Okish, just a quick note on calculating brute-force cracking times and possible combinations.
If you've read the articles, Basic WEP cracking, Basic WPA cracking and Wifi security it's time to talk a bit about how to calculate combinations, and how log it takes to crack a given combination.
But why ?. Because it will tell us, if we've using a good and complex password, and making the trade off between characters and combinations.
The basic formula is :
S= C N
S is total amount of combinations, C is total amount of characters in charecter set, and N is the total length of the password range.
So, for an all lowercase 8 character legth, the total amount is :
S=268
That's all well and good, IF we know the length of the password. What if we dont ?
We can account for that, using this method, in this example it's 1-6 used for length
S = C + C2 + C3 + C4 + C5 + C6
What if we have one of the characters, being a number, same applies. C just becomes 10 (numbers possible = 0-9
Special characters, same, just a different value
Calculating time is just T = S / keys pr second
T = Time in seconds
S = combo's we found
Keys pr second. There's no fixed number here. On my system it's 12000 keys / second, using just normal CPU load, and 95 % load on all eight cores. This is a number that have to be found by trial and error depending on the system used.
This doesn't apply to clusters and distributed cracking, or GPU cracking, that's another game entirely.
For systems configured the same, it could be something like keys pr second X number of systems.
But a more thought out strategy generating wordlists would apply here, since splitting up the wordlist would cut down on the time the crackers needs to run before they are done going through the combo's, and also cutting down the size of the wordlists.
An quick example :
Generating a wordlist with every possible combination, (a-z), 10 characters, would result in a file about 1500 TB (According to Crunch)
Cutting it down to half that, using a mask of aaaaa%%%%% to Crunch, saying we know the first five, and only needs to bruteforce the last five, is resulting in a 3 GB wordlist. And yes, it will find the last five in a bruteforce attack. Here it took 4 hours and fortyfive minuttes using standard Aircrack-NG cracking.