Critical bug disclosureFew days ago the guy who found a
vulnerability in Blockchain.Info and picked
the secret phrase of Nxt genesis account found a security flaw in NRS cryptographic algorithm.
Can someone explain how he found out the passphrase of the genesis account?
"It was a bright cold day in April, and the clocks were striking thirteen."
It has 14 words and some punctuation. Ignoring the punctuation and using a simple 2000 words long dictionary (and this is tiny! There are
1013913 words in the English language) we get 2000^14 possible passphrases, or about 10^46 possibilities, if we go by characters from the alphabet, it has 26^72 ~ 10^101 possibilities. A password written in base 58 and 26 characters long is also about 10^46 possibilities. In comparison, a random 8 character long password takes 3 hours to crack on a desktop pc. 9 char -> 3days, 10 char -> 1 year, 11 char -> 48 years. 26 char -> An octillion years.
Now it is a given that the entropy of a random password is much higher than that of a phrase from a novel, but I still can't see how he could crack the passphrase unless the entire thing was already in his dictionary! Let's not forget he was using a python script which is notably slow!