1

While discussing with another friend the insecurity with some wifi systems against dictionary attacks we couldn't reach a common ground on how big a WPA wordlist dictionary would be for the most common password we work with here.

Not knowing if my calculations are correct or not, I've reached the estimated size of ~14Tb while my friend says that it is over 20Tb. Without any way to be certain of who is doing the math correctly I have decided to ask here for help on this matter.

The question is as the title says; How big a file will be for a wordlist composed of 10 HEX characters (for each word, each character can be from 0 to 9 or A to F) with the following conditions:

  • Each character cannot appear more than 3 times in the entire word
  • The words are all capitalized, no lower caps

We have tried to calculate these values with Permutations and Combinations (and without them), but with no way to confirm the results we can't tell if we used the correct methods for the intended goal.

Yonez
  • 113

1 Answers1

0

The trick is enumerating all of the ways that the repeat groups can be split up.

No repeating characters is easy: $KLMNOPQRST$.

Characters not repeating or repeating once is also easy:

$$KKLMNOPQRS, KKLLMNOPQR, KKLLMMNOPQ, KKLLMMNNOP, KKLLMMNNOO.$$

Characters not repeating, repeating once, or repeating twice gives the most.

If one character repeats twice:

$$KKKLMNOPQR, KKKLLMNOPQ, KKKLLMMNOP, KKKLLMMNNO.$$

If two characters repeat twice:

$$KKKLLLMNOP, KKKLLLMMNO, KKKLLLMMNN.$$

If three characters repeat twice:

$$KKKLLLMMMN.$$

And that's it for the groupings.

Now for each grouping, you have to choose which hex characters, and then choose their order.

You specify that a "hex character" is a hexadecimal digit between $0$ and $F$ ($0$ to $15$ decimal).

Let's do the case $KKKLLMMNNO$.

First choose which character is repeated twice ($_{16}C_1$), then choose the places where it goes in the word ($_{10}C_3$).

Next, choose the three characters from what's left that are repeated once ($_{15}C_3$). Assign the smallest character to $L$, the next largest to $M$, and the largest to $N$. (This prevents counting duplicates.) Then, choose the two locations for $B$ from what's left ($_7C_2$), then $C$ ($_5C_2$), and then $D$ ($_3C_2$).

There's no choice where to put $O$ now, but you still choose what it is ($_{12}C_1$).

So, the number of possible words with one character repeated twice, three repeated once, and one not repeated is:

$$N(KKKLLMMNNO) = 16 \cdot \frac{10 \cdot 9 \cdot 8}{3 \cdot 2} \cdot \frac{15 \cdot 14 \cdot 13}{3 \cdot 2} \cdot \frac{7 \cdot 6}{2} \cdot \frac{5 \cdot 4}{2} \cdot \frac{3 \cdot 2}{2} \cdot 12.$$

That's one of fourteen cases.

Then, after you've calculated them all, add them up and multiply the sum by $8 \cdot 10$ to get the number of bits in the file.

John
  • 26,319
  • Thanks for the detailed response. I have updated what the Hexadecimal character list was, which isn't double digit but single from 0-9 and A-F.

    Regarding the combinations, shouldn't they be (16C3 * 13C3 * 10C3) (7 * 10)?

    The first 3 groups are for the 3 possible repetitions or lower for each character and 7 being the remaining characters times the 10 different positions it can be in? Or in this case it really has to be threated in 3 different cases individually like you mentioned in the group section?

    – Yonez Jun 17 '15 at 23:40
  • Oh I think I am starting to understand and wow isn't it way more complex than I thought. So I have to consider each case and calculate each one and then sum them all; If none repeats, when one repeats once, twice, three times, and then when two repeat once, twice, three times, etc. up to the max of 3 repeat three times and one just moves in position. Is this correct? – Yonez Jun 17 '15 at 23:48
  • So while trying to understand exactly how big the file would be I decided to first find out how big it would be if it had no conditions, 16^16 * 12bytes = 13.19 Tb.

    Now I know the max size it can take, but I am still struggling to find out how big it would be with the listed conditions.

    – Yonez Jun 18 '15 at 01:39
  • I edited the response to take into account your definition of hex character. I also changed the letters to make it clear that you substitute in the hex characters (before it had $A-F$ already so it was confusing). Anyway, the reason why all the separate cases is because of duplicates. The one I calculated involved everything you'd need to consider, I think. Others are easier: If no character repeats, then you get ${16}C{10} \cdot 10!$ possible words. Hopefully makes sense? – John Jun 18 '15 at 04:54
  • Yes it does, thanks for the help. Although I still don't know how big a file will be I have accepted your answer. – Yonez Jun 18 '15 at 13:03
  • I just noticed something, in the 14 cases you listed I can't tell if you are accounting for repeating letters that are not in sequence, for example: X12345X678 (X exists twice) or W12W34WA5A (A exists twice, W exists three times).

    Are these already included in those calculations you listed?

    – Yonez Jun 18 '15 at 16:11
  • The 14 cases just show the size of the groups. The second half of the answer counts the number of words that have those group sizes, rearranged in any order, for the one particular case $KKKLLMMNNO$. I didn't do all 14 cases, but showed the method for that one, and hopefully you see how to do the others. As for the size of the file, if each character takes one byte (8 bits) multiply the number of words (total) by 80 (8 bits times 10 characters per word) to get the file size in bits. – John Jun 18 '15 at 17:00