Lessons · Cybersecurity · time to guess a password
How long would it take to guess?
The number of guesses is 2 to the power of the strength in bits, and the time is that number divided by how many guesses a second the attacker can make.
Hone is a place to practise a career, one idea a day. This is one of its lessons, written out in full and free to read without an account.
In beta. This lesson was written for Hone and has not yet been checked by a practising security analyst. Practice material, not professional advice. What that means.
What it is for
A manager asks whether the eight-character policy is good enough. The honest answer is a time: at a billion guesses a second, this many days. Nobody argues with a number of days, and everybody argues with 'it is not very strong'.
How to think about it
Write the bits, then the rate. Guesses is 2 to the power of the bits. Seconds is guesses divided by the rate. Divide by 86,400 for days and by 3,600 for hours. Quote the whole keyspace and say so; an attacker expects to find it in about half that time.
Worked example
guesses = 2 ** bitsThe whole keyspace: every password of that strength.
seconds = guesses / guesses per secondThe attacker's rate is the other half of the sum.
40 bits at 1,000,000 guesses a second: 2 ** 40 / 1000000 = 1,099,512 secondsAbout a million seconds.
1,099,512 seconds is about 12.7 daysDivide by the number of seconds in a day to say it in a unit people use.
Your turn
You have a number of seconds and want days. Write the line's divisor.
days = seconds /
Solve one, graded on the server
The trap
Quoting a time from a speed you invented. The rate depends entirely on how the password is stored and what hardware is used; state the rate you assumed, or the number of days means nothing.