<story><title>WTF is a KDF?</title><url>https://blog.dataparty.xyz/blog/wtf-is-a-kdf/</url></story><parent_chain><item><author>mr_mitm</author><text>It really annoys me how everyone takes that statement that a 20 character password has been cracked at face value. If it was randomly generated, it is physically impossible to crack even if it was hashed with MD5. It&amp;#x27;s also unlikely that somebody memorized 20 random characters. It is much more likely that the passphrase was weak because it&amp;#x27;s the title of a Wikipedia article or contained in some public word list.&lt;p&gt;Also, by going with the original article (&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;nantes.indymedia.org&amp;#x2F;posts&amp;#x2F;87395&amp;#x2F;une-lettre-divan-enferme-a-la-prison-de-villepinte-perquisitions-et-disques-durs-dechiffres&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;nantes.indymedia.org&amp;#x2F;posts&amp;#x2F;87395&amp;#x2F;une-lettre-divan-en...&lt;/a&gt;), which I translated using DeepL, this is what we know:&lt;p&gt;&amp;gt; &lt;i&gt;As far as the investigation is concerned, in recent months new elements have been added to the file. The most significant is that the police managed to gain access to my computers, even though they were encrypted. The one at work, on which Windows is installed, is encrypted with BitLocker. _A previous report in the file says that they had already tried to access it while I was in police custody but had not succeeded._ But in September the Brigade d&amp;#x27;appui en téléphonie, cyber-investigation et analyse criminelle (BATCIAC) sent a copy of the hard disk to the SDAT. In the PV, they only explain that they booted the computer with a bootable USB key and then used the software AccesData FTK imager 3.3.05 to copy the hard disk. But they don&amp;#x27;t talk about the decryption itself.&lt;/i&gt;&lt;p&gt;&amp;gt; &lt;i&gt;My personal computer, which runs Ubuntu 18, is encrypted with Luks (the password is more than twenty characters: letters, numbers, punctuation marks...). I couldn&amp;#x27;t find any indication in the file about how they decrypted it, but there too they made a copy of the hard disk. There are even files that had been deleted and emails that had been downloaded with Thunderbird (and then deleted). They didn&amp;#x27;t find anything that could be related to the fires I&amp;#x27;m charged with. But I think the very fact that they were able to access hard drives encrypted with supposedly unbreakable software should be made as widely known as possible.&lt;/i&gt;&lt;p&gt;This clearly hints at an evil maid attack, which we always knew were a real risk when it comes to full disk encryption.</text></item></parent_chain><comment><author>rhplus</author><text>He says his BitLocker drive was on a work computer. If it was managed through Active Directory then those key may have been recoverable through his employer.&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;learn.microsoft.com&amp;#x2F;en-us&amp;#x2F;windows&amp;#x2F;security&amp;#x2F;information-protection&amp;#x2F;bitlocker&amp;#x2F;bitlocker-recovery-guide-plan&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;learn.microsoft.com&amp;#x2F;en-us&amp;#x2F;windows&amp;#x2F;security&amp;#x2F;informati...&lt;/a&gt;</text></comment>
<story><title>WTF is a KDF?</title><url>https://blog.dataparty.xyz/blog/wtf-is-a-kdf/</url></story><parent_chain><item><author>mr_mitm</author><text>It really annoys me how everyone takes that statement that a 20 character password has been cracked at face value. If it was randomly generated, it is physically impossible to crack even if it was hashed with MD5. It&amp;#x27;s also unlikely that somebody memorized 20 random characters. It is much more likely that the passphrase was weak because it&amp;#x27;s the title of a Wikipedia article or contained in some public word list.&lt;p&gt;Also, by going with the original article (&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;nantes.indymedia.org&amp;#x2F;posts&amp;#x2F;87395&amp;#x2F;une-lettre-divan-enferme-a-la-prison-de-villepinte-perquisitions-et-disques-durs-dechiffres&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;nantes.indymedia.org&amp;#x2F;posts&amp;#x2F;87395&amp;#x2F;une-lettre-divan-en...&lt;/a&gt;), which I translated using DeepL, this is what we know:&lt;p&gt;&amp;gt; &lt;i&gt;As far as the investigation is concerned, in recent months new elements have been added to the file. The most significant is that the police managed to gain access to my computers, even though they were encrypted. The one at work, on which Windows is installed, is encrypted with BitLocker. _A previous report in the file says that they had already tried to access it while I was in police custody but had not succeeded._ But in September the Brigade d&amp;#x27;appui en téléphonie, cyber-investigation et analyse criminelle (BATCIAC) sent a copy of the hard disk to the SDAT. In the PV, they only explain that they booted the computer with a bootable USB key and then used the software AccesData FTK imager 3.3.05 to copy the hard disk. But they don&amp;#x27;t talk about the decryption itself.&lt;/i&gt;&lt;p&gt;&amp;gt; &lt;i&gt;My personal computer, which runs Ubuntu 18, is encrypted with Luks (the password is more than twenty characters: letters, numbers, punctuation marks...). I couldn&amp;#x27;t find any indication in the file about how they decrypted it, but there too they made a copy of the hard disk. There are even files that had been deleted and emails that had been downloaded with Thunderbird (and then deleted). They didn&amp;#x27;t find anything that could be related to the fires I&amp;#x27;m charged with. But I think the very fact that they were able to access hard drives encrypted with supposedly unbreakable software should be made as widely known as possible.&lt;/i&gt;&lt;p&gt;This clearly hints at an evil maid attack, which we always knew were a real risk when it comes to full disk encryption.</text></item></parent_chain><comment><author>st_goliath</author><text>Thanks! Reading the article, I was already wondering myself: Do we already &lt;i&gt;know&lt;/i&gt; any of this &lt;i&gt;for fact&lt;/i&gt;, or is this just more wild mass guessing?&lt;p&gt;The article doesn&amp;#x27;t seem to cite any new sources other than people speculating on twitter&amp;#x2F;mastodon. Following down the social media rabbit hole, I end up back at the article that sparked the debate 5 days ago. Some RFCs and product data sheets are cited to support the back-on-the-napkin calculations (also cited from social media), but do we have any credible source yet to confirm that&amp;#x27;s what really happened here?</text></comment>