Practical bruteforce of military grade AES-1024 (2021) [video]

There is no such thing as AES-1024 specified by NIST. AES is a NIST standard, it has three (and only three) variants: AES-128, AES-192, and AES-256. If you see something other than those three, it&#x27;s almost certainly proprietary junk.<p>Note that AES is always used in a &quot;mode of operation&quot; to provide any sort of secure encryption. AE-secure modes are AES-SIV, AES-GCM-SIV, AES-OCB, and AES-GCM in decreasing order of safety&#x2F;performance (possibly others, but those are the most well reviewed and most used). Those sometimes get noted with the key length, eg AES-256-GCM-SIV, sometimes not.

&gt; SanDisk, and Lexar provide encryption software for their USB keys, hard drives, and other storage products.<p>I&#x27;m someone who bought several Sandisk devices over the years. The first thing I do after buying and unboxing is setup LUKS[0] on the device with the Disks utility in Ubuntu. These USB flash drives usually ship with an `.exe` piece of &#x27;security software&#x27; written to the disk, which I never execute because I don&#x27;t trust their claims. I prefer battle-hardened and trusted things like LUKS, instead of proprietary products that use snake-oil terms like &#x27;Military Grade&#x27;.<p>[0] <a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Linux_Unified_Key_Setup" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Linux_Unified_Key_Setup</a>

I was watching this just because it&#x27;s fun to see bad implementations. I was totally caught offguard when the vendor presented their own view of the problem! Did not see that coming. Makes for a more interesting presentation IMHO (both sides of the issue, no finger pointing)!<p>often we hear about how broken something is, very RARELY do you get to see the remediation action and decision making. Hats off to the guys at EncSecurity for stepping up to fix their issues AND sharing the lesson with the industry.

Isn&#x27;t key derivation function completely separate from aes implementation. I mean you could have used the same broken key derivation with some other aes implementation.<p>Also aes-1024 sounds like some proprietary thingy, not something people should probably trust anyway...

I&#x27;ve yet to see a good definition of what constitutes &quot;military grade encryption&quot; vs. regular old encryption. It generally has the opposite effect, for me at least, in the sense that I avoid any product that advertises &quot;military grade &lt;something&gt;&quot;.<p>Edit: I&#x27;m not <i>actually</i> looking for definitions of &quot;military grade encryption&quot;, thank-you everyone who tried to explain it though. I work in cybersec, and encryption is encryption. It is either compliant with standards or it is not. But &quot;military grade&quot; is pure marketing fluff, hence why I avoid it.

PSA: AES is not broken at all here. This is a break of a crap key derivation function that used MD5.<p>It shows that all components of a cryptosystem are important. Attacks seldom target things like actual ciphers unless it&#x27;s one known to be weak like RC4 or single-DES. They target bad constructions (like this), implementation bugs, etc.

Summary: AES was not really broken or brute forced at all. The title is clickbait, and also is factually wrong.<p>What really happened: Yet another random company simply implemented the password code wrong. This has nothing to do with the integrity of AES which remains unbroken in principle.<p>Nothing to see here.

&gt; PBKDF2 using 1000 iteration of MD5 to derive the encryption key. The salt used to derive the keys is constant and hardcoded in all the solutions and all the vendors.<p>I feel like this is being bad on purpose.

&gt; . It turned out that the key derivation function was PBKDF2 using 1000 iteration of MD5 to derive the encryption key. The salt used to derive the keys is constant and hardcoded in all the solutions and all the vendors. This makes it easier for an attacker to guess the user password of a vault using time&#x2F;memory tradeoff attack techniques such as rainbow tables and to re-use the tables to retrieve passwords for all users using the software. The implementation itself was incorrect and even with a randomly generated unique salt, it would be effortless to recover the password of a user. Other flaws of the key derivation function will be discussed and compared with nowadays good practices.<p>Yikes

&gt; multiple encryptions<p>Correct me if I am wrong, but isn&#x27;t AES a group, like DES? If so, encrypting twice under keys of the same strength is the same as encrypting once, with a different key.<p>This is why, e.g., 3-DES uses encryption-decryption-encryption, under different keys.

&gt;However, it turned out after the analysis that all these modes offer only a security level of 128-bit.<p>&gt;A plugin in John the ripper software to allow everyone to &quot;practically brute force military grade AES-1024&quot; will be released at the time of the presentation.<p>My understanding was that even 128-bit security is safe from brute forcing at the present. Am I missing something?

The software in question: <a href="https:&#x2F;&#x2F;www.encsecurity.com&#x2F;solutions.php" rel="nofollow">https:&#x2F;&#x2F;www.encsecurity.com&#x2F;solutions.php</a><p>(Technically, the actual software in the USB is white-labeled with the USB flash drive brand, but apart from that this is it.)

Considering the amount of free encryption software, a lot even opensource, where you just add your logo and a pdf with instructions, bundle the source in a zip file somewhere not to break GPL, and you&#x27;re done, fuckups like these seem more and more intentional to me.<p>Tech-savy users will always use &quot;the best&quot; tools, but for &quot;normal people&quot;, the police having the ability to decrypt their data, is a thing government wants. If the encryption is bundled, they&#x27;ll use the broken one, because the alternative (googling the software) will usually show them only the software that actually works.

The cracking script he wrote is at <a href="https:&#x2F;&#x2F;github.com&#x2F;openwall&#x2F;john&#x2F;blob&#x2F;bleeding-jumbo&#x2F;run&#x2F;encdatavault2john.py" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;openwall&#x2F;john&#x2F;blob&#x2F;bleeding-jumbo&#x2F;run&#x2F;enc...</a>

In this case it&#x27;s surely a military grade. Grade F to be precise :)

In case anyone else was confused wtf aes-1024 was. The tl;dr is they were chaining aes-128 multiple times.<p>The bruteforcing is about bruteforcing pbkdf2 w&#x2F; only 1000 iterations being used with user passwords, and doesn&#x27;t have anything to do with aes

To be clear, this isn’t a break of AES itself, but the implementation of a whole system, of which AES is a part.

stopped reading at &quot;military-grade&quot;