Mask Attack — Comprehensive Operation

Project reference document Time2Crack

Recipients: developers, security researchers, advanced users

Contents

1. Overview

Mask attack consists of testing passwords that follow a precise positional shape instead of all possible combinations.

Example: instead of testing all space 8 characters out of 95 symbols (95^8), the attacker targets a probable motive such as:

• 1 capital,

Either the Hashcat mask ?u?l?l?l?l?l?d?d.

The central idea: human passwords are not random. They are often structured (Thomas42, Marine2024, Bonjour!1The mask exploits precisely this regularity.

2. Historical and academic background

2.1 Origins

The logic of masks is old: from the first cracking tools, operators observed that password policies produce repetitive formats.

Industrialization comes with:

2.2 Empirical validation

The offensive/defensive literature converges: a very large fraction of real passwords follow simple patterns (word + digits, capital initial + word + year, etc.).

Wheeler (USENIX 2016), and the probabilistic works (Markov/PCFG/OMEN), show that the structure is as decisive as the gross length.

3. Conceptual Foundations: Why Masks Work

3.1 Humans generate structures, not by chance

Most users build memory secrets:

This strategy is predictable and highly compressible in masks.

3.2 Complexity policies enhance predictability

A rule of the type "1 capital, 1 digit, 1 symbol" does not impose randomity; it often pushes towards stable patterns:

The mask is the ideal tool to browse these diagrams at a very low cost.

3.3 Reduction of the effective keyspace

For a password of length 8 :

The reduction is several million times, while covering a common human pattern.

4. Architecture of a Modern Mask Attack

Pipeline type:

1) Profilage de la cible / du corpus
   -> structures fréquentes (L8D2, L6D4, U1L5D2, etc.)
2) Generation of candidate masks
-> ordered by probability
3) GPU execution (Hashcat -a 3)
-> high speed parallel tests
4) Adaptive adjustment
-> we keep the masks high, we spread the weak

Success depends less on the gross amount of masks than on their prioritization.

5. Mask Syntax (Hashcat/JtR)

5.1 Basic classes

5.2 Examples

5.3. Custom masks

Hashcat allows custom character sets (-1, -2, etc.), for example:

6. Keyspace reduction: mathematical principle

Or a mask of length n with positional cardinalities c1, c2, ..., cn.

The masked keyspace is:

Time (budget model):

In a naive, unmasked model:

The mask gain is:

The stronger the positional constraints (e.g., digits at the end, capital in the head), the greater the gain.

7. Implementation in Time2Crack: addMaskAttacks()

Time2Crack implements mask logic in app.js :

7.1. Calculation of the masked keyspace

The code counts the actual occurrences of each character type in the password:

Then built:

This models an attacker knowing the structure by type, not just the total length.

7.2 Special cases

The time is then estimated by budgetTime(effectiveMaskGuesses, a.rate) (with mask rank factor and Unicode/date processing).

8. Date detection and structural reduction

Time2Crack includes a specific date processing (hasDate, detectDateAndReduce) :

Consequence: a type password Mot2024! This is consistent with offensive practice.

9. High fidelity calibration

When the high fidelity mode is active, the mask category receives an additional multiplier in applyHighFidelityCalibration() :

Intuition: These signals increase the probability of an early ranking in the line of masks tested.

10. Benchmarks and orders of magnitude

Orders of magnitude (profile 12x RTX 4090):

Reading:

11. Concrete examples of mask cracking

11.1 Thomas42

11.2 summer2024

11.3 Marine!7

12. Comparison with Crude Force, Hybrid and PCFG

In practice, operators often combine mask + rules + probabilistic.

13. Limitations of Mask Attack

14. Effective defences

14.1 User side

14.2. System side

14.3 Policy

15. Bibliographic references

Academic sources