Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

My question is different from this previous question: Does repeating one word to form a password result in a similar pattern in its encrypted format?. I'm specifically wondering about brute force attacks. Based on my experiences with John The Ripper, I doubt that repeating a pattern in a password would shorten the time to successfully brute force a password like f00B@rf00B@rf00B@r as opposed to a random string of equal length. However, my doubt is based on the fact that, according to the documentation, JTR does not include a specific attack mode for repeating patterns. JTR, and presumably other brute force tools, can be customized for any arbitrary attack mode. But we can't know how often attackers bother to customize attacks in this way. So then the question becomes mathematical. Please forgive the awkward pseudo mathematical notation.

T = brute force cracking time

PL = pattern of characters of length L

N = number of times PL is repeated

R(LN) = string of random characters of length (L times N)

Would it be true that

T(PL*N)= T(R(LN))

If true, then a repeating pattern password would not affect brute force cracking time. But is it true?

share|improve this question
1  
Take a look at Hashcat if you want brute force by a known pattern! –  Henning Klevjer Oct 13 '12 at 20:47
1  
And the mathematical assertion will be true, indeed, if there is no prioritizing of repeated patterns over random letters. I think John runs incrementally through the character space, and with hashcat you can guess on a pattern. This helps if the password policy is bad enough to restrict the password to contain e.g. three numbers at the end, or "not begin with a number". Although rare, these rules can appear.. –  Henning Klevjer Oct 13 '12 at 21:02
    
It now occurs to me that, although it sounds like the mathematical assertion would be true, a patterned password would have a much smaller keyspace. For simplicity, lets assume that you've got two passwords made up of only the five vowels, upper or lowercase. That makes 10 possible letters. The patterned password, with a four character pattern, would, if the pattern were repeated five times, be a 20 character password with a keyspace of (10^4)*5 = 50,000 combinations. But a 20 character password, even if constrained to 10 possible characters, would have 10^20 combinations. Sound correct? –  Luke Sheppard Oct 14 '12 at 16:05
1  
That sounds about right. This is what we call a low-entropy password. Very simply put, entropy is the degree of "randomness" in your password. If the password is restricted by rules, the entropy level drops. –  Henning Klevjer Oct 14 '12 at 18:28
add comment

2 Answers

up vote 2 down vote accepted

There are three scenarios here:

Attacker has no knowledge of the pattern scheme:
When the attacker has no knowledge of the patterns, the brute-force attempt will have to be exhaustive. The attacker gains no practical efficiency improvement, because there is no way of him knowing the construction of the password.

Attacker has some or full knowledge of the pattern scheme:
If the attacker has knowledge of the patterns, they may improve the efficiency of their bruteforce attack by not attempting passwords that do not match the pattern scheme.

Attacker has no initial knowledge of the pattern scheme, and multiple hashes are available:
If the attacker has no initial knowledge of the pattern, but has a number of different password hashes to crack (all of which use the same scheme for the password) he may crack a small number of them via exhaustive bruteforce, then deduce the pattern. From there, the attack becomes much more efficient.

share|improve this answer
add comment

The knowledge of the password pattern could give you really speed-up in the brute-force method. If you know, that brute-forcing password is a repeating pattern password, you can reduce the cracking time.

If you know, that the password consists of N the same parts, then, all you have to do is find that part. So to speed the cracking process up, you need to add a few lines into your brute-force function. Let's say that the brute-force algorithm checked if your password is abba. Before you let it go to the another step (checking abbb), you should "glue" that try and check passwords like abbaabba, abbaabbaabba and so on.

share|improve this answer
3  
I suppose OP's question is: If one has no knowledge whatever at all of a password and that password does have, say, a repeating pattern, whether that shortens the cracking time. Patterns could be of very diverse kinds, it could be abba..., and also abab..., etc. etc. and it would be, I am afraid, rather difficult for a cracking software to know which particular pattern or patterns to try. –  Mok-Kong Shen Oct 13 '12 at 20:40
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.