Brute Force Attack

This page outlines one of the major threats: Brute Force attacks.

In cryptography, a brute-force attack consists of an attacker submitting many passwords or passphrases with the hope of eventually guessing correctly. The attacker systematically checks all possible passwords and passphrases until the correct one is found.

In a brute force attack, attackers often use high-speed ASIC equipment, similar to Bitcoin mining machines. These devices are approximately (10^6) times faster than modern CPUs.

Assumptions

• Character Set Size: 94 (26 uppercases + 26 lowercases + 10 digits + 32 special characters)

• Password Length: 12 characters

• scrypt Parameters: (N: 2^15, r: 8, p: 5)

• scrypt Computation Time: Approximately 0.5 seconds on a modern CPU. For the sake of this analysis, we assume an ASIC speed-up factor of 10^6, making it 5 * 10^-7 seconds per computation.

Analysis

• Size of Possible Password Space:

$$94^{12} \approx 4.7 \times 10^{23}$$

• Hashes per Second by Fastest ASIC:

$$\text{Hashes per second} = \frac{1}{5 \times 10^{-7}} = 2 \times 10^6 \text{ scrypt computations per second}$$

• Time to Brute Force:

$$\text{Time (in seconds)} = \frac{4.7 \times 10^{23}}{2 \times 10^6} \approx 2.35 \times 10^{17} \text{ seconds}$$

• Convert Seconds to Years:

$$\text{Years} = \frac{2.35 \times 10^{17}}{60 \times 60 \times 24 \times 365} \approx 7.54 \times 10^9 \text{ years} \approx 7.54 \text{ billion years}$$

Even using the fastest known ASICs, a brute force attack would take approximately 7.54 billion years, making it impractical.