I'm trying to answer a multiple-choice question which is the following:

"Consider the security of a password file, which includes a 10 bit salt and all passwords are hashed, but known to consist of exactly 8 characters from the following alphabet:

  • lowercase letters ('a' to 'z')
  • uppercase letters ('A' to 'Z')
  • digits ('0' to '9')
  • the special characters (., -, _, +, <, >, =, @).

Assume that a password cracking system, which is able to check 12 billion (10^12) guesses per second and is able to run around the clock all year, is used to crack the password file. Which of the following worst case estimates for cracking the password file is most accurate?"

The answer is Two years.

What I did is, I would say since the salts are fixed and there are 70 (26+26+10+8) characters for each bit and the password consists of 8bits-> 70^8 possible combinations. And this answer divided by the 12*10^12, but this gives me 48.04 seconds ? wolfram alpha

  • As the other question explains, this is not a security question but a maths question. – schroeder Dec 20 '20 at 13:59
  • Are the salts known or in the password file? Each password should have its own salt. A character is not a bit. 10^12 is a trillion, not a billion. And you do not include how many passwords there are. So, all-in-all, this question is missing information and is a pure maths question. – schroeder Dec 20 '20 at 14:10
  • Where is this question from? – schroeder Dec 20 '20 at 14:11