PW length = 128-bits?

[Gomar]

At what point does a key reach the size where it becomes infeasible to crack encryption directly? Entropy of 85-bits is currently not breakable, but that's how many characters if all 95 keyboard characters are used?
Is 8-12 enough?
Is it better to use a passphrase of 4 words (20 letters), or 10 mixed with #'s and symbols?

if the pw length is 10, using full ASCII,
speed: 100,000,000,000/sec
Brute Force Attack will take up to 21 years.

is this pw:
tobeornottobethatisthequestion
Length: 30
Entropy: 110.2 bits
Charset Size: 26 characters

better than:

¥k7¢Z÷T§e®P<€4_Fœv
Length: 18
Entropy: 108 bits
Charset Size: 242 characters

r) U*c6{2 :1w$o!I-D7~vO
Length: 23
Entropy: 111.2 bits
Charset Size: 95 characters

 

[chiro]

At what point does a key reach the size where it becomes infeasible to crack encryption directly? Entropy of 85-bits is currently not breakable, but that's how many characters if all 95 keyboard characters are used?
Is 8-12 enough?
Is it better to use a passphrase of 4 words (20 letters), or 10 mixed with #'s and symbols?

if the pw length is 10, using full ASCII,
speed: 100,000,000,000/sec
Brute Force Attack will take up to 21 years.

is this pw:
tobeornottobethatisthequestion
Length: 30
Entropy: 110.2 bits
Charset Size: 26 characters

better than:

¥k7¢Z÷T§e®P<€4_Fœv
Length: 18
Entropy: 108 bits
Charset Size: 242 characters

r) U*c6{2 :1w$o!I-D7~vO
Length: 23
Entropy: 111.2 bits
Charset Size: 95 characters

Hey Gomar and welcome to the forums.

To answer this you need to look at the different schemes individually.

There is a lot of research that looks at a particular scheme to find 'weak' keys. These keys therefore are avoided by updated implementations.

Also again with reference to a particular scheme, using some techniques will allow you to use a lower bit count for keys. As an example elliptic curve cryptography does this: the computational complexity for an elliptic curve scheme is a lot higher than say an RSA scheme with the same number of bits for the key.

In terms of your two examples, this issue is an issue of password or key protocol. The reason this kind of thing is discouraged has more to do with the fact that it is easier to break by brute force methods over the second passphrase.

An encryption/decryption algorithm is pointless if people choose weak passphrases, or if they write their password down on a post-it note that is stuck to their monitor.

 

[Gomar]

the computational complexity for an elliptic curve scheme is a lot higher than say an RSA scheme with the same number of bits for the key.

In terms of your two examples, this issue is an issue of password or key protocol.

thanks for the clear explanation.
Thus, I am still confused if you are saying a long (20) passphrase is better than 10 random characters.

 

[DaleSwanson]

thanks for the clear explanation.
Thus, I am still confused if you are saying a long (20) passphrase is better than 10 random characters.

It is difficult, if not impossible, to give any definitive answer. It will largely depend on the methods your attacker applies. Are you trying to protect against someone guessing or brute forcing your password through a web interface? That's a lot different than if you are worried about someone using rainbow tables to crack your password using a cluster of GPUs 10 years from now. This raises a good question, how long does your data need to remain secure? If we are talking about passwords to a website then the answer is not very long, since they can be changed. On the other hand, an encrypted file will need to be secure for as long as the secrets are valuable. In that case you shouldn't just protect against today's attackers; you should protect against the attackers in a decade or two.

Check out what rainbow tables are already available:
http://www.freerainbowtables.com/en/tables2/ [Broken]

Any password covered by those is already vulnerable to a dedicated attacker with local access to your data. Storage will only continue to get cheaper, making larger tables practical.

Passphrases are much less common today, so there is security simply in the fact that your attacker probably won't target them. However if he somehow knows you are using a passphrase then that extra security disappears.

