# Brute forcing - How difficult?

I'm doing a research project and I have a question regarding how difficult it would be to brute force something.

• Say there is a piece of text - "My name is James"
• Removing the whitespaces yields "MynameisJames"

If you alter each character in that string with a different character at random, in the range of mixed case alpha numeric and symbols, how difficult would it be to brute force that and get the original string?

The encrypted string would look like "3r#u8N!PRfeq1".

• Possible duplicate of How can I decode a message that was encrypted with a one-time pad? Commented Jul 15, 2018 at 18:35
• That would be a `perfect secrecy` and unbreakable. Commented Jul 15, 2018 at 18:57
• @Xaqron You're making 2 assumptions, at least one of which is incorrect. First, a one time pad assumes the attacker has no way to know which plaintext is the correct one, but the attacker here will know if he guesses the correct password. Second, it must be a one time pad, while OP doesn't specifically say, I worry they may plan on using the same random string for multiple passwords. Commented Jul 18, 2018 at 16:06

Brute forcing consists of repeatedly generating some new input and then checking if the guess was correct or not. Difficulty of brute forcing thus depends on the average number of guesses needed (i.e. how many different input are there) and how fast it is to verify the correctness of a guess.

But in general the amount of time needed is half the search space (i.e. number of inputs) multiplied with the time needed to create the guess and then check if the guess is correct. For example with a string of 8 characters (A-Z, i.e. 26 characters) the number of possible inputs is 268 and half of these (268/2) are needed to guess correctly on average. If 10,000 guesses per second are possible brute forcing would thus take about 120 days on average to guess the correct input.

Brute forcing is down by the number of possibilities ^the length of the string. eg. 'Mynameisjames' is 13 characters long, and there are 26 letters in the alphabet, so 2613. Which equates to a massive number: `2.4811529e+18`

However, there is a technique known as the birthday attack, which stems from the birthday theorem that you only need 23 people in a room to have two peoples birthdays occuring on the same day. So essentially, a collision. More info can be found here: https://en.wikipedia.org/wiki/Birthday_attack

So, a brute force attack will take a very long time, however a birthday attack would be substantially faster. basically 2613 / 2.

The time aspect really comes down to the speed of the computer(s) that you have at hand in order to attempt to crack the password. The values I gave will give you the number of attempts required to break the password, so these can be subbed in to how many checks a machine can perform per second to give you your final answer.

Many of the answers given are listing 26 characters as your character set, but that's not correct. It would have to be at least 52 for both capital and lowercase characters. If you were brute forcing though, you couldn't know if it was just letters without numbers or punctuation. So the standard number of characters is 94, 26 A-Z, 26 a-z, 10 for 0-9, and 32 "special characters" for punctuation.

Now, to fully brute force this, you have to know the "password" length (let's just call MynameisJames a password) so 13 characters. You typically do not know this information, so what happens is you start by brute forcing everything for 4 characters, then everything for 5, and keep increasing until you find it.

This can be very tedious. Even with a cracking rig that had an i7 and 2 1080 graphics cards, brute forcing a 10 character MD5 hashed password could take a week, and that is assuming I knew it was 10 characters. Granted, there is more involved with that because it's actually cracking the "hash", so the computer has to generate a hash for each tested entry and that takes longer.

"How difficult would it be" is a difficult question to answer as it's not particularly measurable. That said, a week with a crypto computer would probably guess this correctly if it was in an outdated hash format (MD5). In the sense that this is just raw plain text, it would probably more like trying to enter a password, as opposed to cracking a hash, which takes much longer because you have to wait for a response from that. If it was a script to just guess an unknown plaintext 13 character that was entered, could take a few days if optimized (I wrote a script like this to test the success of password lists, so I can say first hand it would run 4 million attempts in a few hours).

13 character password with a 94 character set brute force is 44 x 10^24 attempts. The divided by 2 method just gives you a 50% chance and my experience is the password always seems to be in the 2nd half of that 50, just murphy's law of "in practice" vs "in theory".