Crypto: Guessing a password by brute-force takes a long time!

glennji | Aug 28, 2007 min read

This weekend was a long weekend, and the (annual?) London FrightFest – lots of new and indy horror movies showing in Leicester Square over four days.  It would’ve been fun but as we’re being cheap whilst on a single income we opted to stay home and watch horror movies instead.

I thought we could probably download something, so we gave it a go.  Unfortunately one of the movies I downloaded – not even a horror, not even likely to be very good – was archived in an encrypted RAR file.  Worse, whoever packaged it up wanted me to call a phone in the US to hear the password (at $100/min, no doubt).

So I’m not going to do that, of course.  Instead I wrote a little Java application to brute-force the RAR password.  That’ll show ’em, provided it ever finishes.

Of course, it takes a long time.  Say I have 26 letters, in upper and lower case, 10 digits and 10 symbols – that’s 26 + 26 + 10 + 10 = 72 characters in the character pool, right?

If it’s a 6 character password, allowing repetition, that’s

726 = 139,314,069,504 possibilities.

I’ve scripted it to try all 6, 7 and 8 character passwords at the moment.  Be cool if it works, however.