Re: Newbie question on encryption keys

On Tue, 10 Jul 2007 09:15:03 +0000 (UTC), Mark Shroyer wrote:

No, you shouldn't need to enter a 32-character password (although I
can't say for sure because you still haven't specified what software
you're talking about :) ). What usually happens is that the 256-bit
symmetric key is generated as some hash of whatever password you
provide. The longer and more random the password (until you get
past 32 random ASCII characters, anyway), the more entropy in your
256-bit AES key and therefore the more theoretically secure it is --
but in practice a dozen or so characters should be all the entropy
you need, depending on the quality of your software's hash algorithm
and how sensitive your data is.

Mark, nice job with the answers, noobs often get handed their asses
here.

Is it fair to say that if you used a passphrase such as:

6:Q?-jiF

Then repeated it to make a 16 character passphrase, under attack to
break, that you haven't gained much entropy or protection? My thinking
is that a powerful adversary would have a passphrase breaking program
that would constantly search for replication.
.

Relevant Pages

  • Re: Intruder in my wireless network? / intrusion detection programs
    ... Password/phrase strength is defined in terms of entropy, ... The advantage of a passphrase of random real words is that it's ... characters to achieve the same level of entropy as a password of random ... James Bond and the NSA ARE NOT trying to hack your network. ...
    (alt.internet.wireless)
  • Re: Intruder in my wireless network? / intrusion detection programs
    ... Password/phrase strength is defined in terms of entropy, ... The advantage of a passphrase of random real words is that it's ... characters to achieve the same level of entropy as a password of random ... "To provide adequate protection against the most serious threats... ...
    (alt.internet.wireless)
  • Re: Intruder in my wireless network? / intrusion detection programs
    ... Password/phrase strength is defined in terms of entropy, ... characters to achieve the same level of entropy as a password of random ... But if sufficient extra characters are used a passphrase of ... "To provide adequate protection against the most serious threats... ...
    (alt.internet.wireless)
  • Re: Hashing methods for giant keys
    ... >> How many unique output hash results can there be in the digest of SHA ... >characters that are written down which means you are anyway in trouble. ... I am using the passphrase to protect a key file. ... digits worth of entropy in them. ...
    (sci.crypt)
  • Re: Newbie question on encryption keys
    ... symmetric key is generated as some hash of whatever password you ... past 32 random ASCII characters, anyway), the more entropy in your ... Then repeated it to make a 16 character passphrase, ...
    (comp.security.misc)