As some password manager, such as KeyPassXC allows a user to create a master password using a HMAC response from a YubiKey concatenated with a password entered by user, I was wondering something.
*The encryption key is created with PBKDF2 HMAC-SHA256 from the YubiKey HMAC result and a user-provided input"
*With 150,000 iterations
*The HMAC response has 160 bits of entropy
*The user-provided response has 40 bits of entropy
If an attacker acquired the YubiKey and now knows the first 160 bit of the master password, could they crack the remaining 40 bit using brute force? And if yes, would one need to concatenate the 2 secrets randomily in order to combat this?