This is purely a thought exercise.
Assume a server which does not implement throttling or lock on failed attempts. The server accepts a username/password request & sends back a Yes/No response. The response time is 10 seconds. You are trying to brute force a password on the server. I am trying to figure out how much time it would take to brute force say a 5 digit Numeric PIN.
The entropy of the PIN would be 105 = 100000 So the time taken to brute force would be 100000/10 = 10000 seconds.
However, you can have a multithreaded program sending requests in parallel. Or multiple programs running at the same time doing the brute forcing. So my naive calculation is not correct.
Assuming the attacker's machine a typical laptop of today (i7, 16 GB RAM), how do I calculate the time taken to brute force - are there any thumb rules for this?