I want to store a password hash in plain sight. If I am using a dictionary to crack an Argon2 hashed password that I am storing in plain sight, how long would it take (assuming my password is reasonably complex)? Further, are there any other attack risks that I am not aware of by storing password hash in plain sight?
If I am using a dictionary to crack an Argon2 hashed password that I am storing in plain sight, how long will it take? (--assuming my password is reasonably complex).
The success of brute-forcing depends mainly on following factors:
- Password entropy
- Parameters used for Argon2
- Attacker resources
Modern GPUs can compute more than 100 000 000 quick hashes (like SHA-256) per second. Parameters are usually chosen such that hashing takes long enough to slow the attacker down, but still fast enough to be acceptable for normal users. Let say you set parameters so that hashing of single password takes 1s. Thus you make brute-forcing 100 000 000 times slower compared to SHA-256.
Suppose passwords use randomly selected 64 characters. If password length is 10, then there are 6410 = 260 potential passwords. To try all of them the attacker will need 260 seconds, which means 235 years. If the attacker could afford 1 000 000 000 such powerful GPUs, then it would be needed 100 000 years.
Means, even if password is as short as 10 characters and is generated randomly, it can still be unbreakable.
But if passwords were not generated randomly, but were chosen from a dictionary of let say 10 000 often used words, then slightly modified, and the attacker creates 100 modifications for each dictionary word, then there would 1 000 000 password candidates to test. Which means 278 hours, or less than 12 days for a single GPU.
You can similarly calculate the brute-forcing time for other cases, e.g. if only 26 English letters are used, case insensitive. Or if password length is 15 or 20.