NetAction's Guide to Using Encryption Software

Appendix A:
"Brute Force" Cracking

As discussed in section 5, "What are the vulnerabilities in encryption and how do I guard against them?," "brute force" cracking is a method of finding a password or key by trial and error. The longer the password or key, the more difficult it becomes to crack it. For example, a 56-bit key has 256 possible keys. That's up to 72,057,594,037,927,936 – seventy-two quadrillion – keys that must potentially be tried in order to find the correct one.

That doesn't mean that a 56-bit key is strong enough to prevent successful brute force attacks. Even back in 1997 when desktop computers were much less powerful than current models (this guide was written in September 2001), a distributed computing effort cracked the RSA's 56-bit RC5 encryption in less than 250 days. (See an article on the effort. A distributed computing effort is one in which many computers share the task of testing the seventy-two quadrillion possible combinations of bits.) In 1998, a similar effort took just 39 days using 50,000 computers. Those computers tried 85% of the possible combinations, at speeds that at times reached 26 trillion keys per second, before finding the right key. Another 1998 effort, by the Electronic Frontier Foundation, took only 3 days to crack a 56-bit DES key using a special computer called the DES (Data Encryption Standard) Cracker.

In some cases, viruses have invaded computers and used their computing power without the owner's knowledge. ( has a story about a malicious cracker who launched a denial-of-service attack that flooded a computer with more data than it could process, using 474 Microsoft Windows computers without their owners' knowledge.)

Fortunately, increasing the number of bits in a key exponentially increases the number of possible keys that would have to be tested with the "brute force" method. So, a 128-bit key could be any one of 3.4 * 1038 keys, a 192-bit key could be any one of 6.2 * 1057 keys, and a 256-bit key could be any one of 1.1 * 1077 keys. A note at the U.S. Computer Security Resource Center's Advanced Encryption Standard FAQ states:

In the late 1990s, specialized "DES Cracker" machines were built that could recover a DES key after a few hours. In other words, by trying possible key values, the hardware could determine which key was used to encrypt a message. Assuming that one could build a machine that could recover a DES key in a second (i.e., try 255 keys per second), then it would take that machine approximately 149 trillion years to crack a 128-bit AES key. To put that into perspective, the universe is believed to be less than 20 billion years old.

Note that these efforts are per key; if you were to divide the data you were encrypting into 10 subsections and used a different key for each of the subsections, this decryption process would need to be repeated 10 times.

To summarize, brute force cracking can be significantly slowed with strong encryption, (essentially, just using longer keys) and slower algorithms. Modern strong encryption should be able to hold off all but the best-funded efforts by crackers with lots and lots of time on their hands. Encryption can make data access difficult enough that a malicious cracker may decide to look for an easier target rather than spending resources attempting to crack strong encryption.

Next: Appendix B: What are the different kinds of algorithms that encryption software programs utilize? | Back to Guide