Password Recovery Speeds

提供：MDWiki
移動： 案内, 検索

Ivan Lucas "Password Recovery Speeds: How long will your password stand up" (Friday 10th July 2009 04:01),
Copyright © 1996-2009 Ivan Lucas. Creative Commons License Licensed under a Creative Commons Attribution-ShareAlike 2.0 License. All trademarks are hereby acknowledged.

COPYRIGHT NOTICE
Original Concept & Design: Ivan Lucas
Additional Coding: Rob Beckett

Organisation: The Home Computer Security Centre - LockDown.co.uk
Web Site: http://www.lockdown.co.uk/
Email: ivan.lucas@lockdown.co.uk or rob@subwolf.org

All code, script, text, images and designs on this site are copyright I N Lucas 2000-2007 - All Rights Reserved.

目次

Password Recovery Speeds

How long will your password stand up

This document shows the approximate amount of time required for a computer or a cluster of computers to guess various passwords. The figures shown are approximate and are the maximum time required to guess each password using a simple brute force "key-search" attack, it may (and probably will) be possible to guess correctly without trying all the combinations shown using other methods of attack or by having a "lucky guess".
See the <a href="#Classes">bottom of the page</a> for details about the classes of attack.

10 Characters

Just numbers. As you can see choosing a password from such a small range of characters is a bad idea.

Numerals 0123456789
Password Class of Attack
Length Combinations <a href="#classA">Class A</a> <a href="#classB">Class B</a> <a href="#classC">Class C</a> <a href="#classD">Class D</a> <a href="#classE">Class E</a> <a href="#classF">Class F</a>
2 100 Instant Instant Instant Instant Instant Instant
3 1000 Instant Instant Instant Instant Instant Instant
4 10,000 Instant Instant Instant Instant Instant Instant
5 100,000 10 Secs Instant Instant Instant Instant Instant
6 1 Million 1½ Mins 10 Seconds Instant Instant Instant Instant
7 10 Million 17 Mins 1½ Mins 1½ Mins Instant Instant Instant
8 100 Million 2¾ Hours 17 Mins 1½ Mins 10 Seconds Instant Instant
9 1000 Million 28 Hours 2¾ Hours 17 Mins 1½ Mins 10 Seconds Instant

26 Characters

The full alphabet, either upper or lower case (not both in this case).

Upper Case Alpha ABCDEFGHIJKLMNOPQRSTUVWXYZ
Lower Case Alpha abcdefghijklmnopqrstuvwxyz
Password Class of Attack
Length Combinations <a href="#classA">Class A</a> <a href="#classB">Class B</a> <a href="#classC">Class C</a> <a href="#classD">Class D</a> <a href="#classE">Class E</a> <a href="#classF">Class F</a>
2 676 Instant Instant Instant Instant Instant Instant
3 17,576 < 2 Secs Instant Instant Instant Instant Instant
4 456,976 46 Secs 5 Secs Instant Instant Instant Instant
5 11.8 Million 20 Mins 2 Mins 12 Secs Instant Instant Instant
6 308.9 Million 8½ Hours 51½ Mins 5 Mins 30 Secs 3 Secs Instant
7 8 Billion 9 Days 22 Hours 2¼ Hours 13 Mins 1¼ Mins 8 Secs
8 200 Billion 242 Days 24 Days 2½ Days 348 Mins 35 Mins 3½ Mins
9 5.4 Trillion 17 Years 21 Months 63 Days 6¼ Days 15 Hours 1½ Hours
10 141 Trillion 447 Years 45 Years 4½ Years 163 Days 16 Days 39¼ Hours
12 95 Quadrillion 302,603 Years 30,260 Years 3,026 Years 302 Years 30 Years 3 Years
15 1.6 Sextillion 53 Trillion years 532 Million years 53 Million years 5 Million years 531,855 Years 53,185 Years
20 19.9 Octillion 63 Quadrillion years 6.3 Quadrillion years 631 Trillion years 63.1 Trillion years 6.3 Trillion years 631 Billion years

36 Characters

The full alphabet, either upper or lower case (not both in this case) plus numbers.

Upper Case Alpha ABCDEFGHIJKLMNOPQRSTUVWXYZ
Lower Case Alpha abcdefghijklmnopqrstuvwxyz
Numerals 0123456789
Password Class of Attack
Length Combinations <a href="#classA">Class A</a> <a href="#classB">Class B</a> <a href="#classC">Class C</a> <a href="#classD">Class D</a> <a href="#classE">Class E</a> <a href="#classF">Class F</a>
2 1,296 Instant Instant Instant Instant Instant Instant
3 46,656 4 Secs Instant Instant Instant Instant Instant
4 1.6 million 2½ Mins 16 Seconds 1½ Seconds Instant Instant Instant
5 60.4 million 1½ Hours 10 Mins 1 Min Instant Instant Instant

52 Characters

This time we're trying the full alphabet but using a mixture of upper and lower case letters, that effectively doubles the number of combinations when compared with just using a single case.

Mixed Alpha AaBbCcDdEeFfGgHhIiJjKkLlMmNnOoPpQqRrSsTtUuVvWwXxYyZz
Password Class of Attack
Length Combinations <a href="#classA">Class A</a> <a href="#classB">Class B</a> <a href="#classC">Class C</a> <a href="#classD">Class D</a> <a href="#classE">Class E</a> <a href="#classF">Class F</a>
2 2,704 Instant Instant Instant Instant Instant Instant
3 140,608 14 Secs < 2 Secs Instant Instant Instant Instant
4 7.3 Million 12½ Mins 1¼ Mins 8 Secs Instant Instant Instant
5 380 Million 10½ Hours 1 Hour 6 Minutes 38 Secs 4 Secs Instant
6 19 Billion 23 Days 2¼ Days 5½ Hours 33 Mins 3¼ Mins 19 Secs
7 1 Trillion 3¼ Years 119 Days 12 Days 28½ Hours 3 Hours 17 Mins
8 53 Trillion 169½ Years 17 Years 1½ Years 62 Days 6 Days 15 Hours
9 2.7 Quadrillion 8,815 Years 881 Years 88 Years 9 Years 322 Days 32 Days

62 Characters

Mixed upper and lower case alphabetic characters plus numbers.

