Free TrueCrypt Hard Drive Password Cracking

http://16s.us/TCHead/cracked/

by 16s • 14 years ago

39 25 14 years ago

16s.us

atarian• 14 years ago

>Strong passwords will not be cracked. It's not possible.

What qualifies as a "strong password" against such a tool?

16s2• 14 years ago

For whole disk encryption (WDE) or any sort of password protected service where you cannot execute software (primary authentication), I encourage the use of pass phrases. Dice ware is nice. Something such as this:

"lua ham purple day girl"

The challenge with primary authentication passwords is that users typically cannot use a password manager or generator to recall the password and thus must be able to recall something that they can easily type and end-up selecting weak passwords. There are some exceptions to this (yubikey, etc) but most normal users don't or cannot use them for various reasons, so go with a nice pass phrase like the one above.

spuz• 14 years ago

What qualifies as a crackable password for this tool? What is the maximum length and complexity you can handle?

cowsaysoink• 14 years ago

For disk encryption and keepass databases I like to go with full sentence but odd passphrases.

Like:

    Cats and cows eat 200 tables a day.
    
    The grape is 14 shades of orange.

naner2• 14 years ago

If we know the "algorithm" for your password choice (all lowercase, english words, space delimited, at least two words) that greatly reduces the time needed to guess the password. I wonder how much time that would take to crack on modern hardware...

ditoa• 14 years ago

For those on Windows without access to a *nix machine you can grab a Windows binary of dd at http://www.chrysocome.net/dd the command arguments are the same as on the site.

jakubp• 14 years ago

Can someone explain in plain English what is the purpose of this tool for an actual TrueCrypt user? I'm confused what it does, other than perhaps demonstrating weakness of certain passwords, or maybe some vulnerability in the way TC works.

lambada2• 14 years ago

As I understand it, it attempts to decrypt a TC volume (and any hidden volume contained within) by brute-forcing the password and using a dictionary of some kind.

Essentially it just tries to open the volume with many passwords in quick succession. So there isn't a vulnerability in Truecrypt itself, and complex / long passwords are unlikely to be found with this tool.

joelthelion• 14 years ago

If the dictionnary attack is very fast, it is a vulnerability in TrueCrypt.

A good encryption scheme uses a slow hashing scheme and salt to defeat such attacks.

16s2• 14 years ago

It just cracks weak TrueCrypt WDE passwords. That's all. You'd be amazed how many people still use 'password' as their password.

jrockway• 14 years ago

Does TrueCrypt apply a key strengthening step to the password?

tedunangst• 14 years ago

2k round pbkdf2 iirc.

Free TrueCrypt Hard Drive Password Cracking

Related Stories