Often deemed as inelegant, brute-force attacks can be very successful. This method uses simple trial and error to solve cryptographic algorithms, which uses any possible combinations of numbers, letters, blank and special characters. Hackers as well as authorities use brute-force attacks to decode any encrypted data such as passwords, messages or DES keys.
In a recent post about the Caesar cipher we learned that each letter in the plaintext is replaced by a letter with a constant number further in the alphabet. We will use this Caesar cipher to show a very basic and simple brute-force attack.
I love to encrypt my password for Steemit encrypted with ROT3 results in F ilsb ql bkzovmq jv mxpptloq clo Pqbbjfq . The key to decipher is I. A brute-force attack will try all the keys from A to Z to receive the plaintext.

Since the ROT13 cipher is as ancient as Caesar, it is not often used and is not at all safe. Nowadays passwords are stores as hashes created by cryptographic hash algorithms such as SHA, MD5 etc. A hash is a transformation of character strings into a shorter value of fixed-length. If the value cannot be turned back into the original string the hash is considered safe.
Using a strong cryptographic hash algorithm makes sure that the transformation is one-way and cannot be reversed. When a user enters his password it is hashed and compared with the stored hash. If the value matches the authentication is successful and the password is correct.

Rainbow Tables

One kind of attack similar to brute-forcing is the use of rainbow tables. These allow hackers to attack the hashed password in reverse using a precomputed table. While brute-forcing enters a random password into the locked program to see if the hashes matches, the rainbow method does this offline. This method requires that the hash to be reserved is known. The rainbow table is list of hashes for each word in a dictionary. Instead of verifying a match after every input like the brute-force attack,the rainbow method scans to see if the hash in the table.

This attack became popular because memory became cheaper and had a shorter computing processing time compared to brute-force. The following figure gives an idea how large the tables become with more characters:

G jmtc rm clapwnr kw nyqqumpr dmp Qrcckgr	Key: G
H knud sn dmbqxos lx ozrrvnqs enq Rsddlhs	Key: H
I love to encrypt my password for Steemit	Key: I

Figures taken from http://www.codinghorror.com/blog/archives/000949.html

Dictionary Attack

A dictionary attack is a method used to determine decryption keys or passphrases by systematically entering words from a dictionary list. In order to apply an attack the hacker uses a set of the most common words, digits and sometimes personal information such as names or date of birth.

Dictionary attacks can be very successful because most people use very weak passwords. Here is an analysis by WP Engine about popular passwords and common patterns:

Source: wpengine.com

The main difference between Dictionary, Brute-Force and Rainbow table is that Dictionary and Brute-Force enter the password one after the other and checks for a match of the hashes, while Rainbow does the whole process offline and requires that the hash to be matched is known.

Character Set	Length	Table Size
ABCDEFGHIJKLMNOPQRSTUVWXYZ	14	0.6 GB
ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789	14	3 GB
ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()-_+=	14	24 GB
ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()-_+=~`[]{}|:;"'<>,.?/	14	64 GB

Dictionary Attack Trying coke : failed Trying yourmama : failed Trying justin: failed ... Trying letmein : failed Trying St33mit : success!

Brute Force Attack Trying aaaa : failed Trying aaab : failed Trying aaac : failed ... Trying acdb : failed Trying acdc : success!

How to simply protect Yourself

There are ways to secure yourself against attacks like brute-force, dictionary and rainbow tables. When it comes to choosing your password, consider the following advice:
 

• Use many characters: Try to increase the amount of characters you use. The more characters you use the longer it will take to break your code.
• Avoid: Short passwords like “hello”,”mynameis” etc.
   
• Use different characters: Use as many different characters as possible. Use digits, letters, special characters etc.
• Avoid: Don’t focus on letters only. Try to avoid the same characters in a row like: “abcabc” or “123123”
  
• Don’t replace letters for special characters like “Name → N@me“
• Don‘t use words from a dictionary
• Change your password periodically
• Don‘t use personal information like your name, names of friends, birthdays etc. 

The more complex the password, the more time it takes to brute-force it:

Password consists of	Possible combinations	Time to decode
5 characters (3 lower case, 2 digits)	365= 60.466.176	60.466.176 / 2.000.000.000 = 0,03 seconds
7 characters (1 capitals, 6 lower case)	527= 1.028.071.702.528	1.028.071.702.528 / 2.000.000.000 = 514 seconds= ca. 9 minutes
8 characters (4 lower case, 2 additional character, 2 digits)	688= 457.163.239.653.376	457.163.239.653.376 / 2.000.000.000 = 228.581 seconds= ca. 2,6 days
9 characters (2 capitals, 3 lower case, 2 digits, 2 additional characters)	949= 572.994.802.228.616.704	572.994.802.228.616.704 / 2.000.000.000 = 286.497.401 seconds= ca. 9,1 years
12 characters (3 capitals, 4 lower case, 3 additional characters, 2 digits)	9412= 475.920.314.814.253.376.475.136	475.920.314.814.253.376.475.136 / 2.000.000.000 = 237.960.157.407.127 seconds = ca. 7,5 million years

When it comes to protection against Rainbow Tables the use of Salt is recommended. Two users with the same password will have the same hash. By adding an additional string to the password before hashing we create a randomized hash. These new hashes make the use of Rainbow Tables almost impracticable. There exist Rainbow Tables with additional Salts but these tables are way too large and are not efficient enough. The salt is stored in database along with hash. When the additional string is stored desperately we speak of pepper. Combining pepper and salt is very effective.

Privacy is our right and we need to know how to protect ourselves

Recent Posts:

• The most famous Field Cipher: ADfGVX - And its important Role during WWI
• Who’s the real Threat to your Security? Rogue Hackers vs. the Government
• Caesar used Encryption and so should You

Don't miss the next Steemit Crypto Challenge this week. More information will follow tomorrow. Solve the Crypto puzzle and win a generous reward. Show us your code-cracking skills.

Feel free to tell us what you think about Encryption and what you would like to read next

-Tim Said