I wonder how long it will take to crack 16 character alphanumeric WinRAR password for a mini supercomputer. As far as I know graphic cards are preferred over CPUs to crack passwords nowadays. If we consider that the cracker (law enforcment) uses the latest technologies to crack the RAR password and has pretty much computing power how long it will take for him to crack the password?
6
-
1If you mean 16 completely random alphanumeric characters, then it's infeasible even for state level adversaries. I'd estimate a ~112 bit security level, which should be good for several decades.– CodesInChaosCommented Mar 26, 2013 at 18:10
-
With a policy which mandates a password change every one week , now top this with what @CodesInChaos said its just become very impractical.– SaladinCommented Mar 26, 2013 at 18:22
-
3@Saladin A password-change policy wouldn't actually have any effect at all, since we're talking about a password on a file. At any given point in time the file has a password that can't be invalidated if the file is copied, so the frequency with which it is changed is immaterial to the feasibility of a brute-force attack.– XanderCommented Mar 26, 2013 at 18:27
-
@Xander okay i was thinking somewhere along the lines of a static file kept on a secure server (without any copies rights) which the attacker is trying to bruteforce. If it has been already copied (e.g in usb) then you are right, it wouldn't have any effect. Thanks for clarifying.– SaladinCommented Mar 26, 2013 at 18:32
-
1@kasperd 95 bits of entropy + 17 bits of iterated hashing = 112 bits of security. See my answer.– CodesInChaosCommented Oct 31, 2015 at 21:55
|
Show 1 more comment
1 Answer
A completely random alphanumeric password of length 16 has an entropy of 95 bits (16*log2(2*26+10)). I forgot the exact value, but I think rar uses around 100k iterations for its KDF, increasing the security level by about 17 bits, resulting in an effective security level of 112 bits.
With standard GPUs breaking this would cost around $1019. Custom hardware shaves off a factor 100 or so, still giving you a cost of $1017. Even if Moore's law continues, it'll take several decades until this is remotely feasible.
Related question: How expensive is it to guess a 15 character password, and should I be worried?
answered Mar 26, 2013 at 18:23
-
4I just would like to mention that RAR uses 262144 SHA-1 iterations in its KDF.– AdiCommented Mar 26, 2013 at 22:48
-
5For anyone wondering the significance of that number, it's just
0x40000, or 2^18. Commented Mar 27, 2013 at 0:42