I'm building a remote management software that will allow remote access to work equipment.

To get access, the user will have to enter a code which is shown on the device to be accessed. The user will take this code in person and then put it manually in the client machine.

I want to keep the length of this code the shortest possible for user experience reasons.

What's the minimum bit-length of this code so that even if an attacker could do a brute-force, he/she won't get access to any machine?

  • How is the code stored ? MD5 ? Plain ? BCrypt ? Is there a lock after a number of attemps ? You need to be more precise. If there is no lock and it's plain text you would need way more than With Bcrypt for instance. – Walfrat Apr 5 '17 at 13:05
  • It's stored plain. Assuming that an attacker can do an unlimited number of guesses, what would be the right length? – Tony Apr 5 '17 at 13:15
  • 1
    If an attacker can try as many attempts as they like, you need a long enough code that they're unlikely to find the right one in less time than it would take for someone to find them. If you have to enter it correctly on first try, it's a 1 in (possible number of codes) chance that they get in. If it's OK for them to get in 1 time in 10, a single digit would work (but be terrible). If they had to enter a 10 digit code correctly, first time, selected randomly, it would be a 1 in 10 billion chance to get in. Most systems are somewhere between these extremes. – Matthew Apr 5 '17 at 13:15
  • 1
    You should not store passwords in plaintext. If you are E.U-based that could even have you pay a fine if the privacy commission (or equivalent in your country) performs an audit (say there is a breach for example..) – niilzon Apr 5 '17 at 13:49
  • Can the code expire? – Xiong Chiamiov Apr 5 '17 at 15:08

It depends on how this code is entered, if this is a type a code in a box from a computer keyboard or a type a code on a physical keypad that requires a user to physically brute force it.

If it has scope to be attacked by a computer a six digit numeric pin could be cracked in minutes, 6 digits gives 1111110 password combinations, at 766 keys per second, your pin is cracked in 24 minutes, at 4 digits it's 14 seconds. You can run numbers yourself through this calculator to give you an idea http://calc.opensecurityresearch.com/

With physical entry it's much more demanding time wise and a human will give up long before a computer will. You must have some sort of lock out after multiple failed attempts, as ATMs do - typically locking you out after three attempts. So, it's not necessarily the length that is hugely important beyond the trivially guessable, ie it should be at least four or more. The chances of hitting a 4 digit code in three guesses are extremely small, so something in the range of 4 - 8 i would have thought should suit your application offering a difficult to guess PIN with low effort to enter.

  • since it is stored in plaintext.. Well.. ;) – niilzon Apr 5 '17 at 13:49
  • I agree entirely it needs to be stored securely but didn't go into that as the OP's question was purely on length of pin. – iainpb Apr 5 '17 at 14:06
  • yeah your answer is nice, OP's question is improper (and adds critical info in comments instead of editing) – niilzon Apr 5 '17 at 14:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.