Mathematics Analysis and Approaches Internal Assessment
What are the strength of all possible passwords and how much
time will the computer take to crack all possible passwords?
Table of content:
1. Introduction…………………………………………………………… 2
2. Investigation…………………………………………………………...3
a. Brute force attack………………………………………………3
b. Dictionary attack………………………………………………..8
c. Using real-life example: Managebac ………………………..10
3. Conclusion……………………………………………………………..11
4. Evaluation…….………………………………………………………..11
5. Bibliography……..…………………………………………………….12
6. Appendix……...………………………………………………………..13
1
1. Introduction
Every people has secrets, it’s human nature to have something to keep for
ourselves. A password is a tool to keep humans’ secrets. Many people have seen
passwords as a modern intervention, but passwords had been used since ancient
times. In ancient times, passwords are implemented by the military to securely
transmit messages and information. The Greek historian Polybius described how the
Roman legion used a passphrase system that shares many of the characteristics of
modern-day passwords to distinguish whether strangers were friends or enemies. In
the digital age that we are currently living in, passwords had become a necessity in
our lives, this has made the internet store approximately 1.2 million terabytes of
information on the internet (Appendix 1). Passwords are used for the identification of
social media accounts, mail, bank, technological gadgets, etc. Hence, creating a
strong password is crucial to protect your data on the internet. Aside from the
difficulty of remembering passwords, the most grieving aspect of passwords is that
they are easily cracked. In fact, hackers can crack any password with the right
hardware and software, it's just a matter of time. However, a strong password can
make cracking incredibly difficult and time-consuming.
Throughout my essay, a formula will be derived to find the probability of all possible
passwords to be cracked and how much time is needed to crack the passwords. The
2 cracking techniques that I will be using are brute force attacks, which is a method
that uses all the combinations of letters and numbers to break the password, and
dictionary attacks, which involve systematically entering all words in a dictionary to
crack passwords. I will also calculating the probability of cracking a Managebac
account which is wiTodely use ini every IB schools as my extention.
2
2. Investigation
In real life, while we’re entering into a new social media or a website such as Gmail,
Instagram, Facebook, etc, they often demand certain password requirements, which
include a specific amount of letters, numbers, and special characters. These
requirements are intended to ensure our password to be as strong as possible and
to make the barrier of entry stronger. So, what determines a strong password. To
answer this question, I will use the formulas I created to calculate the strength of
passwords.
The strength of a password is inversely proportional to the probability of hackers
cracking your password. Thus, the lower the probability of cracking your password,
the stronger the password. The probability to break a password is based on 3 factors
such as the number of characters used, the length of the password, and the hacking
method.
2.1 Brute force attack
A brute force attack is a method by which hackers use random numbers，and
letters to break a password. In order to derive a formula, an example of a password
will be used. If the password is numeric and an example password “74785693” is
8
given to break. In order to break this password, the computer will have to try10
possible passwords to get the 8 numbers right. Therefore, the probability to break
1 −8
the password “74785693” for just one try is 8 =10 .
10
3
Thereby, the formula for the strength of the password is derived:
𝐿
𝑠𝑡𝑟𝑒𝑛𝑔𝑡ℎ 𝑜𝑓 𝑝𝑎𝑠𝑠𝑤𝑜𝑟𝑑 (𝑛𝑢𝑚𝑏𝑒𝑟 𝑜𝑓 𝑐𝑜𝑚𝑏𝑖𝑛𝑎𝑡𝑖𝑜𝑛𝑠) = 𝑁
N refers to the number of characters (fixed) and L refers to the length of the
password. For example, a numeric password will have 0~9, which has 10 characters
allowed, N = 10 whereas an alphabetic password will have a~z, which has 26
characters allowed, N = 26.
