On 28.06.2012 12:28, Heinz Diehl wrote: > On 28.06.2012, Milan Broz wrote: > > > Passphrase is interactively entered string > > (from real terminal, not stdint), keyfile is everything else. > > So the length of a keyfile is equivalent to the length of a > passphrase, or is there any difference which should let me choose a > bigger keyfile than one containing 64 chars for "maximum security", > assumed I'm using 512 bit encryption? If you shoot for maximum security that means you need at last 512 bit of ENTROPHY not characters (per se). As there are "values/bits missing" (at least the "\n") a 64 char key can't have the full 512 bit entrophy. But when using e.g. base64 encoding you can pack the full 512 bits of entrophy into 85.33 chars. Personally i round that up to 528 bit, to get an even 88 chars. For base64 encoding the length should be divisible by 3, otherwise you still get 88 chars (in this case) but the rest is filled with one or two "=" (Which you could also strip, it's no like you you need to be able to decode the string.) head -c 66 /dev/random | openssl base64 -A which gets you 88 chars. or head -c 64 /dev/random | openssl base64 -A | tr -d = which gets you 86 chars. Case one has 528 bits of entropy. Case two has 512 bits of entrophy + 4 "empty" bits. Bis denn -- Real Programmers consider "what you see is what you get" to be just as bad a concept in Text Editors as it is in women. No, the Real Programmer wants a "you asked for it, you got it" text editor -- complicated, cryptic, powerful, unforgiving, dangerous. _______________________________________________ dm-crypt mailing list dm-crypt@xxxxxxxx http://www.saout.de/mailman/listinfo/dm-crypt
