Lessons · Cybersecurity · time to guess a password
How long would it take to guess?
The number of guesses is 2 to the power of the strength in bits, and the time is that number divided by how many guesses a second the attacker can make.
Hone is a place to practise a career, one idea a day. This is one of its lessons, written out in full and free to read without an account.
What it is for
A manager asks whether the eight-character policy is good enough. The honest answer is a time: at a billion guesses a second, this many days. Nobody argues with a number of days, and everybody argues with 'it is not very strong'.
How to think about it
Write the bits, then the rate. Guesses is 2 to the power of the bits. Seconds is guesses divided by the rate. Divide by 86,400 for days and by 3,600 for hours. Quote the whole keyspace and say so; an attacker expects to find it in about half that time.
Worked example
guesses = 2 ** bitsThe whole keyspace: every password of that strength.
seconds = guesses / guesses per secondThe attacker's rate is the other half of the sum.
40 bits at 1,000,000 guesses a second: 2 ** 40 / 1000000 = 1,099,512 secondsAbout a million seconds.
1,099,512 seconds is about 12.7 daysDivide by the number of seconds in a day to say it in a unit people use.
Your turn
You have a number of seconds and want days. Write the line's divisor.
days = seconds /
Solve one, graded on the server
The trap
Quoting a time from a speed you invented. The rate depends entirely on how the password is stored and what hardware is used; state the rate you assumed, or the number of days means nothing.