According to my research, it suggests that a computer can guess more than
100,000,000,000 passwords per second (appendix 2), which means that it takes
−11
1 × 10 . Using the same password “74785693” as above, the strength of the
password can be found by using this formula:
𝐿
𝑠𝑡𝑟𝑒𝑛𝑔𝑡ℎ 𝑜𝑓 𝑝𝑎𝑠𝑠𝑤𝑜𝑟𝑑 = 𝑁
N = 10
L= 8
𝐿 8
The strength of the password: 𝑁 =10
The time needed for a computer to break the password can be calculated by this
formula:
𝑠𝑡𝑟𝑒𝑛𝑔𝑡ℎ 𝑜𝑓 𝑡ℎ𝑒 𝑝𝑎𝑠𝑠𝑤𝑜𝑟𝑑
𝑡= 𝑠𝑝𝑒𝑒𝑑
8
10
𝑡 = 11 = 0.001 seconds
10
Hence, as you can see this password can be hacked by hackers in less than a
second, however, when the complexity of the password increases, the time needed
4
to hack the password will increase as well. To prove this statement, I will add
alphabetical letters and numbers into a password.
𝑁 = 26 + 26 + 10 ( 26 𝑙𝑜𝑤𝑒𝑟 𝑐𝑎𝑠𝑒 𝑎𝑙𝑝ℎ𝑎𝑏𝑒𝑡, 26 𝑢𝑝𝑝𝑒𝑟 𝑐𝑎𝑠𝑒 𝑎𝑙𝑝ℎ𝑎𝑏𝑒𝑡 𝑎𝑛𝑑 10 𝑛𝑢𝑚𝑏𝑒𝑟𝑠)
𝑁 = 62
𝐿 =8
𝐿 8 14
𝑠𝑡𝑟𝑒𝑛𝑔𝑡ℎ 𝑜𝑓 𝑝𝑎𝑠𝑠𝑤𝑜𝑟𝑑 = 𝑁 = 62 = 218, 340, 105, 584, 896 = 2. 18 × 10
14
𝑠𝑡𝑟𝑒𝑛𝑔𝑡ℎ 𝑜𝑓 𝑡ℎ𝑒 𝑝𝑎𝑠𝑠𝑤𝑜𝑟𝑑 2.18 ×10
𝑡= 𝑠𝑝𝑒𝑒𝑑
= 11 = 2183. 401 (𝑠𝑒𝑐𝑜𝑛𝑑𝑠) = 36 𝑚𝑖𝑛𝑢𝑡𝑒𝑠 23 𝑠𝑒𝑐𝑜𝑛𝑑𝑠
10
The results that I calculated show that both of the passwords have the same length,
2183.401
yet the more complex password with 62 characters is 0.001
= 2183401 times
stronger than the less complex password with 10 characters, so it proves that the
more complex the password, the stronger the password.
In order to determine whether the length of a password or the complexity of a
password can give a stronger password, I will use another example in which the
password consists only of numbers but its length is 16 numbers.
𝐿
𝑠𝑡𝑟𝑒𝑛𝑔𝑡ℎ 𝑜𝑓 𝑝𝑎𝑠𝑠𝑤𝑜𝑟𝑑 = 𝑁
N = 10
L= 16
𝐿 16
The strength of the password: 𝑁 =10
5
16
𝑠𝑡𝑟𝑒𝑛𝑔𝑡ℎ 𝑜𝑓 𝑡ℎ𝑒 𝑝𝑎𝑠𝑠𝑤𝑜𝑟𝑑 10
𝑡= 𝑠𝑝𝑒𝑒𝑑
= 11 = 100000(𝑠𝑒𝑐) = 27 ℎ𝑟 46 𝑚𝑖𝑛 40 𝑠𝑒𝑐 = 1 𝑑𝑎𝑦 3 ℎ𝑟 46 𝑚𝑖𝑛
10
My results show that even though the password has numbers (N=10) only but the
100000
strength of the longer password is 2183.401
= 45.8≈ 46 times stronger than the one
that is only 8 characters long but consists of 62 characters (N=62). Hence, I can
conclude that the length of the password plays a more important role in the strength
of the password than the complexity of the password.
Observing the calculations above, it is correct to say that there is an exponential
correlation between the strength of a password and the complexity of the password.
