Re: Safe password?

> I use an encryption program that uses AES-256 as its encryption
> algorithm but only allows passwords with a maximum length of 16
> characters. Is it possible to create a safe password with only 16
> characters for this encryption type?

Hi, IMHO it's quite hard that an user would remember easily a 16
character password randomly generated, also if from a reduced character
set.
On the other side, it's quite probable that if it's the user that is
requested to chose the password, he/she will chose a trivially
guessable one.
The keyspace, expecially in the second case, would be far from the one
of AES-256 and the system could be brute forced with an effort very
lower than bruteforcing an AES 256 implementation that uses the wole
keyspace, however this fact alone is not a mandatory reason to "reduce"
the encryption to an AES-128.
I would rather enforce the application's capability to exploit the AES
256 keyspace, in example AFAIK you have two ways:
- you may let the user enter long sentences and hash it (with a
collision resistent hash) to a random key of the length you desire;
- you may use a two factor authentication "something you have plus
something you know" generating a random keyfile, that the user will
have to manage in a secure way, plus a traditional password
authentication, that the user have to remeber (and here you can
implement the same suggestion of the first point of letting the user
type a long passphrase and then hash it to the length you desire).

.

Relevant Pages

  • Re: Safe password?
    ... >> I use an encryption program that uses AES-256 as its encryption ... >> characters for this encryption type? ... >keyspace, however this fact alone is not a mandatory reason to "reduce" ... >collision resistent hash) to a random key of the length you desire; ...
    (sci.crypt)
  • RE: XP password and encryption
    ... Windows NT 4 (I can't remember if it was part of the SP2 upgrade to ... (effectively limited to 14 characters), ... a one-way (non-reversible encryption) of variable size. ... > We provide Ethical Hacking, Advanced Ethical Hacking, Intrusion ...
    (Security-Basics)
  • Re: encryption
    ... advantages over 64-bit encryption if one chooses a password which is 8 ... characters or less? ... One of my pass phrases has more than 15 characters, ... and kept in a Keychain-like system. ...
    (comp.sys.mac.system)
  • Re: Storing input into a character array
    ... char enc; ... slots in the array enc until enc is filled up. ... If you don't want newline characters in your array, ... encryption, it does correctly output the 4 characters of the first row ...
    (comp.lang.c)
  • Re: Vulnerability: known crypto algo + known MD5 value
    ... A hash algo like SHA-256 takes an any input and makes a unique (unique in theory ... and most of reality) fixed-length output. ... An encryption key takes an input and makes an output of varying length. ... Encrypting a SHA-256 hash (which is itself a string of characters) is ...
    (sci.crypt)