AES-256 password cracking time

Question

My question is kinda simple.

I want to use AES-256 encryption to encrypt my backup. Using a password like this: 7okufZ308@lB$^KTINX1NWbpdw6rkysxv@giMW5jgI#ZaX*#YwloT3Y$*c*2qVCW

This has 64 chars and I wanted to know what is the possible cracking time for a password like this? The software I will be using has a custom iteration configuration so I set it to 20,000.

(The server running the encryption software has a lot of cpu power) Running a quad Xeon with 128GB of ram so I am not really worried about the encryption time.

I am more worried about how long will it take to crack a password like that?

Answer 1

It will happen immediately, because you just posted your password to the internet, where the adversary is watching.

On the other hand, if you can describe the procedure you used to generate it, we can quantify the adversary's probability, knowing only the procedure and not the specific outcome, of guessing the password in one trial. From there one can quantify the expected cost of an attack that finds it, or the number of trials to find it with any prescribed probability.

For example, if you picked it uniformly at random out of a hat containing

• 7okufZ308@lB$^KTINX1NWbpdw6rkysxv@giMW5jgI#ZaX*#YwloT3Y$*c*2qVCW
• aqfSLH4)K{*zDH:$t6(G^alcSEN\Tbc#8X)W3P[whp%kC@Kn>T#.Q8BQ6=q+![/>
• D%]Auqkuel:W4l(/YqBuXSTx7Oh.0]Wq"jly>["t?8wVmUnR+ivCS?<)}+P=-:1N
• I am the very model of a modern major passphrase

then the adversary has a 1/4 probability of getting it right in the first trial, and the expected number of trials before the adversary will get it right is 2.

I recommend picking it uniformly at random out of a hat containing at least $2^{128}$ possibilities.

For example, you could flip a coin 128 times and use the outcome as a seed for a CSPRNG from which you sample octets, rejecting those that do not encode graphic characters in US-ASCII, until you have collected 64 of them.

That's not a very efficient use of the password space, though: the adversary's most efficient attack is probably on the 128 coin flip outcomes rather than on the password. So you could safely bring your password down to 20 US-ASCII characters.

Alternatively, if you want it to be more memorable, you could pick a sequence of 10 words independently and uniformly at random out of a list of 7776 of them, with the help of diceware and a standard household appliance, or with the same rejection sampling technique on a CSPRNG if your name is not Raphael Weldon.

Note that for a uniform distribution on $2^{128}$ possible passwords to be safe against multi-target attacks, you must be sure to combine your password with a hefty salt. Otherwise, or if you are concerned about quantum computers, it may be prudent to double these numbers (256 coin flips, 40 US-ASCII characters, 20 diceware words) to bring it up to $2^{256}$ equiprobable possibilities, or at least bring it up to $2^{192}$.