It also depends on the specifics of how you construct your passphrase. You absolutely should not use any phrase from a book, movie, or song. Anything that that might be found on the internet is a bad idea. There are collections of any phrases found on the internet.
http://www.commoncrawl.org/

Instead you should construct a seminonsensical sentence yourself. Use proper punctuation, and use some digits in there. Make sure you use at least one word not a http://en.wiktionary.org/wiki/Wiktionary:Frequency_lists/TV/2006/1-1000" [Broken]. Try to use some proper names and local places.

In your example, even if we ignore that it is a common phrase, all the words are very common. This means an attacker only has to try 500¹⁰ = 9.7 x 10²⁶ passwords. That is better than a 10 character random password at 95¹⁰ = 6 x 10¹⁹. A 23 character password is much better than a 10 word phrase though.

 

[Gomar]

A 23 character password is much better than a 10 word phrase though.

really? Seems 40-50 letter lower case character phrase is more secure than gibberish which is impossible to memorize.
today is tuesday, December6, 2011
is better than
Y3^*K5c:{2!S~O>3v

 

[Floid]

You are mixing to many ideas to get a clear answer.

For one, if you are talking true encryption (versus a pass phrase like access for a website), then what good does 40-50 letters do you? If you are using 128 bit encryption, then anything past 16 ascii characters is just wasted typing (each ascii character is represented by an 8 bit value). Even if you bump it up to 256 bit encryption, then anything past 32 characters is a waste.

And if you are talking encryption, you don't want to use an ascii based key because the ascii characters only take the range 0x20 to 0x7E which means there are some bits that would never be used which cuts down on the number of possible keys. Instead you would want to the key to be typed in as hexadecimal.


Now on the other hand if you are talking pass phrases like a password for websites then I would say in general gibbirish is better because someone trying to crack website passwords is more likely to be using a dictionary based attack than not.

 

[DaleSwanson]

If you are using 128 bit encryption, then anything past 16 ascii characters is just wasted typing (each ascii character is represented by an 8 bit value).

I have to disagree with this. In the most theoretical sense it could be true that 16 ascii characters would give 128 bits of entropy, however it relies on two unlikely conditions. First, that the user is using the full 256 character space (including hard to access characters > 128, and unprintable characters < 32). And second, that the user is generating random data. Neither of these conditions are likely to be even close to true. Any good encryption program (or website for that matter) will hash the user's entered password. This means entering additional password entropy will increase key strength until the user enters entropy equal to key length.

really? Seems 40-50 letter lower case character phrase is more secure than gibberish which is impossible to memorize.
today is tuesday, December6, 2011
is better than
Y3^*K5c:{2!S~O>3v

I shouldn't have used as ambiguous a word as better. In that context I meant better = higher entropy. I agree certainly that the phrase is a much better password from a useability standpoint.

The key to using phrases as passwords is to think of each word as a character in an alphabet that is very large (1000 - 10000). Use more words, use a few uncommon words, use a few non word characters, and you have a pretty good passphrase. An additional concern is if your phrase makes grammatical sense a new attack could arise from an attack that attempted to make grammatical sentences. This will decrease your entropy, but estimating the amount will be very difficult.

My personal password advice would be to take a few random words (from 3 up depending on security desired), ensure that at least 1 is not on common word lists. For added security you can combine your passphrase of memorable words with a random string. You can write the random string down and keep in your wallet. Most people protect their wallet pretty well, and even if someone had access to your wallet they wouldn't know the passphrase portion.
Example:
correct horse battery staple ZAPR2veLwP

You memorize the words, write down the random part, and then combine them as a passphrase. The random part is generated from here, and the phrase is from here. This is probably overkill for most things though. You have to weigh the actual loss if someone gains access to the data vs the useability of long passphrases.

One last word of caution. Many sites have truly awful security. Unfortunately, there isn't much you can do to verify security as a user. Some sites will limit passwords to something silly like 8 characters. But on top of that some may even simply discard the excess length without warning the user. This would mean that a nice long passphrase could be turned into a short dictionary word without the user even knowing it. I would hope that today, this isn't done anywhere, but I wouldn't count on it.

Microsoft windows had a somewhat similar flaw in its password hash that was still present in XP (but was well known and could be turned off).

