Greetings SE security community.

Background: I have a number of items like certificates, databases, and encrypted file systems that require private keys. In order to avoid having duplicates of these keys on the different systems that use them, I'd like to keep them all in a secure portable location, like an encrypted flash drive. While looking at options for hardware-encrypted flash drives, I noticed that all of them (biometric authentication-based models excluded) had relatively short maximum password/passphrase/PIN lengths. They tended to cap at 16 chars, some even lower; as I'm used to applications like TrueCrypt and KeePass (which have very high password and key length options), this seemed insecure.

Question: When using a secure element for hardware-based encryption that is actually secure and infeasible to tamper with; and assuming that feeding guesses to the device will result in destruction of the data after a very small number of incorrect attempts (e.g. 10); and that the password chosen is not easily human-guessable (a birthday, pet's name, etc); how important is it to have a password whose length and/or complexity makes it computationally infeasible to crack?

Simple Version: Does the password used to authenticate to a hardware token need to be strong, or will an adversary never be able to try cracking it anyway?

1 Answer 1


The usual computations on password entropy take place in the context of a dictionary attack, especially an offline dictionary attack, where the attacker can try passwords at will without locking anything. When there is an auto-locking tamper-resistant hardware, the context changes.

Conceptual view: there are N possible passwords (to simplify the exposition, I suppose that the possible passwords are equiprobable). The attacker may realistically try K of these passwords. The attacker's probability of success is then K/N. Security is ensured when that probability is sufficiently low that the attacker finds it not worth the effort. Let's arbitrarily set that threshold at 1/1000: if the attacker's probability of success, after (say) one week of cracking efforts, is still only one in a thousands, then he will decide to spend his time on something else (e.g. buying lottery tickets).

When the attacker can obtain a hashed version of the password, K will range from millions (if a good password hashing function like bcrypt was used, with enough iterations) to millions of billions (if a poor password hashing function was used, e.g. a single SHA-1 invocation). To achieve our 1/1000 threshold, N will have to be in (at least) the billions range.

With a device that autolocks after 10 wrong tries, K = 10. The threshold is reached with N = 10000, which is a very small space of possible passwords; you get that with a four-digit code. This is how such an autolock feature makes small/easy passwords satisfyingly secure.

Credit cards with chips do that (usually with K = 3).

  • I understand the mathematical principles of password security; I worded my question poorly. It was intended to be more about the feasibility of an attacker obtaining the hash used to access a secure hardware element, thereby enabling an offline attack which bypasses the lockout mechanism and depends entirely on the security of the password. Commented Jul 28, 2014 at 19:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .