Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I wonder how long it will take to crack 16 character alphanumeric WinRAR password for a mini supercomputer. As far as I know graphic cards are preferred over CPUs to crack passwords nowadays. If we consider that the cracker (law enforcment) uses the latest technologies to crack the RAR password and has pretty much computing power how long it will take for him to crack the password?

share|improve this question
1  
If you mean 16 completely random alphanumeric characters, then it's infeasible even for state level adversaries. I'd estimate a ~112 bit security level, which should be good for several decades. –  CodesInChaos Mar 26 '13 at 18:10
    
With a policy which mandates a password change every one week , now top this with what @CodesInChaos said its just become very impractical. –  Saladin Mar 26 '13 at 18:22
1  
@Saladin A password-change policy wouldn't actually have any effect at all, since we're talking about a password on a file. At any given point in time the file has a password that can't be invalidated if the file is copied, so the frequency with which it is changed is immaterial to the feasibility of a brute-force attack. –  Xander Mar 26 '13 at 18:27
    
@Xander okay i was thinking somewhere along the lines of a static file kept on a secure server (without any copies rights) which the attacker is trying to bruteforce. If it has been already copied (e.g in usb) then you are right, it wouldn't have any effect. Thanks for clarifying. –  Saladin Mar 26 '13 at 18:32
add comment

1 Answer

up vote 6 down vote accepted

A completely random alphanumeric password of length 16 has an entropy of 95 bits (16*log2(2*26+10)). I forgot the exact value, but I think rar uses around 100k iterations for its KDF, increasing the security level by about 17 bits, resulting in an effective security level of 112 bits.

With standard GPUs breaking this would cost around $1019. Custom hardware shaves off a factor 100 or so, still giving you a cost of $1017. Even if Moore's law continues, it'll take several decades until this is remotely feasible.

Related question: How expensive is it to guess a 15 character password, and should I be worried?

share|improve this answer
2  
I just would like to mention that RAR uses 262144 SHA-1 iterations in its KDF. –  Adnan Mar 26 '13 at 22:48
2  
For anyone wondering the significance of that number, it's just 0x40000, or 2^18. –  Polynomial Mar 27 '13 at 0:42
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.