I've been told that if my bootloader is unlocked then it is easy for someone to install a new boot image and just brute force my passcode.

What is it about having the bootloader locked that makes it difficult to bruteforce the passcode? Is the encryption key derivation unique for each operating system image? What prevents someone from just hooking up the encrypted partition to another bootloader and bruteforcing it through there. What exactly is happening when the bootloader is locked and how does this protect against bruteforce attacks?

1 Answer 1


Of course you could break the encryption key outside of the device, however for doing so you need to access the central encryption header of the encrypted partition.

A locked system usually does not allow to read arbitrary data from flash. Hence you can't read/extract the required information unless you can run own code or attack disassemble the device and try to access the flash on hardware level.

If you can't install software to the device and don't attack on hardware level the only remaining way way is to use the password prompt UI provided by the operating system. O course attacking the key via UI is very slow compared to a GPU assisted brute-force attack.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .