Numerical Evaluation of the Average Number of Successive Guesses

This work has been inspired by problems addressed in the field of computer security, where the attacking of, e.g., password systems is an important issue. In [2] Lundin et al. discuss measures related to the number of guesses or attemts a supposed attacker needs for revealing information. Similar problems are considered in [1], [3] and [4]. In this presentation numerical approaches are discussed for evaluating the average number of successive guesses required for correctly guessing the value of a string of independent and identically-distributed random variables. The guessing strategy used is guessing strings in decreasing order of probability [1]. The main conclusion is that it is possible to calculate the average number of successive guesses with moderate requirements concerning both memory and CPU time. The exact evaluation demands high storage and CPU time requirements. If n is the size of the alphabet and m is the size of the word the requirements are of O(n) and O(n), respectively, for storage and CPU time. In a first approximation (using quantification) the high storage demand was removed (to O(m)), but the high CPU time demands remained (of O(mn)). In a second approximation (using random selection) and a third approximation (using a normal distribution) also the high CPU time demands were removed and reduced to O(m) for both approximations. However, for all probability distributions the normal distribution is not an accurate approximation. Considering realistic sizes of alphabets (50) and word lengths (50) both approximations are able to give an estimate of the average number of successive guesses within minutes.