Does adding a non-entropic part to a password makes it less secure?

Question

Suppose I'm encrypting a file via AES using a password of my choice, or creating a TrueCrypt volume using a password and no keyfiles. Which of the following two passwords would be more secure:

nf890y9jqb

nf890y9jqb123456

The first one has a set of characters chosen at random, whereas the second one has the same characters but with an extra set of non-entropic characters added at the end. Does the extra length make it more secure, or the non-entropic part actually makes the file easier to decrypt, thus lowering security?

Answer 1

No, longer is not stronger.

What makes a password strong is its entropy: how much unknown the password is to the attacker. Adding a "non-entropic" suffix to the password does not add to the entropy (by definition) so it does not increase the hardness of the task for the attacker. It does increase the hardness for the normal user, though, since that means more keys to type in.

Adding a known suffix or prefix does not lower security either, except in the indirect effect of encouraging the user to choose a less entropic password to make his job easier. Unless the password processing makes something dumb, of course. For instance, suppose that passwords are truncated to their first eight characters (typical of old DES-based Unix crypt()) and that you add a fixed 6-letter prefix to your password, turning "o7843vD!" into "123456o7": in that case, the prefix makes the attack much easier.

Answer 2

Length does complicate brute force attacks; a longer password is stronger. High entropy passwords are stronger than low entropy passwords.

Even if the attack is based on rainbow tables, rainbow tables for short passwords are cheaper to calculate, store, and manage.

If the attacker is stealing the password from some other plaintext source, then the length and complexity are both meaningless; if the attacker is trying any form of a brute force attack, then the complexity of the attack is related to both entropy and length.

The relative value of an increment in complexity vs an increment in length would be interesting, but is probably related to specifics of the attack technique. For example, if you extend length by adding a digit to a password, (XXX vs XXX1), the increment is negligible, because most password crackers will automatically test every password with each digit appended, and the time to do 10 additional tests is imperceptible.