Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to create a brain wallet using a custom diceware since I don't like the original one. Instead of 7776 words it has 46656 because I use 6 dice for each word instead of 5, and also it only has words with many characters.

So this is what I got so far, please tell me if I made a mistake:

$$\frac{2 ^ {\log_2(46656) · 5} }{ (1 · 10^{15}) · (60 · 60 · 24 · 365)} = 7 \text{ years}$$

  • $2 ^ {\log_2(46656) · 5}$ is the entropy for a password of 5 words
  • $1 · 10^{15}$ is 1 Phash/s, which is the hashing power I'm assuming for this attacker. I don't even know if this makes sense, because an attacker doesn't need to start over for each brain wallet he wants to crack, and also there might have been huge databases of precomputed sha256 hashes before Bitcoin even existed.
  • $60 · 60 · 24 · 365$ represents a year in seconds.
share|improve this question
You calculated the attackers worst case duration ... average case is half of this. – Paŭlo Ebermann Mar 15 '14 at 20:50
Also: the entropy is the base-2 log of the number of (assumed equiprobable) passwords, thus $\log_2(46656)\cdot5$, not $2^{\log_2(46656)\cdot5}$. You do not account for key stretching, which can help a lot in many contexts, perhaps this one. Using long words has no discernible advantage, if they are public, which the computation assumes. – fgrieu Feb 28 at 20:50

Generally correct.

It would take approximately 7 years to brute-force all possible keys generated by your brainwallet format, for an attacker with 1Petahash/sec hashing power. For reference, the current hash rate of the entire Bitcoin network is roughly 1 exabyte / second, 1000 times your hypothetical attacker's hash rate.

This means that on average it would take approximately 3.5 years to crack a single brainwallet.

You also mentioned precomputed hashes. For an attacker to precompute all of the given hashes (assuming 32 bytes per SHA256 hash), they would need to store $46656^5 * 32 \approx 7.07 * 10 ^ {24}$ bytes, amounting to 7.07 yottabytes. This is currently an unpractical amount of storage.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.