Real World: Password Complexity

Math for CS · Axiom Academy

REAL WORLD Password Complexity Why "P@ssw0rd!" cracks in milliseconds and a 5-word passphrase takes longer than the age of the universe. If your password is exactly L characters long and each character is drawn from an alphabet of size C , the total number of possible passwords is This is the basic counting principle: C choices for the first slot, C for the second, and so on, multiplied L times. The exponent is what makes password length so devastatingly important — adding one character multiplies the search space by C . Lowercase letters (a–z): C = 26 Letters + digits (a–z, 0–9): C = 36 Mixed case + digits + ~32 symbols: 2. From Search Space to Cracking Time An attacker who knows the password is hashed (e.g. they stole the database) can try guesses offline. The time to brute-force depends on two things: the size of the space, and how many guesses per second the attacker can compute. The "/2" is because, on average, an attacker has to try half the space before stumbling on the right answer. Modern hashrates vary by orders of magnitude depending on the hash function: 3. Real Numbers: How Long Does Each Password Last? Below: average time to brute-force a password of given length and alphabet, against a single attacker doing 10^ 12 raw SHA-256 hashes per second (a \ 10K rig). Length dominates. Going from 8 to 12 characters (just 4 more keystrokes) is more powerful than tripling the alphabet.

This is the written version of the interactive lesson above. See the full Math for CS course.