to "derive" them, you already have them because they literally are the ciphertext. – AndrolGenhald Dec 13 '18 at 19:34
  • 2
    This answer is mostly irrelevant. CBC has weaknesses, but do they apply to 7z encryption? The discussion of password structure is not relevant except to question the assertion that the password actually has 100 bits of entropy. A statement like “the password is generated with 100 bits of entropy” assumes that the attacker knows the structure. Either the statement is correct, and the discussion of the password structure is irrelevant, or the statement is not correct. The crucial thing for security here is what 7z does to harden the password. – Gilles Dec 14 '18 at 8:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy