[Cryptography] Recommendations for short AES passphrases

[Tom Mitchell]

On Fri, Sep 16, 2016 at 8:42 AM, ıuoʎ <yonjah at gmail.com
<javascript:_e(%7B%7D,'cvml','yonjah at gmail.com');>> wrote:

> Though I've been following this list for a while my understanding of
> cryptography is very basic.
> So forgive me if I hope I haven't mixed any terms or got anything horrobly
> wrong.
>
> I recently came by a service that uses dangerously short passphrases for
> AES.
> The current implementation using a 6 chars from BASE 36 encoded string.
> The KDF is just one round of salted md5 (as defaults by openssl).
>
> I think the main reason for selecting short passwords was that they could
> be easily shared/written and that might be a requirement of the software.
> ......
>
Any comments or helpful suggestions would be appreciated
>
>
Much depends on the network and physical security of your systems.
A short pass phrase that unlocks a longer key makes sense if and only if
the saved private key file is difficult to get too.
If the private but locked key is stolen the attacker then has time and
privacy
to unlock it.

With all important keys you must be able to remember them
or that which is locked is lost.

Perhaps, If your only incoming and outgoing connection is ssh to a terminal
shell on another machine  then a shortish pass phrase makes some sense.

A phrase of common words confused with some easy to apply random additions
might prove durable enough for personal use.

A company like Google might guide their staff to write long keys down
and lock them in a physical vault bolted to the floor.  Other key management
methods may apply.

So as others noted"   What threat are you defending against?"
The good news is the short key can be improved and changed.
Short keys are a defense against the forgetful.


-- 
  T o m    M i t c h e l l


-- 
I be mobile, excuse my tipping!
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.metzdowd.com/pipermail/cryptography/attachments/20160917/d59ff96e/attachment.html>