Bruteforce

Brute force, in computing, refers to a method of solving a problem by exhaustively trying all possible possibilities until a solution is found. In security contexts, a brute-force attack is an attempt to gain access by systematically checking all possible credentials or keys until the correct one is discovered. The approach is simple and guarantees a solution if the search space is finite, but it can be prohibitively slow as the number of possibilities grows.

Brute-force search is a general algorithmic strategy. It is complete, meaning it will find a solution when one exists, but its time and resource requirements typically grow with the size of the search space. The method is often used as a baseline or last resort when more efficient techniques are unavailable or impractical.

Brute-force attacks are most associated with password cracking and key recovery. The practicality of such attacks depends on the length and complexity of the secret, the strength of the hashing or encryption scheme, and the availability of computing resources. Modern systems employ defenses to hamper brute forcing, such as rate limiting and multi-factor authentication, and use memory-hard password hashing schemes (for example bcrypt, scrypt, and Argon2) to increase the cost per guess. Salting hashes prevents reuse of identical passwords across users, and robust key derivation functions make brute-forcing cryptographic keys expensive.

Limitations and considerations: while brute force is conceptually straightforward, it is rarely practical against well-protected targets. For small search spaces or clearly defined problems, brute-force methods can be effective for verification or benchmarking purposes.