"Does the placement of the known characters make any difference?"
Yes, it does make a difference and a rather significant difference. When it comes to information, the more the attacker knows the faster he can break it, as simple as that.
If the attacker knows where a
b
c
goes in your key, then again it is as good as,
[][][][][] (5 chars, 0 known)
is the same as,
[]a[]b[]c[][]
[]abc[][][][]
abc[][][][][]
If you want a key of length 8
and 3
chars are to be considered known values, then the true length of the key/secret is simply 5
.
If an attacker knows the value at position X, position Y, position Z, the attacker can include that in brute-forcing the key. You basically shortened the time taken to obtain the full key. You removed a nice chunk of combinations for him. You can have a key with 10 digits of random numbers. If you add a string of numbers like 1234567890 behind it, so it becomes XXXXXXXXXX1234567890
, its a 20 digit key now, it is useless. It's as good as 10. Another example > X1X2X3X4X5X6X7X8X9X
, if the attacker knows the position of the known values, again it's as good as a key length of 10.
Also, what is the relation of the revealed values to the key? Like if a
b
c
is revealed & a
b
c
won't appear again, then that is a huge clue to be handing out, again shortening the time it takes to brute-force it and undermining the integrity/overall effectiveness of the key.
Let me reiterate, (5 known & 3 known) = (5 known) both has the same level of integrity provided that the values are not related to each other