Member Avatar for Raaz_mystery

Hi Guys. My doubts are related to Brute Force Attack but let me Tell you first that it has nothing to do with the Hacking/Cracking. So please dont block/remove my Post on this Forum. I want to study more about Brute Force Attack because it is in my Subject (i.e. E-Commerce). I want to create something to minimize the risk of Brute Force.
I have the Following Queries:

Q.1. How much time a Brute Force Attack will take to guess a password of 10 digits which includes alphabets,numbers & special characters ??
Q.2. If a single processor will only execute the Brute Force Attack then How much times its Speed will increase (forget about the OS instructions here) ??

  • 4 Contributors
  • 6 Replies
  • 115 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by TrustyTony

Dani AI

Generated

As asked, you need two inputs to estimate brute-force time: the character-set size S and the attacker guesses-per-second R. Total candidates = S^L (where L is length). Average work is about S^L / 2. Time (seconds) = (S^L / 2) / R. That is why was right that "it depends" and why and focused on permutations.

Examples for L = 10 (exact totals shown), using common sets and a few illustrative guess rates:

  • S = 26 (lowercase): 141,167,095,653,376 total; average ~70,583,547,826,688 tries. At 1,000/s ~2,238 years; at 1,000,000/s ~2.24 years; at 1,000,000,000/s ~20 hours; at 1,000,000,000,000/s ~71 seconds.
  • S = 62 (upper+lower+digits): 839,299,365,868,340,224 total; average ~4.1965e17 tries. At 1e6/s ~13,305 years; at 1e9/s ~13.3 years; at 1e12/s ~4.9 days.
  • S = 94 (printable ASCII): 53,861,511,409,489,970,176 total; average ~2.6931e19 tries. At 1e9/s ~854 years; at 1e12/s ~312 days.

About Q2 (scaling): brute force is embarrassingly parallel, so ideal throughput scales linearly: R_total = N * R_one. In other words N independent workers divide the attack time by N. In practice, limits appear: hash algorithm cost, memory bandwidth, GPU vs CPU architecture, network latency, per-IP throttling and account lockouts all reduce real gains. Fast hashes (MD5/SHA1) give huge GPU speedups; slow, memory-hard KDFs (bcrypt/scrypt/Argon2) greatly reduce per-core rates and parallel efficiency.

Practical mitigations (what to build): require long passphrases (length > complexity), enable multi-factor auth, store passwords with a memory-hard KDF and tuned cost, apply per-account and per-IP throttling or progressive delays (rather than immediate permanent lockout), check against breached-password lists, and monitor/alert on abnormal attempt patterns. These measures turn both online and offline brute-force from plausible to impractical.

Recommended Answers

All 6 Replies

Member Avatar for TrustyTony

I do not see that your answers are wrong -- actually I do not see your answer.

Edited by TrustyTony because: n/a
Member Avatar for Raaz_mystery

I do not see that your answers are wrong -- actually I do not see your answer.

Sir, I want answers for the above asked two questions.

Member Avatar for Rashakil Fol

A.1. It depends.

A.2. It depends.

Member Avatar for WaltP

Hi Guys. My doubts are related to Brute Force Attack but let me Tell you first that it has nothing to do with the Hacking/Cracking. So please dont block/remove my Post on this Forum. I want to study more about Brute Force Attack because it is in my Subject (i.e. E-Commerce). I want to create something to minimize the risk of Brute Force.
I have the Following Queries:

Q.1. How much time a Brute Force Attack will take to guess a password of 10 digits which includes alphabets,numbers & special characters ??

How many total characters? (n)
Compute the time to make 1 comparison. (c)
Compute the time to create the next value to compare. (t)
n*c*t*10*10

Q.2. If a single processor will only execute the Brute Force Attack then How much times its Speed will increase (forget about the OS instructions here) ??

If only one processor, how can the speed increase?

Member Avatar for TrustyTony

How many total characters? (n)
Compute the time to make 1 comparison. (c)
Compute the time to create the next value to compare. (t)
n*c*t*10*10


If only one processor, how can the speed increase?

Hmmm, my math says there is n**10 permutations.

Edited by TrustyTony because: n/a
commented: Good point... +17
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.