The Brute Force Attack — Comprehensive Operation

Project reference document Time2Crack

Recipients: developers, security researchers, advanced users

Contents

1. Overview

Crude force is the most fundamental attack in password cracking: it consists of testing systematically all possible combinations No intelligence, no heuristic — only the raw computing power against the size of the space to travel.

In Time2Crack, brute force plays a double role:

2. Historical and academic background

2.1 Origins

The raw force precedes the computer: the principle of testing all possible combinations is used since the first mechanical encryption machines (Enigma during the Second World War). The bomb of Alan Turing was, in a broad sense, a device of raw force forced by a hypothesis of cribs.

With the advent of computers, the unix password force was formalized from the 1970s to the 1980s:

2.2 Benchmarks

The GPU revolution changed the order of magnitude of the raw force. On CPU, an attacker of the 1990s tested ~10,000 MD5/second passwords. A RTX 4090 in 2024 in test 168.9 billion per second — an acceleration of 16 million times in 30 years.

• Gosney, J (2012) : first multi-GPU public benchmark on LM/NTLM, showing 180 GH/s with 8 GPU
• Hive Systems (2025) : annual tables calibrated on 12× RTX 4090, quoted by Forbes, CNBC, BBC
• Sprengers, M. (2011) : Radboud University thesis on GPU cracking, mathematical formalization

3. Math bases: keyspace and entropy

3.1 Keyspace

Keyspace (keyspace) is the total number of possible passwords for a given length and tank:

keyspace = charset_size ^ length

Examples:

3.2 binary entropy

Entropy (measured in bits) is the logarithmic formulation of keyspace:

entropie = length × log₂(charset_size)

In Time2Crack (function entropy()) :

function entropy(pw) {
  return pw.length * Math.log2(getCharset(pw).size);
}

The relationship between entropy and keyspace:

keyspace = 2^entropie
entropie = log₂(keyspace)

3.3 Mathematical Hope: Keyspace / 2

Crude force does not always test keyspace Integer combinations — on average, it finds the password midway, as the target is equiprobably distributed in space.mathematical expectation the number of attempts is therefore:

tentatives_attendues = keyspace / 2

This is exactly what models bruteTime() in Time2Crack:

// "For brute force: expected value is keyspace/2 (uniform random search)"
function bruteTime(keyspace, rate) {
  const ls = Math.log(keyspace / 2) - Math.log(rate);
  return Math.exp(ls); // = (keyspace / 2) / rate
}

This division by 2 is correct under the assumption that the attacker travels the space linearly (non-repetitive). keyspace/2 Attempts.

14. Effective defences

14.1 User side: length and randomity

Gross force is defeated by two combined factors:

• Password Manager + Random Generation ≥ 16 characters with complete float = out of range of any raw force in a human life horizon

14.2 Server side: resistant algorithms

The choice of the hash algorithm multiplies or divides the raw force time by factors up to several million :

15. Bibliographic references

Academics

Industry