[pilif]

there's a difference between brute-forcing all possible key combinations and brute-forcing various passwords on a (huge) wordlist.

Brute-forcing all keys will have you check 730750818665451459101842416358141509827966271488 possible keys in average.

Using a dictionary will have you check however many words are in your list.

If course the first method will give you a 100% chance of eventually finding the key, but it will take a very long time.

Brute-forcing the dictionary will take a very short time, but you won't have a 100% chance of finding the key (if it's not on the list).

Now, there might be some mathematical problems in the SHA algorithm that lowers that astronomical number of tries you have to do for a real brute-force attack, but there are none currently known and even with all the parallel GPU power, checking all those keys would take years. Not minutes.