Brute Force Attack

This page outlines one of the major threats: Brute Force attacks.

In cryptography, a brute-force attack consists of an attacker submitting many passwords or passphrases with the hope of eventually guessing correctly. The attacker systematically checks all possible passwords and passphrases until the correct one is found.

In a brute force attack, attackers often use high-speed ASIC equipment, similar to Bitcoin mining machines. These devices are approximately (10^6) times faster than modern CPUs.

Assumptions

• Character Set Size: 94 (26 uppercases + 26 lowercases + 10 digits + 32 special characters)

• Passphrase Length: 12 characters

• Scrypt Parameters: (N: 2^15, r: 8, p: 5)

• Scrypt Computation Time: Approximately 0.5 seconds on a modern CPU. For the sake of this analysis, we assume an ASIC speed-up factor of 10^6, making it 5 * 10^-7 seconds per computation.

Analysis

• Size of Possible Passphrase Space:

$$94^{12} \approx 4.7 \times 10^{23}$$

• Hashes per Second by Fastest ASIC:

$$\text{Hashes per second} = \frac{1}{5 \times 10^{-7}} = 2 \times 10^6 \text{ scrypt computations per second}$$

• Time to Brute Force:

$$\text{Time (in seconds)} = \frac{4.7 \times 10^{23}}{2 \times 10^6} \approx 2.35 \times 10^{17} \text{ seconds}$$

• Convert Seconds to Years:

$$\text{Years} = \frac{2.35 \times 10^{17}}{60 \times 60 \times 24 \times 365} \approx 7.54 \times 10^9 \text{ years} \approx 7.54 \text{ billion years}$$

Even using the fastest known ASICs, a brute force attack would take approximately 7.54 billion years, making it impractical.

Additional Consideration: The Role of the Passcode

In the above analysis, we focused strictly on the complexity of a single passphrase, but the actual security of the wallet is even stronger because the pair of passphrase and PIN determines the private key and wallet address.

By requiring both inputs, the system effectively creates a high-entropy, multi-factor credential that acts as a self-contained salt for the key derivation process. This means that even if a common passphrase is used, the addition of a unique PIN drastically increases the difficulty of a successful attack, as an attacker must guess the exact combination of both secrets to gain access.