Given: Known ciphertext (in hex) (ciphertext is the exact length of the message (i.e. non-padded). It is known that the cipher was developed using CBC. There is one and only one ciphertext message that was grabbed. The exact ASCII range of the plaintext is known.
Known IV in Hex
Known partial key! (in binary) 91 bits (rightmost) of the key--meaning the first 37 bits are unknown. This key is: XXXXXXXX.XXXXXXXX.XXXXXXXX.XXXXXXXX.XXXX1100.00000000.00000000.00000000.00000000.00000000.00000000.00000000.00000000.00000000.00000000.00000011
This should translate to 00000000_0C000000_00000000_00000003 in hex unless I've done something wrong. In the translation the 0's to the left of the "C" should be unknown (so F's in keymask). The zeros between the x and the 3 are known "0s" and should be there.
Key mask to search this should be something like "FFFFFFFF_F0000000_00000000_00000000"
What would a method try to brute this? Is this even realistic? Is there software already developed (open source) that already has the ability to plug in a known portion of a key, the cipher, and IV to try to brute without re-inventing the wheel?
As for complexity, wouldn't the complexity be something like $n^{37}$. since the other 91 of the key are known? Or is there another mathematical factor that I am missing here?