# SD backup encryption vulnerable **URL:** \ **Category:** General\ **Created:** [December 21, 2024, 4:13pm UTC](https://community.foundation.xyz/t/sd-backup-encryption-vulnerable/231 "2024-12-21T16:13:07Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![anonfinn](https://community.foundation.xyz/letter_avatar_proxy/v4/letter/a/a88e4f/32.png) [@anonfinn](https://community.foundation.xyz/u/anonfinn)\ **Post date:** [December 21, 2024, 4:13pm UTC](https://community.foundation.xyz/t/sd-backup-encryption-vulnerable/231/1 "2024-12-21T16:13:07Z")
I read you article about encrypted microSD backup and noticed, that it only uses and allows to be used 20 digit key to encrypt it with 7zip. This method only gives “protection level” of about 54-64 bits of encryption (like old DES). Even with hashing with 100000 rounds its still only about 70-90 bits of security, which is completely breakable by a skillfull attacker with a lot of computing power. Why bother using AES-256 if you are only getting max 90 bits of security? 10^18 possibilities you say in your pages. Well, Antminer can do 200+ TH/s, which is 20^12. You put up 50 of those running and you get 10^15 per second. In 1000 seconds or 16,7 minutes you get it open. With just 1 Anthminer power it takes about 16 hours to get it open. If you must use digits as keys, you should have atleast 48 digits like Bitlocker recovery keys. This should have never happened. Who came up with this idea? Dont they/you understand mathematics & encryption? What is the logic behind here supposed to be? ---
**Author:** ![qna](https://community.foundation.xyz/user_avatar/community.foundation.xyz/qna/32/284_2.png) [@qna](https://community.foundation.xyz/u/qna)\ **Post date:** [December 22, 2024, 9:21am UTC](https://community.foundation.xyz/t/sd-backup-encryption-vulnerable/231/2 "2024-12-22T09:21:13Z")
Closing this as a duplicate of a recent topic here. Have also seen your email and a member of the team will respond asap. > [@Encrypted back up](https://community.foundation.xyz/t/encrypted-back-up/223/2): > > While I’m not positive how Coldcard handles their backup, [here](https://t.me/foundationdevices/1/10401) you have a response from our CTO regarding the diffculty of breaking a 20 digit code. Besides that, you can head over to [our blogs area](https://foundation.xyz/2023/01/why-we-love-encrypted-microsd-backups/) to read more on why we use encrypted backups. Hope this helps! ---
**Author:** ![qna](https://community.foundation.xyz/user_avatar/community.foundation.xyz/qna/32/284_2.png) [@qna](https://community.foundation.xyz/u/qna)\ **Post date:** [December 22, 2024, 9:21am UTC](https://community.foundation.xyz/t/sd-backup-encryption-vulnerable/231/3 "2024-12-22T09:21:46Z")