Suppose I know that the password is composed of characters [A-Za-z0-9], length is unknown, but maybe less than 8. If I have information about the salt use to perform hashing, and also hashing algorithm(SHA-512) is known, how long will brute-forcing the password will take? what is the mathematical relationship with time for password lengths = 1,2,3,4,5,6,7,8?
So your alphabet is 26 + 26 + 10 = 62 characters. If they are completely random (they often are not completely random, but OK) then each time you add a character the brute forcing will be 62 times more difficult.
So if you have a 8 characters then you will need a maximum of 218,340,105,584,896 tries. As the password could be any of these, the average search time would be half that number.
If you need to search for multiple passwords then you would still only need a single pass - so testing more password hashes at once is more efficient. If each password is salted separately then this speedup doesn't apply though.
You can simply calculate the table using a WolframAlpha query.
- How long each try will take depends of course on the speed to check each possibility;
- This problem is "embarrassingly parallel", so if you've got more computers you can simply throw them in;
- The hash algorithm itself doesn't make a difference when it comes to the order of the tests (the number of tests to perform), although it of course does influence the time it takes to test each possibility.
- The salt will not make a difference during testing of one password hash, except if it triggers another block to be hashed; for SHA-512 this is not likely.