Length of the password (in numbers) The time needed to crack the password
(s)
7 10
7
11 = 0. 0001
10
8 10
8
11 = 0. 001
10
9 10
9
11 = 0. 01
10
10 10
10
11 = 0. 1
10
11 10
11
11 = 1
10
12 10
12
11 = 10
10
13 10
13
11 = 100
10
14 10
14
11 = 1000
10
6
15 15
10
11 = 10000
10
Figure 1: the exponential growth between the time needed to crack the password
and the length of the password
Furthermore, according to the calculation above, we can conclude that the
complexity of the password and strength of the password is directly proportional as
when the complexity of the password increases, the strength of the password
increases too.
Length of the password (in numbers) The time needed to crack the password
(s)
7 62
7
11 = 35. 2
10
8 62
8
11 = 2183. 4
10
7
9 62
9
11 = 135370. 9
10
10 10
62
11 = 8392994. 7
10
11 11
62
11 = 520365606. 8
10
12 12
62
11 = 3226266762. 9
10
13 13
62
11 = 2000285393268. 6
10
14 14
62
11 =124017694346575
10
15 15
62
11 =7.6891E+15
10
Figure 2: the relationship between the time needed to crack the password and the
length of the password in alphabets
2.2 Dictionary attack
8
My calculations above are using the method of brute force attack to break the
password, however, sometimes people will use dictionary words or words that are
meaningful for them instead of using random numbers and characters to create their
password because dictionary words are easier to remember. Therefore, this had led
hackers around the world to create another hack system called dictionary attack
which they upload a specific dictionary into the program and test for each word until
it matches the password.
To differentiate between brute force attack and dictionary attack, I will test the
difference in cracking times between a dictionary attack and a brute-force attack on a
hypothetical password "trigonometryisfun". By using brute force attack the time
needed to crack the password is:
𝐿 17 24
𝑠𝑡𝑟𝑒𝑛𝑔𝑡ℎ 𝑜𝑓 𝑝𝑎𝑠𝑠𝑤𝑜𝑟𝑑 = 𝑁 = 26 = 1. 1 × 10
24
𝑠𝑡𝑟𝑒𝑛𝑔𝑡ℎ 𝑜𝑓 𝑡ℎ𝑒 𝑝𝑎𝑠𝑠𝑤𝑜𝑟𝑑 1.1×10 13
𝑡= 𝑠𝑝𝑒𝑒𝑑
= 11 = 1. 1 × 10
10
If the same password “trigonometryisfun” is hacked using a dictionary attack
by uploading Cambridge Advanced Learner's Dictionary containing 140,000 words
into the program, the formula for the dictionary attack with remain the same with
brute force attack but the only thing that altered is N will be the total number of words
in the specific dictionary and L will be the number of words in the password. Such as
in this case the number of words in the dictionary (N) is 140,000 words and the
number of words in the password (L) “trigonometryisfun” is 3. Thereby, by using a
dictionary attack the time needed to crack the password is:
𝐿 3 15
𝑠𝑡𝑟𝑒𝑛𝑔𝑡ℎ 𝑜𝑓 𝑝𝑎𝑠𝑠𝑤𝑜𝑟𝑑 = 𝑁 = 140, 000 = 2. 7 × 10
9
15
𝑠𝑡𝑟𝑒𝑛𝑔𝑡ℎ 𝑜𝑓 𝑡ℎ𝑒 𝑝𝑎𝑠𝑠𝑤𝑜𝑟𝑑 2.7×10
𝑡= 𝑠𝑝𝑒𝑒𝑑
= 11 = 27440(𝑠𝑒𝑐)
10
13
1.1×10 8
With dictionary attacks take 27440
= 4. 1 × 10 (𝑠)times less time than using brute
force attack to break the password “trigonometryisfun”. This result shows that
passwords that contain dictionary words can be broken fastly when hackers are
using a dictionary attack.
