Analysis and Evaluation of the Windows Event Log - Bill Buchanan

Barrie Codona, BSc (Hons) Network Computing, 2007
For testing purposes it was initially limited to a 3 character key. The information in
Figure 56 was used. As it can be seen from Figure 57, after 20 seconds the brute force
cracker program successfully managed to find the key that was used to generate the
hash signature.
Original Key: zzz
Original String: test
Hash Signature: 0f0203fc9e5902739e7fb6434e7619c0caecc693
Figure 56: Three character key HMAC test data
Start Time
Finish Time
Figure 57: HMAC brute force application
This same test was again repeated with a 4 character key. Figure 58 shows the details
that were used. Figure 59 shows that it took 25 minutes to decode this one.
Original Key: zzzz
Original String: test
Hash Signature: f1e16dce22437e68581b664331cb2674ab2182fe
Figure 58: Found four character key
Figure 59: Found four character key
64