A password in line with the recommendations in the Wireless Overview wiki, would be impossible to crack in a human lifetime:
-
Since I'm not sure on the exact number of symbols that can be utilized, let's use 18. With case sensitive, alphanumeric, this would equate to 80 possible characters than can be utilized.
- (17*10^-6 * 80^16) / 2 / 60 / 60 / 24 / 365 = x
- 17*10^-6 = 0.0017ms
- Approximately how long it takes an 8C 2.8GHz CPU to process SHA512 hashes
- I don't believe wifi passwords use SHA512 for hashing, but I do believe they use SHA256
- I don't believe wifi passwords use SHA512 for hashing, but I do believe they use SHA256
- Approximately how long it takes an 8C 2.8GHz CPU to process SHA512 hashes
- 80^16 = 2.81474976710656e+30
- 80: amount of alphanumeric characters
- 26 lowercase
- 26 uppercase
- 10 numbers
- 18 symbols
- 16: Amount of characters in the password
- 80: amount of alphanumeric characters
- 17*10^-6 = 0.0017ms
- (17*10^-6 * 80^16) / 2 / 60 / 60 / 24 / 365 = 758,668,601,611,040,100 yrs per PC
- Let's say a botnet has 100,000 devices:
- (17*10^-6 * 80^16) / 2 / 60 / 60 / 24 / 365 / 10^4 = 7,586,686,016,110.401 yrs
- Botnet completely comprised of GPUs for calculations (+100>)
- (17*10^-6 * 80^16) / 2 / 60 / 60 / 24 / 365 / 10^6 = 75,866,860,161.10402 yrs
- (17*10^-6 * 80^16) / 2 / 60 / 60 / 24 / 365 / 10^6 = 75,866,860,161.10402 yrs
- Largest botnet ever was 12M devices, and we'll give each a GPU for calculations (+1,200,000,000>)
- (17*10^-6 * 80^16) / 2 / 60 / 60 / 24 / 365 / (12 * 10^8) = 632,223,834.6758667 yrs
- (17*10^-6 * 80^16) / 2 / 60 / 60 / 24 / 365 / (12 * 10^8) = 632,223,834.6758667 yrs
- (17*10^-6 * 80^16) / 2 / 60 / 60 / 24 / 365 / 10^4 = 7,586,686,016,110.401 yrs
- 12M device botnet completely comprised of supercomputers using GPUs for calculations (+180,000,000,000,000>) [150,000 * 12,000,000 * 100]
- (17*10^-6 * 80^16) / 2 / 60 / 60 / 24 / 365 / (18 * 10^13) = 4,214.82556450578 yrs
- (17*10^-6 * 80^16) / 2 / 60 / 60 / 24 / 365 / (18 * 10^13) = 4,214.82556450578 yrs
- Let's say a botnet has 100,000 devices:
- (17*10^-6 * 80^16) / 2 / 60 / 60 / 24 / 365 = x
-
This assumes password will be cracked when half of the possible passwords are checked, hence division of two
- Even with SHA256 hashing, it would still be fundamentally, literally, impossible to brute force a password in line with the recommendations, hence why I added the recommendations.