# How much is the private-key in a keystore resilient to bruteforce?

I was wondering how safe would be my key if someone can put his hands on my Keystore File (UTC / JSON) created with MyEtherWallet. I've used in the past hashcat and so I know it can easily find the plaintext of a medium length password in a reasonable time starting from his hash, even with just a normal GPU. So can the keystore be bruteforced in the same easy way? Or in other words how long should be the password to be safe?

• Apr 20, 2017 at 16:22
• Apr 20, 2017 at 16:22
• @RichardHorrocks I've seen that is used AES128, but I think to know how secure it is against bruteforce, it's important to know the hash algorithm used to derive the AES key from the password Apr 20, 2017 at 16:48

In fact, the KDF has got almost nothing to do with the overall security of your wallet. Here is why:

## Key Derivation Functions

A KDF adds computational entropy to a user's password. The only reason a KDF is needed is due to the mere fact that humans are bad at passwords (meaning there passwords are predictable). Humans tend to construct passwords like P@ssw0rd! which seem to have a mathematically high entropy (9 characters, lower/uppercase, numbers, special chars) but apparently suffer from predictability.

However, if you are using a strong password as your AES key anyway (i.e. not a human generated but for example a 128 bit CSPRNG), there is no need to use a KDF at all (a potential attacker would probably try a different approach and attack your encryption directly instead of your KDF).

You're right, though: The KDF adds some computational entropy and is built for slowing the attacker down by increasing the complexity that the attacker has to overcome. For k iterations, the added complexity is about log2(k) bits (more info). Of course this is just a hypothetical value and you don't want to rely on it. Better pick a strong password in the first place.

## The theoretical math

Let's do the math for your case and suppose that you're using an average password (32 bit of entropy) and 1024 iterations (number is mentioned as n in your config). 32 + log2(1024) = 42 bits of entropy

Now, the actual feasibility of an attack only depends on the attacker's computational resources and money respectively. If he's able to do 10 thousand guesses per second an attack will take

2^42 / (10000 * 3600 * 24 * 356) = 14 years

## What's really important

Please bear in mind that the 14 years and other results are all theoretical. The real lesson learned: The KDF is negligible if you want to know the real security of your wallet. If you pick a password like "1234" while lower/uppercase, numbers and special chars are allowed neither the KDF nor the AES will help you and your wallet cannot be considered secure.