On Mon, Oct 10, 2011 at 5:44 PM, Jerome Baum <jerome+per...@jeromebaum.com> wrote: > On 2011-10-10 23:29, Jan Janka wrote: >> >> How long would it take to execute a successful brute force attack on >> a pasphrase consisting of 12 symbols (symbols available on common >> keyboards)? > > Calculate how many combinations there are, assume some number of tries > per second (you can experimentally find this out), and there you go. > > But remember Murphy's(?) law! -- (I mean the one about doubling computer > power every 18 months -- are there two Murphy's laws? Confused now...) > > You can measure the strength of your password in bits of entropy, which > is basically the log base 2 of the number of combinations. So if there > are 64 possible combinations (a single alphanum case-sensitive > password-ish) then you have 6 bits of entropy. In the diceware FAQ at > www.diceware.com you can find info about how long a password with a > given number of bits is supposed to be secure. Also some tips on how to > pick a memorizable secure passphrase.
A very important distinction must be made between randomly-generated passwords and human-generated passwords. Based on a NIST study on password entropy[1], a 12 character password has only about 24 bits of entropy. Of course, if you're careful about your passphrase generation schemes, you can probably achieve higher than that while still generating your own password. If you value your OpenPGP key, I would not trust it to 24 bits of entropy. My off-card backup of my key is protected by a 32-character passphrase that I believe to be highly resistant to dictionary attack (and contains sufficient special characters that I believe its entropy to be close to the optimal 6.5 bits per symbol). But perhaps I'm delusional. [1] http://csrc.nist.gov/publications/nistpubs/800-63/SP800-63V1_0_2.pdf -- David Tomaschik, RHCE, LPIC-1 System Administrator/Open Source Advocate OpenPGP: 0x5DEA789B http://systemoverlord.com da...@systemoverlord.com _______________________________________________ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users
