How much is the private-key in a keystore resilient to bruteforce?

Question

I was wondering how safe would be my key if someone can put his hands on my Keystore File (UTC / JSON) created with MyEtherWallet. I've used in the past hashcat and so I know it can easily find the plaintext of a medium length password in a reasonable time starting from his hash, even with just a normal GPU. So can the keystore be bruteforced in the same easy way? Or in other words how long should be the password to be safe?

Answer 1

In fact, the KDF has got almost nothing to do with the overall security of your wallet. Here is why:

Key Derivation Functions

A KDF adds computational entropy to a user's password. The only reason a KDF is needed is due to the mere fact that humans are bad at passwords (meaning there passwords are predictable). Humans tend to construct passwords like P@ssw0rd! which seem to have a mathematically high entropy (9 characters, lower/uppercase, numbers, special chars) but apparently suffer from predictability.

However, if you are using a strong password as your AES key anyway (i.e. not a human generated but for example a 128 bit CSPRNG), there is no need to use a KDF at all (a potential attacker would probably try a different approach and attack your encryption directly instead of your KDF).

You're right, though: The KDF adds some computational entropy and is built for slowing the attacker down by increasing the complexity that the attacker has to overcome. For k iterations, the added complexity is about log2(k) bits (more info). Of course this is just a hypothetical value and you don't want to rely on it. Better pick a strong password in the first place.

The theoretical math

Let's do the math for your case and suppose that you're using an average password (32 bit of entropy) and 1024 iterations (number is mentioned as n in your config). 32 + log2(1024) = 42 bits of entropy

Now, the actual feasibility of an attack only depends on the attacker's computational resources and money respectively. If he's able to do 10 thousand guesses per second an attack will take

2^42 / (10000 * 3600 * 24 * 356) = 14 years

What's really important

Please bear in mind that the 14 years and other results are all theoretical. The real lesson learned: The KDF is negligible if you want to know the real security of your wallet. If you pick a password like "1234" while lower/uppercase, numbers and special chars are allowed neither the KDF nor the AES will help you and your wallet cannot be considered secure.

Eventually, the security of your wallet depends on your password and its entropy. Protect your wallet with a strong password and you're safe.

Answer 2

Looking into the keystore file I found that all the crypt algorithm are specified.. As KDF algorithm is used "scrypt" with the following options "n":1024,"r":8,"p":1.

I don't know exactly how that translates in number of tries per seconds for an avarage hardware, but it should be bruteforce resilient.