How strong is nfc password with 8 bytes? How much time needed to bruteforce it?

[abhijeet_7]

Hi Team,

How strong is 8 bytes NFC password given the fact that there is no lockout mechanism. Assuming an attacker with physical proximity tries to brute-force (try all combination) the password on nfc chip, How much time will be needed to crack the password? How to calculate the time it takes to perform one valid/invalid authentication attempt on nfc chip?

[Peter BENSCH · Accepted solution]

Welcome @abhijeet_7, to the community!

Well, you can easily work that out for yourself: 2^64 = 1.845*10^19 codes, divided by an assumed 10000 brute force attacks per second = approx. 58.45 million years. Do you want to wait that long?

Regards
/Peter

[abhijeet_7]

Thanks @Peter BENSCH for the explaination I really appreciate it. I am interested in knowing how the assumed 10000 brute force was derived. I referred the datasheet of ST25DV04KC and found that the chip supports fast read access up to 53 Kbit/s which approximates to 829 password reads from memory per second. So I was assuming that the maximum bruteforce attempts per seconds will be 830 approx. Is there any caching mechanisms on the NFC chip which can reduce the authentication time or my assumption is correct?

[Peter BENSCH]

@abhijeet_7 I only took the 10000 attacks as an example, it is not a number stored somewhere. However, the total time required for the approx. 830 per second and 64Bit is also a good 12 times as long, i.e. 704 million years…