Encryption Question

[Robert M]

I’m trying to learn a little bit about file encryption software in general, so forgive me if my question is silly or ignorant. This isn’t really an AxCrypt specific question so I hope it’s OK to ask it here.

I know of at least two file encryption products that limit password length according to the key size of the encryption algorithm.

For example, AES-128 is limited to a 16 character password, while AES-256 is limited to a 32 character password. If an ASCII character is 8 bits, then 16 x 8 = 128 and 32 x 8 = 256. Are these products simply using the binary values of the characters in the password as the key? For example, the key for password abc might look something like like: 01100001 01100010 01100011 and then 00000000 until you hit 128 or 256 bits? That just seems wrong to me.

I hope this question makes sense. I like looong passwords and use a 44 character password with AxCrypt. I’m sure that’s overkill — but I like it! Those other products will not allow such a password.

[SvanteSpectator]

Hello Robert,

Your question makes eminent sense, and I’d refrain from using encryption products that limit password length to 16 characters for AES-128 etc. It shows a fundamental lack of understanding of the technology, and I’d suspect that such a product does not properly implement other encryption functions.

I can’t write a really long response, but properly implemented software a password based key derivation function of some kind. AxCrypt uses a standard function called PBKDF2 with SHA512.

The fact of the matter is that in practice a typed password does not use 8 bits/character (even if the characters is stored using 8 bits, there’s a bit of effective waste there since not all 256 positions typically represent printable/typable characters). ASCII which you refer to for example is a 7-bit code, stored in 8 bits most commonly, and even so not all 128 positions are used by printable characters.

A 44 character password, provided that is not a sentence or set of words but rather really is a long password with a good mix of characters is very good, and is likely to give you more than 128 bits of effective strength, but perhaps not as much as 256 (it depends on how the password is constructed).

To determine the effective strength of the password:

1. Assume the attacker knows the *principle* but not the detail of your password. I.e., assume the attacker is yourself, who knows everything about how you choose passwords – *except* the actual password.
2. Estimate the number of possible passwords by taking the number of possibilities for each position or group times each other. Call this hopefully very big number N.
3.  Calculate log N / log 2. This will give you the number of effective bits.

Example: I chose a password that is 8 characters long, with completely random characters upper and lower case a-z. Each position can have 26 + 26 possibilities = 52 per position. So, N = 26 * 26 * … * 26 (8 times), i.e. 26^8.

N = 53459728531456.

log(53459728531456) / log(2) = approximately 45.6, i.e. approximately 47 bits.

This is a very weak password…

 

[Robert M]

Thank you for that informative reply.

[Jacksonjames]

Hello, I think the relationship between the key size of an encryption algorithm and the password length can vary depending on the implementation and design choices made by the software developers. While some encryption software may limit the password length based on the key size, it is not necessarily a direct correlation or limitation imposed by the encryption algorithm itself.

 

geometry dash scratch

[dordle luka]

Hello, I’m so glad I found your blog, I’m here and can only say thank you for a wonderful post. Please continue to do well. If you have more time, please visit: fnaf security breach unblocked

[Author]

Posts