Is a password easier to brute force if it contains a repeating pattern?

Question

My question is different from this previous question: Does repeating one word to form a password result in a similar pattern in its encrypted format?. I'm specifically wondering about brute force attacks. Based on my experiences with John The Ripper, I doubt that repeating a pattern in a password would shorten the time to successfully brute force a password like f00B@rf00B@rf00B@r as opposed to a random string of equal length. However, my doubt is based on the fact that, according to the documentation, JTR does not include a specific attack mode for repeating patterns. JTR, and presumably other brute force tools, can be customized for any arbitrary attack mode. But we can't know how often attackers bother to customize attacks in this way. So then the question becomes mathematical. Please forgive the awkward pseudo mathematical notation.

T = brute force cracking time

PL = pattern of characters of length L

N = number of times PL is repeated

R(LN) = string of random characters of length (L times N)

Would it be true that

T(PL*N)= T(R(LN))

If true, then a repeating pattern password would not affect brute force cracking time. But is it true?

Answer 1

There are three scenarios here:

Attacker has no knowledge of the pattern scheme:
When the attacker has no knowledge of the patterns, the brute-force attempt will have to be exhaustive. The attacker gains no practical efficiency improvement, because there is no way of him knowing the construction of the password.

Attacker has some or full knowledge of the pattern scheme:
If the attacker has knowledge of the patterns, they may improve the efficiency of their bruteforce attack by not attempting passwords that do not match the pattern scheme.

Attacker has no initial knowledge of the pattern scheme, and multiple hashes are available:
If the attacker has no initial knowledge of the pattern, but has a number of different password hashes to crack (all of which use the same scheme for the password) he may crack a small number of them via exhaustive bruteforce, then deduce the pattern. From there, the attack becomes much more efficient.

Answer 2

The knowledge of the password pattern could give you really speed-up in the brute-force method. If you know, that brute-forcing password is a repeating pattern password, you can reduce the cracking time.

If you know, that the password consists of N the same parts, then, all you have to do is find that part. So to speed the cracking process up, you need to add a few lines into your brute-force function. Let's say that the brute-force algorithm checked if your password is abba. Before you let it go to the another step (checking abbb), you should "glue" that try and check passwords like abbaabba, abbaabbaabba and so on.

Answer 3

Most of the answer has been provided by @Polynomial. But however, I will add another angle to it.

Brute forcing of a password is a process where the attacker randomly guesses the password based on an existing history of passwords or through other statistical methods. Having said that, it becomes evident that if the victim (upon whose machine the Brute forcing is carried out), whether he uses a repeating pattern or a random string of characters will not matter to the attacker because he/she is not aware about it (considering that the attacker knows nothing about the victim's password policy).

A script kiddie or a hacker will definitely give up with his/her attempt, if the password takes a very long time to crack. Only a serious hacker would take up this task.

Also, statistics can infer from past records and suggest that users are most likely to use certain alphabets, symbols, or numbers within their passwords. But having repeated characters, jumbling up the order of repeating the patterns, will definitely make the task slightly easier for the hacker. But again, the question will be one based on probability, which the hacker will take time to ascertain.

I believe repeating the characters, jumbling them up with other random characters, and then changing the entire password after a definite period, will definitely provide a similar security posture to the victim as in the case wherein he/she uses a random string of characters.