 

[vladb]

is this pw:
tobeornottobethatisthequestion
Length: 30
Entropy: 110.2 bits
Charset Size: 26 characters

How exactly did you get 110.2 bits? The fact that you gave entropy for a piece of english text shows that you somewhat misunderstand entropy/information theory. In fact, no one knows exactly the entropy of english text (it doesn't even make much sense).

On the other hand, we can exactly calculate the entropy of a (truly) random ascii string (or, more correctly, of the source of this string), and thus the strength of the password.

This is why it is better to use random strings, not english text.

 

[Gomar]

and thus the strength of the password.

This is why it is better to use random strings, not english text.

Since I am using an English keyboard, I can't use anything but English text; can't use Japanese, nor Arabic.
Please define "random string", and provide an example.

 

[justsomeguy]

The key to using phrases as passwords is to think of each word as a character in an alphabet that is very large (1000 - 10000). Use more words, use a few uncommon words, use a few non word characters, and you have a pretty good passphrase. An additional concern is if your phrase makes grammatical sense a new attack could arise from an attack that attempted to make grammatical sentences. This will decrease your entropy, but estimating the amount will be very difficult.

I have another "key" to using a passphrase, and it's how I construct all my passwords when the sites allow me to; many simply will not allow long passwords, and have nonsensical and arbitrary limits on allowed characters. If you can come up with a reasonable passphrase that's easy to remember, you can take the first, or first and last (or ... etc ...) letters of each word and combine them, leaving the numbers intact as digits.

"My coffee maker holds ten cups and has seven buttons!" becomes "Mcmh10cah7b!"

Once you've passed from easily guessed words with simple numeric substitution and reversals, there's no middle ground for an attacker when it comes to guessing passwords -- they have to just start brute forcing from aaaaaaa.

As an aside, any website that won't allow me to enter my *own* secret questions and the answers to them gets gibberish for the answer of a randomly chosen secret question.

"What is your mothers middle name?" or "What city did you got to high school in?" are the types of things that just get a random keyboard pounding, because in no way are they secrets I can pretend only I know the answer to.

 

[MATLABdude]

XKCD has some insight on the matter:

http://xkcd.com/936/

I use a password manager with secondary hashing--the "password" is a hint to get me to remember the actual password, based on the scheme above.

 

[Gomar]

"What is your mothers middle name?" or "What city did you got to high school in?" are the types of things that just get a random keyboard pounding, because in no way are they secrets I can pretend only I know the answer to.

Right. However, in case you lose your pw and need to get in, do you memorize the gibberish? I too use gibberish, but it's saved in a text file which is encrypted; same as a password database.

 

[justsomeguy]

Right. However, in case you lose your pw and need to get in, do you memorize the gibberish? I too use gibberish, but it's saved in a text file which is encrypted; same as a password database.

No, I pick up the phone and prove my identity that way. It's not perfect, but it's better than the questions. I may adopt your method for some, but others (like my bank) I like to gently remind about the insecurity of this question feature, which I can also do during the call :)

 

[Gomar]

You can't call every web site, or Hotmail, gmail, ebay, paypal, Topix, flickr, twitter, google, facebook, etc. to prove who you are. All are free, so no billing or credit card info is taken.

I use fake DOB, address, no self-pics, all fake SNs, and I do input gibberish in those
security questions. I save all PWs into txt files, and password corral, which is themselves
encrypted. I keep USB drives, CD-Rs in safe deposit box.

 

[justsomeguy]

I will probably start keeping track of the gibberish as you pointed out. I mainly wanted to draw attention to the fact that honestly answering those questions will likely make your accounts less secure -- not more -- to anyone else following the thread.

I might not be able to guess your 64 character passphrase by going through your trash, but if I can answer all your "security questions", it doesn't matter.

 

[vladb]

Since I am using an English keyboard, I can't use anything but English text; can't use Japanese, nor Arabic.
Please define "random string", and provide an example.

Wow, you brought this up after a year? Interesting :)

But anyway, the definition of 'random string' I used in my claim is just a random variable that is represented as a string, where each character is chosen independently and uniformly at random. Its entropy is just the entropy of this random variable.

It also doesn't matter what languages you can type, since as long as you have at least 2 characters available you can encode anything.