3 ms·

The comic claims an entropy of 44 bits for a 4-word phrase. That means 11 bits per word, so a dictionary of 2048 words, which sounds reasonable for "common Eng

by defen 14y ago

The comic claims an entropy of 44 bits for a 4-word phrase. That means 11 bits per word, so a dictionary of 2048 words, which sounds reasonable for "common English words". A single ATI 5970 can compute 2300M SHA-1 hashes per second. So you're looking at about two and a half hours to run through the entire keyspace. Fewer on a farm (which Amazon will rent to you for a few bucks). That's assuming you know the dictionary, of course. Of course, if the password is hashed with bcrypt or scrypt it will take much longer, although I'm not sure how to do that calculation.

miles 14y ago
you're looking at about two and a half hours to run through the entire keyspace That's a little faster than howsecureismypassword.net's estimate (154 octillion years on a desktop PC to crack "correct horse battery staple" (without quotes)).
- koopajah 14y ago
  Yes but don't forget the other part of his sentence : That's assuming you know the dictionary, of course.
  - huggah 14y ago
    It's pretty likely you do. Just take the N most common English words, and retry with a higher N if that doesn't work. That will crack "correct horse battery staple" quickly.
peterwwillis 14y ago
Assuming you knew the dictionary and just wanted to add entropy, get a bigger dictionary. A sample one I downloaded has about 7261 unique 4-letter words, or about 16,920 5-letter words, combined it's 24,181 words. Between four and six letters there's 56,099 words. Each of those sets will bring you up in entropy, from two quadrillion up to nine quintillion permutations. That would take the ATI 5970 about 4306184595 seconds, or 136.4 years. If you spread that out over 100 cards that would only take you 1.3 years to crack. Maybe that's too close to call, so you can always change your password every 60 days to mitigate people with more money/time on their hands. If anyone ever wants my password that bad they should just give me the money they'd spend on cracking and i'll give them my password ;) $ cat final/english-words.* | perl -le'@wl=map{ s/\s//g; tr/A-Z/a-z/; (/^[a-z0-9]+$/ and length$_ > 3 and length$_ < 7) ? $_ : () } <>; push @a, $wl[int rand(@wl)] for 1..4; print "@a"' rymmes weekly calvin cimbal

by defen 14y ago

miles 14y ago

you're looking at about two and a half hours to run through the entire keyspace That's a little faster than howsecureismypassword.net's estimate (154 octillion years on a desktop PC to crack "correct horse battery staple" (without quotes)).

koopajah 14y ago
Yes but don't forget the other part of his sentence : That's assuming you know the dictionary, of course.
- huggah 14y ago
  It's pretty likely you do. Just take the N most common English words, and retry with a higher N if that doesn't work. That will crack "correct horse battery staple" quickly.

peterwwillis 14y ago

Assuming you knew the dictionary and just wanted to add entropy, get a bigger dictionary. A sample one I downloaded has about 7261 unique 4-letter words, or about 16,920 5-letter words, combined it's 24,181 words. Between four and six letters there's 56,099 words. Each of those sets will bring you up in entropy, from two quadrillion up to nine quintillion permutations. That would take the ATI 5970 about 4306184595 seconds, or 136.4 years. If you spread that out over 100 cards that would only take you 1.3 years to crack. Maybe that's too close to call, so you can always change your password every 60 days to mitigate people with more money/time on their hands. If anyone ever wants my password that bad they should just give me the money they'd spend on cracking and i'll give them my password ;) $ cat final/english-words.* | perl -le'@wl=map{ s/\s//g; tr/A-Z/a-z/; (/^[a-z0-9]+$/ and length$_ > 3 and length$_ < 7) ? $_ : () } <>; push @a, $wl[int rand(@wl)] for 1..4; print "@a"' rymmes weekly calvin cimbal