Brute Force Search Space is the set of candidates that can be tested successively when searching for a secret value. The target may be a generator input, password or private key; these spaces differ. A time calculation needs a distribution model, a verification rule and measured speed for the specific operation.
Guessing the password of an encrypted backup differs from searching for a private key or the input of a weak generator. Each candidate needs a concrete correctness check. The nominal number of all possible keys does not describe an attack when generation used a much smaller input set. [RFC 4086 — Secret distributions and guessing] [RFC 8018 — Salt, derivation cost and offline search]
For N equally probable candidates, one correct answer and testing without repetition, the mean is E = (N+1)/2 verified candidates. With 16 possibilities this is 8.5 attempts; at a constant 2 attempts per second it takes 4.25 seconds on average. This is a small teaching model, not a wallet-recovery measurement. [RFC 4086 — Secret distributions and guessing]
Human passwords and faulty generators can have strongly nonuniform distributions. An attacker can try likely candidates first, making the uniform-model average inapplicable. Min-entropy describes the best first guess; alone it determines neither average work for the full sequence nor a guaranteed time to success. [RFC 4086 — Secret distributions and guessing] [NIST SP 800-90B — Min-entropy and guessing cost]
PBKDF2 increases work per guess through repeated computation. Public salt separates derivations and limits reuse of precomputed tables; it is not secret additional entropy. A speed estimate needs the exact algorithm, parameters and hardware, not merely the resulting key’s length. [RFC 8018 — Salt, derivation cost and offline search]
BIP39 uses PBKDF2 with HMAC-SHA512 and 2048 iterations to obtain a 512-bit seed. Every passphrase produces a valid seed, so the word checksum does not confirm the correct passphrase. Authorized recovery needs known context to distinguish the intended wallet. Derived seed length is not the amount of secrecy in the input password. [BIP39 — Passphrase derivation and valid seeds]
SEC 2 specifies secp256k1 parameters; knowing a public key presents a discrete logarithm problem, not merely a list of every key. NIST SP 800-57 consequently distinguishes ECC size from classical security strength. An estimate based only on the count of 256-bit strings misses other mathematical routes. [SEC 2 v2 — secp256k1 parameters] [NIST SP 800-57 Part 1 Rev. 5 — Security strength and key protection]
More processors can share independent attempts, but actual speedup depends on the algorithm, memory and overhead. Mining hashrate cannot be substituted for PBKDF2 throughput or ECC operations. Limits on a login service do not themselves limit offline attempts against a copied encrypted backup. [RFC 8018 — Salt, derivation cost and offline search] [NIST SP 800-57 Part 1 Rev. 5 — Security strength and key protection]
A leaked seed, malware or an implementation fault may disclose a secret without exhausting the space. A large theoretical candidate count therefore does not guarantee whole-wallet security. Any timing claim must distinguish the assumed attack, available information and key protection; these models promise neither recovery nor a particular device’s resistance. [NIST SP 800-57 Part 1 Rev. 5 — Security strength and key protection]
For the clearest picture, read this entry together with Cryptographic Entropy, Entropy Bit, Private Key, Seed Phrase. The reverse links also lead from Entropy Bit, Random Number Generator.