A database file is encrypted with 256bits AES and the key is the first 7 characters (from the character set 0-9, a - f, all small letter) of MD5 hash . This implies 2^28 bits (268,435,456) possible passwords. How long will take to brute force such a password?

  • 2
    It depends how long it takes to verify a password but cryptopp.com/benchmarks.html indicates that you can perform about 255 million MD5 hash per second on a relatively weak CPU which, more or less, means walking through the whole keyspace in a bit over one second. – Stephane May 30 '16 at 12:22
  • You have to factor into account hardware, as it stands your question is too broad and unlikely to allow us to provide a good answer. Are you asking about the time just out of curiosity? or do you want to know because you are assessing a specific security implementation? – Purefan May 30 '16 at 13:17
  • @Purefan, I am writing a report on decrypting a 256BITS AES encrypted database. I don't have the facility to test out the brute forcing scenarios, however, it would help my report for knowledge and documentation purpose. – e.kenny67 May 30 '16 at 13:23
  • Then the most accurate answer I guess would be to figure out the logarithmic complexity, otherwise you're looking at answers like "a lot" which are not really useful – Purefan May 30 '16 at 14:44
  • @Stephane that sounds like an answer – Neil Smithline May 30 '16 at 15:46

To clarify and expand what I said in the comment:

A GPU-based cracker can go through a LOT of MD5 hash per seconds. According to this, one based on the (old) NVIDIA Geforce 8800 Ultra can compute about 200 million hashes per seconds. Since your keyspace is a bit above 2 millions entry large, it means that you can get through ALL of it in about one second and a half.

That doesn't, however, tell you the whole story: you're not trying to generate a collision here but you're trying to find the key used in an encryption scheme. This means that each of these hashes must then be tested. It is very possible - even likely - for this step to take much longer that simply generating a hash. Exactly how long depends on how the chosen algo is used exactly and at what stage you can decide if the key is valid or not.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.