Im not sure about the others, but there is no way your going to be able to crack any modern encryption algorithm or hash function by any means in a reasonable time frame via brute force. A dictionary attack is certainly possible, but most people are using some type of multi-word\number\symbol\caps password, so unless you get lucky and the password is just a single english word without any special symbols\casing\numbers, your SOL.

It would take all the computers in the world 100's of years in order to crack modern algorithms with shear brute force, and most algorithms have been analyzed for years without any vulnerabilities found.

TrueCrypt is actually not that hard to get around depending on your you use it unfortunately.  If you have physical access to the machine using TrueCrypt volumes it's usually quite possible to get the key.

The decryption key is stored in memory every time you access your encrypted volume.  Any small piece of malware that might slip in can easily steal the keys from needed to decrypt the volumes right from live memory.  Anti-malware really only useful against mainstream known stuff.  It's not too hard to write a small program and keep it to yourself that wont be detected by anti-malware.

Another way is by using Firewire.  If your PC is turned on and even if it's locked or in sleep mode anyone can dump the entire contents of your RAM out to a storage device.  Firewire simply has a huge design flaw in that any device connected to it is automatically granted root access to all system memory.


On the topic if brute forcing.  You would be surprised in the speed in which you can brute force passwords with large enough rainbow tables. Now that 3TB hard drives are out people can easily carry around their 3TB rainbow tables and brute force like never before.

You can read up lots of possible attacks and vulnerabilities here:

http://www.truecrypt.org/docs/paging-file
http://www.truecrypt.org/docs/hibernation-file
http://www.truecrypt.org/docs/memory-dump-files
http://www.truecrypt.org/...nencrypted-data-in-ram
http://www.truecrypt.org/docs/physical-security
http://www.truecrypt.org/docs/malware
http://www.truecrypt.org/../multi-user-environment
http://www.truecrypt.org/...enticity-and-integrity
http://www.truecrypt.org/...passwords-and-keyfiles
http://www.truecrypt.org/docs/trim-operation
http://www.truecrypt.org/docs/wear-leveling
http://www.truecrypt.org/docs/reallocated-sectors
http://www.truecrypt.org/docs/defragmenting
http://www.truecrypt.org/...ournaling-file-systems
http://www.truecrypt.org/docs/volume-clones

As you can see, there are quite a few vulnerabilities.

Here are some real examples of actual software that exists to take advantage of some of these vulnerabilities and attacks:

http://www.mydigitallife.info/2008/07/24/bitlocker-filevault-dm-crypt-and-truecrypt-encryption-key-crack-via-dram-cold-boot-attack-with-program-source-code-download/

http://www.lostpassword.com/hdd-decryption.htm


There are definitely additional measures you can take to stay more secure but you can never be absolutely secure unfortunately. 

As far as the software here: Passware.  It's actually quite fast at brute forcing Office and RAR encrypted files.  I have used it personally.  I have also used it to successfully decrypt a TrueCrypt volume from a laptop that had full disk encryption enabled but was left in sleep mode with a working Firewire port.  These were done as labs in my Security class in my Senior year at College last year so I do have at least a bit of experience with this stuff.  However I am no expert, experts have even more tricks up their selves  that I couldn't even imagine :P

hehe I just had a deja vous experience after reading lehpron's post :)

I'm not an expert in cryptography but what I do know matches with what SirMaster said.  Brute force combined with dictionary attacks are not 100% effective but given the average user password, their lack of knowledge of what makes a password difficult to crack, and efficient hardware cracking platforms like GPGPU I wouldn't rule anything out.

honestly if someone wanted to break into your house and have physical acess to your machine, I dont think they would waste time trying to crack your encryption. They would most likely just grab the entire pc and leave LOL. the best protection is to bolt your case to the ground or stick it inside of a cabinet (rackmount, with room for pc's) and lock it down.

Brute force iso nly powerful as the dictionary you're using. Modern password encryptions could be cracked, but they are difficult/timely to decrypt. 128bit can easily be cracked. AES 256 is far difficult. I cant go into specifics here, the process is forbidden/illegal and DOES NOT involve dictionary attacks. If you want to know more about how it works visit the backtrack forums. There si a thread that examine all levels of password encryption on popular OS's and tools including truecrypt.

Good info Rudster816, however I can prove to you that AES 128 is quite easy to crack, but not in all scenarios. For example bitlocker/filevault on the windows/mac OS utilizes AES 128bit encryption. Now it is illegal for me to explain the process since it violates microsoft/apple's EULA. Here is a paper from a scientist at Princton University explaining exactly how it works. These are exploits carried out on the data that remains on RAM/OS in order to manipulate the encryption method, using the "Cold Boot" attack. But like I said before it wont work in every scenario. Apple has found a way to prevent this by enabling secure erase virtual ram by default.

[link=http://citp.princeton.edu.nyud.net/pub/coldboot.pdf]http://citp.princeton.edu.yud.net/pub/coldboot.pdf [/link]

The GPU has nothing to do with . If the rar password you use is complex, it takes more time to unlock. Otherwise, you don't need to spend too much time. There are many free ways to unlock rar, like using notepad and password-online. It is wise to use the software if the free method does not work.