John Kennedy wrote:
>
<snip>
> To get back to the main point, the cipher-encrypted data isn't any more
> or less secure if you look at the cipher aspect alone. It is the key
> that is important, and the difficulty perceived in brute-forcing it.
>
Ahh, this I understand. And you are right (assuming for the moment that
the cipher does not have any attacks that are faster than brute-force).
Another well-know quote: "All security rests in the key" (this should be
true of a cipher algorithm and you consider such an algorithm broken, if
that is not so).
<snip>
> > Yes, is does not help, but it is still moot. That is because you can be
> > in the following two cases:
> >
> > a.) Your encrypted second key is accessible by the attacker.
> > b.) It is not.
>
> Yup. And if it isn't, it is perceived as being a lot more difficult.
> I could lie and say that my password as 100 characters long and it is
> suddenly more secure (if you believe me). You can't just look at the
> key and know how much entropy went into it (as far as I know).
>
Yes, that is also right. Yet, the smart attacker would probably try the
'easy' keys first (e.g.
ripemd('A'),ripemd('B'),...,ripemd('Z'),Ripemd('AA'),...)
<snip>
> > Bottomline: Choose a passphrase that has at least 64 bits of entropy and
> > you should be as secure as you need to be.
>
> Presumably a good rule of thumb.
>
Cryptography is also about making it 'hard enough'. E.g., you don't need
to protect against the computing power of the NSA (which you probably
cannot, because they have more mathematicians than the whole public
cryptographic scientific society) if you just want to hide your diary
from your familiy.
Marc
--
Marc Mutz <Marc@xxxxxxxx> http://EncryptionHOWTO.sourceforge.net/
University of Bielefeld, Dep. of Mathematics / Dep. of Physics
PGP-keyID's: 0xd46ce9ab (RSA), 0x7ae55b9e (DSS/DH)
Linux-crypto: cryptography in and on the Linux system
Archive: http://mail.nl.linux.org/linux-crypto/
