I've got a Google spreadsheet calculating password hash brute-force times based on a number of factors (length, complexity, hashing algorithm, attacker resources). I've got brute force time calculated in seconds, but depending on what values you plug in, the range of numbers varies wildly from seconds to centuries.

Right now I'm just dividing seconds by 86,400 to get days.. but trivially small times display as 0 days and extremely large times display as 4,000 days or 250,000 days.

It'd be really nice if I could conditionally format the duration based on how big the number is. Even just a days/years distinction would help, but perfect world it would conditionally use seconds, minutes, hours, days, years, etc.

This seems like a problem someone must have solved before, but I've spent a while searching and haven't found a good way to do it.

Any advice/pointers appreciated.

Here's a link to my spreadsheet: https://docs.google.com/spreadsheets/d/1XQsXPZLR43LcFkJtBe2io1otXbwhzVXY-pdLWmNJrrM/edit?usp=sharing

The main sheet lets you specify the size of the character set you assume the passwords to contain and the number of GPUs the attack system has (using oclhashcat). To brute force lower case alphabetical-only passwords you'd use a character set size of 26. A size of 95 is 26 capitals, 26 smalls, 10 numbers, and 33 symbols (including space).

The "Data" sheet calculates the number of possibilities for various password lengths based on your character set size, and some assumptions about how many hashes each GPU in the attack system can generate per second.

Together, they calculate on the main sheet how long it would take, in theory, to brute-force passwords of various lengths. The division by 86,400 is simply a conversion from durations of "seconds" to durations of "days".

  • This is actually quit difficult, to get a good result you often need to know when and even where the 86,400 seconds occured. Did they span a daylight savings shift? If so, it might not equal a full day, but 23 or 25 hours. And when does the daylight savings shift occur in your timezone? There's also leap seconds. And if you want to convert a number of seconds to a number of months ... don't get me started. – Vidar S. Ramdal Mar 22 '17 at 21:31
  • That being said, you probably need to be more specific (or the question risks being closed as too broad). Should values be rounded - e.g. how should a value like 86,401 be displayed? – Vidar S. Ramdal Mar 22 '17 at 21:46
  • Please add more details like the formula or format that you are trying. Also add a table of sample input and the expected result. – Rubén Mar 23 '17 at 14:57
  • @VidarS.Ramdal I hear you about the madness of calendar systems. In my case I'm just calculating durations with no dates involved, so I see calendar considerations as outside the scope of what the spreadsheet is calculating. If I was estimating how long something would take in months, I would assume 30 day months.. I wouldn't say "is February one of the months?" Does that make sense? I've added a link to the spreadsheet and added some explanation. Does this help narrow it down some? You should be able to make a copy of the spreadsheet and plug in your own numbers to see how it works. – adfaklsdjf Mar 23 '17 at 22:59
  • 1
    Yes, that makes sense. However, we still need to know how you'll want to display values that cannot be divided to a bigger unit, like 86,401. If you follow Rubén's suggestion to add a table of example values and their expected display result to your question, I'm sure you would get an answer. – Vidar S. Ramdal Mar 24 '17 at 10:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.