問51
頻出度★★★
パスワードの解読方法の一つとして, 全ての文字の組合せを試みる総当たり攻撃がある。“0” から “9” の10種類の文字を使用できるパスワードにおいて, 桁数を4桁から6桁に増やすと, 総当たり攻撃でパスワードを解読するための最大の試行回数は何倍になるか。
平成26年度 春期 ITパスポート試験 問51
テクノロジ系セキュリティ › 情報セキュリティ
This question's explanation and your answers so far.
解説
問 51
Incorrectア
1.5 comes from taking the ratio of the digit counts themselves, 6 ÷ 4 = 1.5, as the answer. The total number of combinations is not proportional to the number of digits; it grows as 10 to the power of n, with the digit count as the exponent, so the ratio of digit counts cannot be used directly as the factor for the number of attempts.
Incorrectイ
20 comes from combining the 2 extra digits and the 10 character types as 10 × 2 = 20, treating them with simple multiplication or addition. Since the total is multiplied by 10 for each additional digit, adding 2 digits gives 10 × 10 = 100 times, not 10 × 2 = 20 times.
- ウ
正解 The correct answer is ウ, 100. A brute-force attack tries every possible password combination one after another, so the maximum number of attempts equals the total number of possible passwords. Each digit can use 10 characters (from 0 to 9), and each digit is chosen independently, so an n-digit password has 10 to the power of n possible values. Therefore 4 digits give 10 to the 4th power = 10,000 combinations, and 6 digits give 10 to the 6th power = 1,000,000 combinations. The factor is 1,000,000 ÷ 10,000 = 100. Using the law of exponents, increasing the length from 4 digits to 6 digits, that is by 2 digits, means a factor of 10 to the power of (6 − 4) = 10 squared = 100, so you can answer immediately by multiplying by the number of character types for each added digit, without computing the totals. The key point of this question is this multiplicative growth: every extra digit of password length multiplies the cracking effort by the number of character types (10 times per digit here).
Incorrectエ
1,024 is 2 to the 10th power. It comes from a calculation unrelated to this question's conditions, such as mistaking the character set for 2 types (binary 0 and 1). In fact, even with only 2 character types, going from 4 digits to 6 digits gives a factor of only 2 squared = 4, and the number 1,024 cannot be derived from any of the conditions in this question.
ここがポイント
- The maximum number of attempts in a brute-force attack equals the total number of password combinations. If m character types can be used and the length is n digits, the number of combinations is m to the power of n.
- When the length increases from n1 to n2, the factor is m to the power of (n2 − n1). In this question that is 10 to the power of (6 − 4) = 100. Adding just one more digit multiplies the cracking effort by the number of character types, so the longer the password, the more dramatically its strength increases.
用語