Managebac
Managebac is online planning, assessment, and report platform for all IB schools
and students, therefore a weak password is not acceptable when creating an
account in Managebac. It has the password requirement of at least 8 characters
including upper case letters, symbol and numbers so it is worth knowing how strong
is the password required to enter Mangebac. There are 26 alphabets letters, 26
upper case alphabets letters, 10 numbers, and 40 symbols found on our laptop. The
strength of the password can be used the formula that I derived above:
𝑁 = 26 + 26 + 10 + 40 = 102
𝐿 = 8 (𝑚𝑖𝑛𝑖𝑚𝑢𝑚 𝑐ℎ𝑎𝑟𝑎𝑐𝑡𝑒𝑟𝑠)
𝐿 8 16
𝑠𝑡𝑟𝑒𝑛𝑔𝑡ℎ 𝑜𝑓 𝑝𝑎𝑠𝑠𝑤𝑜𝑟𝑑 = 𝑁 = 102 = 1. 2 × 10
The time needed for a computer to break the password can be calculated by:
16
𝑠𝑡𝑟𝑒𝑛𝑔𝑡ℎ 𝑜𝑓 𝑡ℎ𝑒 𝑝𝑎𝑠𝑠𝑤𝑜𝑟𝑑 1.2×10
𝑡= 𝑠𝑝𝑒𝑒𝑑
= 11 = 117165. 9(𝑠𝑒𝑐) = 1952 𝑚𝑖𝑛 45 𝑠𝑒𝑐
10
The amount of time for hackers to hack into a Managebac account need 1952
minutes and 45 seconds which is approximately 1.4 days for a minimum 8
10
characters password to crack so it is better to create a longer and more complex
password to protect and secure your information.
Evaluation:
Nevertheless, there’re still some limitations in my essay. Some technology
gadgets now use the identification of fingerprints and face to secure information from
the owner. Hence, my calculations might not be suitable in this situation. Other than
that, there’s no exact number of passwords cracked by a computer on the internet,
which will make my results may be inaccurate. So, to make my investigation closer
to reality, I could have used another real-life hacking method to justify my answer,
exploring the probability and finding out the time needed with no information given in
a password and using a hacker-used computer to break the password. These
solutions can bring my investigation more realistic.
Conclusion:
In my investigation, the strength of all possible passwords, the time is taken to
crack a password as well as how a password can be improved are determined. I
have found out that the length of a password can make a password stronger rather
than making a password to be complex. Moreover, dictionary attacks can crack
dictionary words easily, hence, it is worthy to include upper case letters, symbols,
and numbers in s password to decrease the probability of getting hacked. I can
conclude that a strong password consists of longer characters, upper and lower case
11
alphabets, symbols, and numbers. However, I believe that my investigation is useful
and important to every people living in this advanced technological century as the
password has become essential.
Bibliography:
Www-scientificamerican-com-s.webvpn.bjmu.tsg211.com. 2019. The Mathematics of (Hacking)
Passwords. [online] Available at:
<http://www-scientificamerican-com-s.webvpn.bjmu.tsg211.com/article/the-mathematics-of-hacking-pa
sswords/> [Accessed 3 December 2021].
Perry, C., 2015. The Origin of Passwords | Password Security. [online] Blog.bio-key.com. Available at:
<https://blog.bio-key.com/2015/09/14/the-origin-of-password-security> [Accessed 3 December 2021].
www.kaspersky.com. 2021. Brute Force Attack: Definition and Examples. [online] Available at:
<https://www.kaspersky.com/resource-center/definitions/brute-force-attack> [Accessed 3 December
2021].
SearchSecurity. 2021. What is a dictionary attack? - Definition from WhatIs.com. [online] Available at:
<https://www.techtarget.com/searchsecurity/definition/dictionary-attack> [Accessed 3 December
2021].
12
Appendix:
1. Starry Blog. 2021. How Big Is The Internet? Hint: Probably A Lot Bigger Than You Think.
[online] Available at: <https://starry.com/blog/inside-the-internet/how-big-is-the-internet>
[Accessed 3 December 2021].
2. The Conversation. 2021. A computer can guess more than 100,000,000,000 passwords per
second. Still think yours is secure?. [online] Available at:
<https://theconversation.com/a-computer-can-guess-more-than-100-000-000-000-passwords-
per-second-still-think-yours-is-secure-144418#:~:text=It%20achieved%20a%20rate%20faster,
process%20called%20brute%20force%20attacks.> [Accessed 3 December 2021].
3. 2021. [online] Available at:
<https://help.managebac.com/hc/en-us/articles/360019113471-Creating-Strong-Passwords-th
at-are-Easy-to-Remember> [Accessed 3 December 2021].
13
