One of the most powerful attacks one can mount on encrypted data is a Dictionary Attack. A dictionary attack is a form of a brute force attack, which simply tries every single combination of a key against encrypted data. However, in most cases, this is not needed. User passphrases are unfortunately sometimes based on real words, dates, names, etc. We can eliminate most of the pass-phrase combinations by simply testing for most probable 30,000 words. An English dictionary is a good place to start, hence the term Dictionary Attack. This means that a key with a 128 bit key space, which has 3.4 x 1038 possible combinations, has just been reduced to just over 30,000 (somewhere between 11 and 12 bits). A computer that can process just 1 pass-phrase per second can run through the dictionary in just over 8 hours.
Download the paper in PDF format here.
By subscribing to our early morning news update, you will receive a daily digest of the latest security news published on Help Net Security.
With over 500 issues so far, reading our newsletter every Monday morning will keep you up-to-date with security risks out there.