Mixed Alpha and Numerals 0123456789AaBbCcDdEeFfGgHhIiJjKkLlMmNnOoPpQqRrSsTtUuVvWwXxYyZz
Password Class of Attack
Length Combinations <a href="#classA">Class A</a> <a href="#classB">Class B</a> <a href="#classC">Class C</a> <a href="#classD">Class D</a> <a href="#classE">Class E</a> <a href="#classF">Class F</a>
2 3,844 Instant Instant Instant Instant Instant Instant
3 238,328 23 Secs < 3 Secs Instant Instant Instant Instant
4 15 Million 24½ Mins 2½ Mins 15 Secs < 2 Secs Instant Instant
5 916 Million 1 Day 2½ Hours 15¼ Mins 1½ Mins 9 Secs Instant
6 57 Billion 66 Days 6½ Days 16 Hours 1½ Hours 9½ Mins 56 Secs
7 3.5 Trillion 11 Years 1 Year 41 Days 4 Days 10 Hours 58 Mins
8 218 Trillion 692 Years 69¼ Years 7 Years 253 Days 25¼ Days 60½ Hours

86 Characters

Mixed upper and lower case alphabet and common symbols.

Mixed Alpha & Symbols AaBbCcDdEeFfGgHhIiJjKkLlMmNnOoPpQqRrSsTtUuVvWwXxYyZz <SP>!"#$%&'()*+,-./:;<=>?@[\]^_`{|}~
Password Class of Attack
Length Combinations <a href="#classA">Class A</a> <a href="#classB">Class B</a> <a href="#classC">Class C</a> <a href="#classD">Class D</a> <a href="#classE">Class E</a> <a href="#classF">Class F</a>
2 7,396 Instant Instant Instant Instant Instant Instant
8 2.9 Quadrillion 9,488 Years 948 Years 94 Years 57 Years 346 Days 34 Days


96 Characters

Mixed upper and lower case alphabet plus numbers and common symbols.

Mixed Alpha, Numerals & Symbols 0123456789AaBbCcDdEeFfGgHhIiJjKkLlMmNnOoPpQqRrSsTtUuVvWwXxYyZz <SP>!"#$%&'()*+,-./:;<=>?@[\]^_`{|}~
Password Class of Attack
Length Combinations <a href="#classA">Class A</a> <a href="#classB">Class B</a> <a href="#classC">Class C</a> <a href="#classD">Class D</a> <a href="#classE">Class E</a> <a href="#classF">Class F</a>
2 9,216 Instant Instant Instant Instant Instant Instant
3 884,736 88½ Secs 9 Secs Instant Instant Instant Instant
4 85 Million 2¼ Hours 14 Mins 1½ Mins 8½ Secs Instant Instant
5 8 Billion 9½ Days 22½ Hours 2¼ Hours 13½ Mins 1¼ Mins 8 Secs
6 782 Billion 2½ Years 90 Days 9 Days 22 Hours 2 Hours 13 Mins
7 75 Trillion 238 Years 24 Years 2½ Years 87 Days 8½ Days 20 Hours
8 7.2 Quadrillion 22,875 Years 2,287 Years 229 Years 23 Years 2¼ Years 83½ Days

Examples

These are just a couple of examples to show the resilience of certain types of password, using the information in the tables above you will be able to make your own examples.

Sample Passwords Class of Attack
Pwd Combinations <a href="#classA">Class A</a> <a href="#classB">Class B</a> <a href="#classC">Class C</a> <a href="#classD">Class D</a> <a href="#classE">Class E</a> <a href="#classF">Class F</a>
darren 308.9 Million 8½ Hours 51½ Mins 5 Mins 30 Secs 3 Secs Instant
Land3rz 3.5 Trillion 11 Years 1 Year 41 Days 4 Days 10 Hours 58 Mins
B33r&Mug 7.2 Quadrillion 22,875 Years 2,287 Years 229 Years 23 Years 2¼ Years 83½ Days

<a name="Classes">Classes</a> of Attack

These are just some example speeds, I'd be interested to hear from people with more information about the speed taken to crack various types of passwords with various hardware.

<a name="classA">A.</a> 10,000 Passwords/sec
Typical for recovery of Microsoft Office passwords on a Pentium 100

<a name="classB">B.</a> 100,000 Passwords/sec
Typical for recovery of Windows Password Cache (.PWL Files) passwords on a Pentium 100

<a name="classC">C.</a> 1,000,000 Passwords/sec
Typical for recovery of ZIP or ARJ passwords on a Pentium 100

<a name="classD">D.</a> 10,000,000 Passwords/sec

Fast PC, Dual Processor PC.

<a name="classE">E.</a> 100,000,000 Passwords/sec

Workstation, or multiple PC's working together.

<a name="classF">F.</a> 1,000,000,000 Passwords/sec
Typical for medium to large scale distributed computing, Supercomputers.

<a href="http://www.distributed.net/">Distributed.net</a>'s Project Bovine RC5-64 possibly the fastest computer on earth has recently reached a speed of 76.1 Billion passwords per second!

リンク

「http://wiki.markupdancing.net/index.php?title=Password_Recovery_Speeds&oldid=594」より作成
個人用ツール
名前空間
変種
操作
案内
ツールボックス