Skip to main content
Information Security

Return to Answer

deleted 13 characters in body
Source Link
Dakkaron
Dakkaron
  • 219
  • 1
  • 8

It looks to me that most of the other answers are focussing on the wrong type of attack.

Since we are dealing with a very specific scenario (manual PIN input) we can optimize the PIN generation for the possible attack scenarios.

Dictionary Attack

From what I can gather from the question, we are talking about manual PIN input, so the attacker has to type out each PIN they try. So a brute force attack might take quite a while (say, you need two seconds for each PIN you try, it will take almost three hours on average). This is possible, but not the smartest approach.

So when a brute force attack is unfeasible, you can instead try a dictionary attack. Here you try the most common PINs first. If this fails you can always resort to a brute force attack later. With dictionary attacks, entropy does not matter that much anymore. Here it matters whether the password is in the dictionary or not. Since the attacker most likely does not have a real dictionary of common PINs, they will have to come up with their dictionary on the fly. This would mean, the dictionary will probably be rather short and pattern-orientated. Possible PINs in the dictionary would be:

  • Consecutive PINs (e.g. 0123 or 1234)
  • PINs with four times the same digit (e.g. 2222)
  • maybe also PINs with only three times the same digit

By eliminating these few passwords you don't lower your entropykeyspace size by much but you can easily defend against dictionary attacks. Similar strategies are used by websites that don't allow you to use common or easy to guess passwords (e.g. using the username as the password)

Brute Force Attack

Next we can try to optimize against possible brute force attacks. This might help a lot less for a higher cost, so this might not be worthwhile. There are two main strategies how an human attacker can perform brute force attacks: either just enter random PINs or start with 0000 and count up (or 9999 and count down). So PINs like 0001 or 9998 might be a bad choice since someone performing a brute force attack might find them rather quickly. So maybe exclude PINs starting with 0 or 9.


Following these rules you should not loose too many possible passwords (and thus entropy), but you might be able to strengthen your PIN against the most common attack strategies for this specific scenario.

It looks to me that most of the other answers are focussing on the wrong type of attack.

Since we are dealing with a very specific scenario (manual PIN input) we can optimize the PIN generation for the possible attack scenarios.

Dictionary Attack

From what I can gather from the question, we are talking about manual PIN input, so the attacker has to type out each PIN they try. So a brute force attack might take quite a while (say, you need two seconds for each PIN you try, it will take almost three hours on average). This is possible, but not the smartest approach.

So when a brute force attack is unfeasible, you can instead try a dictionary attack. Here you try the most common PINs first. If this fails you can always resort to a brute force attack later. With dictionary attacks, entropy does not matter that much anymore. Here it matters whether the password is in the dictionary or not. Since the attacker most likely does not have a real dictionary of common PINs, they will have to come up with their dictionary on the fly. This would mean, the dictionary will probably be rather short and pattern-orientated. Possible PINs in the dictionary would be:

  • Consecutive PINs (e.g. 0123 or 1234)
  • PINs with four times the same digit (e.g. 2222)
  • maybe also PINs with only three times the same digit

By eliminating these few passwords you don't lower your entropy by much but you can easily defend against dictionary attacks. Similar strategies are used by websites that don't allow you to use common or easy to guess passwords (e.g. using the username as the password)

Brute Force Attack

Next we can try to optimize against possible brute force attacks. This might help a lot less for a higher cost, so this might not be worthwhile. There are two main strategies how an human attacker can perform brute force attacks: either just enter random PINs or start with 0000 and count up (or 9999 and count down). So PINs like 0001 or 9998 might be a bad choice since someone performing a brute force attack might find them rather quickly. So maybe exclude PINs starting with 0 or 9.


Following these rules you should not loose too many possible passwords (and thus entropy), but you might be able to strengthen your PIN against the most common attack strategies for this specific scenario.

It looks to me that most of the other answers are focussing on the wrong type of attack.

Since we are dealing with a very specific scenario (manual PIN input) we can optimize the PIN generation for the possible attack scenarios.

Dictionary Attack

From what I can gather from the question, we are talking about manual PIN input, so the attacker has to type out each PIN they try. So a brute force attack might take quite a while (say, you need two seconds for each PIN you try, it will take almost three hours on average). This is possible, but not the smartest approach.

So when a brute force attack is unfeasible, you can instead try a dictionary attack. Here you try the most common PINs first. If this fails you can always resort to a brute force attack later. With dictionary attacks, entropy does not matter that much anymore. Here it matters whether the password is in the dictionary or not. Since the attacker most likely does not have a real dictionary of common PINs, they will have to come up with their dictionary on the fly. This would mean, the dictionary will probably be rather short and pattern-orientated. Possible PINs in the dictionary would be:

  • Consecutive PINs (e.g. 0123 or 1234)
  • PINs with four times the same digit (e.g. 2222)
  • maybe also PINs with only three times the same digit

By eliminating these few passwords you don't lower your keyspace size by much but you can easily defend against dictionary attacks. Similar strategies are used by websites that don't allow you to use common or easy to guess passwords (e.g. using the username as the password)

Brute Force Attack

Next we can try to optimize against possible brute force attacks. This might help a lot less for a higher cost, so this might not be worthwhile. There are two main strategies how an human attacker can perform brute force attacks: either just enter random PINs or start with 0000 and count up (or 9999 and count down). So PINs like 0001 or 9998 might be a bad choice since someone performing a brute force attack might find them rather quickly. So maybe exclude PINs starting with 0 or 9.


Following these rules you should not loose too many possible passwords, but you might be able to strengthen your PIN against the most common attack strategies for this specific scenario.

Source Link
Dakkaron
Dakkaron
  • 219
  • 1
  • 8

It looks to me that most of the other answers are focussing on the wrong type of attack.

Since we are dealing with a very specific scenario (manual PIN input) we can optimize the PIN generation for the possible attack scenarios.

Dictionary Attack

From what I can gather from the question, we are talking about manual PIN input, so the attacker has to type out each PIN they try. So a brute force attack might take quite a while (say, you need two seconds for each PIN you try, it will take almost three hours on average). This is possible, but not the smartest approach.

So when a brute force attack is unfeasible, you can instead try a dictionary attack. Here you try the most common PINs first. If this fails you can always resort to a brute force attack later. With dictionary attacks, entropy does not matter that much anymore. Here it matters whether the password is in the dictionary or not. Since the attacker most likely does not have a real dictionary of common PINs, they will have to come up with their dictionary on the fly. This would mean, the dictionary will probably be rather short and pattern-orientated. Possible PINs in the dictionary would be:

  • Consecutive PINs (e.g. 0123 or 1234)
  • PINs with four times the same digit (e.g. 2222)
  • maybe also PINs with only three times the same digit

By eliminating these few passwords you don't lower your entropy by much but you can easily defend against dictionary attacks. Similar strategies are used by websites that don't allow you to use common or easy to guess passwords (e.g. using the username as the password)

Brute Force Attack

Next we can try to optimize against possible brute force attacks. This might help a lot less for a higher cost, so this might not be worthwhile. There are two main strategies how an human attacker can perform brute force attacks: either just enter random PINs or start with 0000 and count up (or 9999 and count down). So PINs like 0001 or 9998 might be a bad choice since someone performing a brute force attack might find them rather quickly. So maybe exclude PINs starting with 0 or 9.


Following these rules you should not loose too many possible passwords (and thus entropy), but you might be able to strengthen your PIN against the most common attack strategies for this specific scenario.