Does repeating one word to form a password result in a similar pattern in its encrypted format?

Question

If i use a single word to form a password by repeating it like the examples below:

securesecuresecuresecuresecuresecure

SeCuReSeCuReSeCuReSeCuReSeCuReSeCuReSeCuRe

$eCuRe$eCuRe$eCuRe$eCuRe$eCuRe$eCuRe$eCuRe

Would a similar pattern (repeated symbols) appear in the encrypted format of the password (NTLM, MD5, etc)?

Answer 1

Here's a place you can try it out with a bunch of different algorithms: http://www.crypo.com/tools/index.php

But the answer is no you will not see any repeating pattern. You may see that with xor encryption but you will never see that with a strong encryption algorithm. Password padding and repetition can be very secure unless someone knows that is what you do. To counter that all you have to do is throw in one or two extra characters to break the pattern and make it strong.

For example: securesecuresecuresecure.securesecure.

Answer 2

Against a bruteforce attack the latter would be more secure, but the overall length of your password would already be hard to guess.

If someone however would know that you always repeat a regular word with a fixed amount of times, then a dictionary attack might be easier performed with the first example. (providing the person doesn't know about your signs)

With modern encryption techniques (1 way hashing and CBC) there isn't an easy way to notice repeated words.

Answer 3

If you are unlucky, then a repeated password can result in a repeated encrypted text, it depends on the encryption that was used.

I never heard of patterns in a hash algorithm, so if a website only stores the hash (what it should), then you propably won't get such repeating patterns.

Should a website store the encrypted password, it can happen that you will see repeating patterns, if the ECB mode was used. That's why one should not use ECB anymore, instead use CBC or another mode. Here you will find a better explanation about EBC and CBC with good examples.

Answer 4

Some encryption algorithms that work on blocks may use a method known as block chaining, whereby each previously encrypted block is XOR'd with the next consecutive block to prevent repeating patterns. If this or other methods aren't used then repeating patterns will be seen in the encrypted data as in algorithms that use an Electronic Code Book method.

Wikipedia - Block Cipher Modes

Hashing algorithms are generally very good at disguising repeating patters as they strive to achieve the avalanche effect, whereby the changing of one individual bit creates a massive change in the output so even with a repeating pattern the change would be massive.

Wikipedia - Avalanche effect

Answer 5

No, repeats in your password will not be visible in the password hash.

However, if you are thinking using this to strengthen your password: don't. It is not a good strategy. Repeating a secret word multiple times does not appreciably increase the strength of your password. Sadly, there are no shortcuts for password choice; your password needs to be long, strong, and unpredictable.

Answer 6

If what the password is subject to, was encryption, and if that encryption was poorly done, then patterns in clear data could be seen in the encrypted output. However, properly done encryption does not have this problem, and, more importantly, passwords are hashed, not encrypted. Encryption uses a key and has an output size which is roughly proportional to the size of the input; hashing uses no key, and has a fixed output size.

Of course, repeating a password in a long sequence does not make it stronger; it just makes it longer. Password strength comes from randomness, not from length. A long password has more room for randomness (so it can help fitting more of it), but if you repeat the same string, then you are not putting any randomness in it, so the extra length comes to naught. You just made the password frustratingly harder to type.

Using the word "secure" in a password does not make it secure either -- quite the contrary, indeed, because "secure" and "password" are among the most common words used in passwords by unwary users (who certainly styled themselves as "witty").