I am trying to encrypt a password for my school project. Here is the process:

  • Let's assume that I have a string p (n characters long) which contains the password.
  • The program reverses the string and stores it in string r.
  • It takes each character of p and r, applies the XOR operator and stores it in string e.
  • Next time the user wants to access the file, she will be asked to enter the password. The entered password will go through the process explained above and will be compared to string e.
  • If both are not equal, access will be denied.

How many combinations it will take a computer to brute force it, in order to show if it is effective?

The assignment prevents me from using any third-party libraries such as bcrypt.

  • 2
    First things first, passwords should not be encrypted, but hashed. The hashing process is similar to what you are doing right now, though. Second thing, are you required to use your own algorithm for passwords?
    – Revenant
    Commented Oct 11, 2016 at 8:43
  • This is for my school project I don't know anything about including hashing in my project. I'm using my own algorithm for passwords because the other algorithm will be hard to include and might require third party applications to do so.
    – Dr.Paradox
    Commented Oct 11, 2016 at 8:50
  • Most languages have some sort of crypto implementation, whether it be built-in or in third-party libraries. What language are you using?
    – Revenant
    Commented Oct 11, 2016 at 9:07
  • 2
    For 8-bit ASCII passwords the maximum number would be 256^n so the password (or text) length would be relevant (). Most users won't use anything but letters and maybe numbers. Assuming the attacker would already know it's XOR and has some idea of password length. Not to mention other methods to which XOR cypher would be highly vulnerable. So for short texts it can be brute forced easily for long text it leaves too many clues (like repeating certain patterns, especially when pasword is shorter than the text) that allow other methods to be used. (Also reversing the password is good for nothing) Commented Oct 11, 2016 at 10:31
  • 1
    @Revenant It's very likely this is a toy assignment for school, meaning no crypto functions may be used, either built-in or external. The purpose is probably to teach the student the complexity and weaknesses of a naive implementation.
    – Andres F.
    Commented Oct 12, 2016 at 0:53

1 Answer 1


No brute forcing is needed. Given the "encrypted" string e, I can produce a fake password p_ which your system will accept, very quickly.

The algorithm to do this is:

  • Let p_first_half be the first n/2 characters of e (where / indicates integer division, rounded down).
  • Let p_ be p_first_half with n - n/2 zero-bytes appended.

If you run p_ through your "encryption" algorithm, the result will be e, so your system will accept my fake password.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.