Cracking Passwords in Forensic Investigations - Scholarly ...

Thus, the cost of cracking a password can be calculated as:
Cost of cracking a password = Direct costs + Fair share of indirect costs.
The time required to crack a password determines the indirect costs such as power
costs and computer and equipment depreciation costs. Thus, the amount of time
spent would be directly related to other indirect costs. Because of this, if the
amount of time is reduced or managed, it could be possible to reduce or manage
the costs of cracking a password.
2.4.2.3 Time Estimation
As discussed above, time is the direct cost involved for the purpose of calculating
the costs of cracking a password. It is difficult to estimate the time required to
crack a password. If the password is ‗len‘ characters in length and the character
space contains ‗alpha‘ number of characters, then the key space (the space
containing all possible combinations of passwords) of the password ‗k‘ would be
alpha len (Rowan, 2009). Therefore, as the number of characters and the length of
the password increases, its key space increases exponentially. This can be shown
in Table 2.3 below.
Table 2.3: Comparison of character space, length, key space and maximum time
taken to crack a password (Adapted from Rowan, 2009, p. 5)
Character
Space Length Key Space
10 4 10000 1 sec
10 5 100000 1 sec
10 6 1000000 2 sec
26 4 456976 1 sec
26 5 11881376 24 sec
23
Max. Time to Crack @ 500,000
Passwords/Second
26 6 308915776 10 minutes
26 10 141167095653376 9 years