Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Given

Dictionary containing 1000 three-letter words:
dictionary=abc,def,ghi,jkl,mno,pqr...

Randomly chosen words from the dictionary:
10-bits-passwords=abc,def,ghi

Randomly chosen three words from the dictionary:
30-bits-password=jklmnopqr

The 10-bits-passwords are encrypted using the 30-bits-password and the tabula recta like this:
abc+jkl=jln, jln+mno=vyb, vyb+pqr=kos
def+jkl=moq, moq+mno=ybe, ybe+pqr=nrv
ghi+jkl=prt, prt+mno=beh, beh+pqr=quy

Question (-s):

If kos, nrv and quy are known, is cracking these strings/10-bits-passwords as difficult/as easy as cracking the 30-bits-password (Assuming the attacker has a way to test the 10-bit-passwords)? If so, does the strength of the encryption remains the same if a 10-bit-password is known/cracked directly?

share|improve this question
    
Is this a homework question? This seems unlikely to be a real world scenario. It also depends on if the passwords can be tried one at a time or only in a set of three. –  AJ Henderson Jan 30 at 14:21
add comment

closed as off-topic by Xander, Adnan, TildalWave, Iszi, SteveS Jan 30 at 18:18

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions asking us to break the security of a specific system for you are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem." – Xander, Adnan, TildalWave, Iszi, SteveS
If this question can be reworded to fit the rules in the help center, please edit the question.

1 Answer

up vote 2 down vote accepted

Assuming that this is a homework question, the key here is how difficult it is for the attacker to get confirmation that they have guessed correctly. For a given number of options that an attacker has to guess and will be given confirmation of being correct, it takes half the total number of possibilities on average to get a hit.

If you have 5000 possible passwords, then it will take an average of 2500 guesses to find it (via brute force). If the three passwords must all be entered before confirmation is given about any of them being correct, you would need to figure out the number of possible guesses for all three passwords. If each password is confirmed separately however, you only need to know the number of guesses to get each password and to guess them 3 times.

This is of course assuming that there are no other, more subtle weaknesses in the system. For example, if the system stored hashes of the passwords that might be compromised, then it wouldn't matter if confirmation was given between the passwords or not since the hashes for each would allow the attacker to verify it for themselves.

share|improve this answer
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.