A sad story: One of our hard drives failed. While it was failing, we managed to take a quick backup. As it is our standard practice, we encrypted the backup using GPG (by however method Duplicity uses to do that, most likely plain
gpg -c). Unfortunately, we stored the wrong passphrase. (Doh!)
The backup contains some data that we would very much like to recover.
We know that the passphrase was generated by
pwgen -n 16 -s command on an modern Ubuntu 32-bit server machine that is a guest in a Xen host. We may have a passphrase from the same batch of pwgen passphrases (that's the "wrong passphrase"). There are several files in the backup, each encrypted with the same passphrase.
Is it feasible to attempt to brute-force the passphrase? What tools are there for that? How to calculate the cost and time of such brute-force passphrase recovery attempt? (Assume, say, that we're willing to rent Amazon HPC GPU instances as needed, and Amazon has enough of them available.)
Given that we have 62^16 possible passwords, and decrypting the smallest file (265B) with
gpg takes 0.02s on my (rather old) box, the answer looks to be "not feasible"... But it never hurts to ask.
If it is preferred by the site rules, I can rephrase this question as "how hard to break is this method of backup encryption?" :-)