3 ms·
I think that's a pretty bad underestimate of the difficulty required. The problem is that you're assuming you'd use an ordinary English sentence for a passphras
by bscphil 7y ago
I think that's a pretty bad underestimate of the difficulty required. The problem is that you're assuming you'd use an ordinary English sentence for a passphrase, like something you read on Twitter, not (at the very least) random words or letters.
Assume you had a word list of the 10000 most common English words, and picked six of them at random. That's probably less than the 50 characters you're assuming.
There are 10000^6 combinations, so 10000^6/2 guesses required. Assume you can hash 1000/s per core (IMO if your attacker can get that your hash setting are too weak)...
So it's going to take 10000^6/2/1000/(3*10^7) core years to crack. If you can devote 1200 CPU cores to this project, you have a 50/50 shot at cracking the password by the time the universe is twice as old as it is now.
And that's just by taking the most obvious of steps to generate a better password, which (again) is probably still less than 50 characters.
- bostik 7y agoAye, if we're talking about diceware outputs and large dictionaries, then the passphrase [very likely] has no semantic meaning. I assumed, perhaps naively, that due to use of the term passphrase we were discussing a sequence of words that might be identified, and thus also likely generated by, an NLP-like system. After all, the ~1b/chr estimate only holds true with English language texts.
- mirimir 7y agoSorry. I used "passphrase" in the sense of "long password". Not meaning that it was a sequence of words. But actually, my LUKS passphrases are sequences of letters and numbers. They're based on favorite quotations. With the standard leet letter->number replacements, and no punctuation or spaces. So they're easy to reconstruct (from my books) if I forget them.
- mirimir 7y agoDamn. I forgot to say that I just use the first letter of each word.