>>105817401
This is your issue? It explicitly assumes a dictionary attack, the strength of the password comes from there being >2^40 passwords you can make with 4 random common words