Time it will take to crack a password file?

Asked Dec 20 '20 at 14:53

Active Dec 20 '20 at 15:11

Viewed 64 times

I'm trying to answer a multiple-choice question which is the following:

Consider the security of a password file, which includes a 10 bit salt and all passwords are hashed, but known to consist of exactly 8 characters from the following alphabet:

    lowercase letters ('a' to 'z')
    uppercase letters ('A' to 'Z')
    digits ('0' to '9')
    the special characters (., -, _, +, <, >, =, @)

Assume that a password cracking system, which is able to check 12 billion (10^12) guesses per second and is able to run around the clock all year, is used to crack the password file. Which of the following worst case estimates for cracking the password file is most accurate?

The answer is Two years.

What I did is, I would say since the salts are fixed and there are 70 (26+26+10+8) characters for each bit and the password consists of 8bits-> 70^8 possible combinations. And this answer divided by 12,000,000,000 ~~12*10^12~~, but this gives me 48040 seconds ? wolfram alpha

EDIT: corrected 12 billion

edited Dec 20 '20 at 15:11

asked Dec 20 '20 at 14:53

LoSpazzino

12 Billion isn't equal to $12*10^{12}$ – Sergio Dec 20 '20 at 15:02
that would be 12 Trillion^ – Sergio Dec 20 '20 at 15:02
The correction of billion to $10^9$ gets you to $48040$ seconds, which is a little over $13$ hours, still far off $2$ years. I believe salts are assumed known by the attacker, which justifies not using those bits in the calculation. – Ross Millikan Dec 20 '20 at 15:06
@RossMillikan what does salys mean? – Sergio Dec 20 '20 at 15:18
It reads salts to me – Ross Millikan Dec 20 '20 at 15:18
Yes salts sorry, I made a typo here. – Sergio Dec 20 '20 at 15:22
You listed that each password has a $10$ bit salt, but you ignored that in your calculation. I was agreeing that was the correct approach because you are assumed to know the salt. – Ross Millikan Dec 20 '20 at 15:30
This formulation is somehow confusing. Assuming the encoding is ASCII. How can the salt be only 10 bits when 1 character in ASCII is 1 byte (8 bits). This means the salt is 1 and 2/10 characters long. – Ev. Dec 20 '20 at 16:10

Time it will take to crack a password file?

0 Answers0