Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

If i use a single word to form a password by repeating it like the examples below:

securesecuresecuresecuresecuresecure

SeCuReSeCuReSeCuReSeCuReSeCuReSeCuReSeCuRe

$eCuRe$eCuRe$eCuRe$eCuRe$eCuRe$eCuRe$eCuRe

Would a similar pattern (repeated symbols) appear in the encrypted format of the password (NTLM, MD5, etc)?

share|improve this question

6 Answers 6

up vote 4 down vote accepted

Here's a place you can try it out with a bunch of different algorithms: http://www.crypo.com/tools/index.php

But the answer is no you will not see any repeating pattern. You may see that with xor encryption but you will never see that with a strong encryption algorithm. Password padding and repetition can be very secure unless someone knows that is what you do. To counter that all you have to do is throw in one or two extra characters to break the pattern and make it strong.

For example: securesecuresecuresecure.securesecure.

share|improve this answer
1  
wonderful site, thanks alot –  rezx Apr 10 '12 at 8:37

Against a bruteforce attack the latter would be more secure, but the overall length of your password would already be hard to guess.

If someone however would know that you always repeat a regular word with a fixed amount of times, then a dictionary attack might be easier performed with the first example. (providing the person doesn't know about your signs)

With modern encryption techniques (1 way hashing and CBC) there isn't an easy way to notice repeated words.

share|improve this answer
    
so if i use one word and repeated there is no such a thing mean Repeated encrypted symbol even if i use just one letter like ' aaaaaaaaaaaaaaa ' ? –  rezx Apr 9 '12 at 11:46
1  
not in modern encryption algorithms if I'm not mistaking. –  Lucas Kauffman Apr 9 '12 at 12:52
    
so password padding is really secure > exmp. password%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% –  rezx Apr 9 '12 at 12:57
2  
@rezx It should be noted that many password-based authentication systems do not allow characters to be repeated more than twice consecutively. –  Iszi Apr 9 '12 at 13:55
3  
@rezx - Because the strength of the password does not increase if you repeat characters. The length is only important in the context the password must be strong enough not to be a trivial calculation to brute force. –  Ramhound Apr 9 '12 at 17:37

If you are unlucky, then a repeated password can result in a repeated encrypted text, it depends on the encryption that was used.

I never heard of patterns in a hash algorithm, so if a website only stores the hash (what it should), then you propably won't get such repeating patterns.

Should a website store the encrypted password, it can happen that you will see repeating patterns, if the ECB mode was used. That's why one should not use ECB anymore, instead use CBC or another mode. Here you will find a better explanation about EBC and CBC with good examples.

share|improve this answer
    
will take alook at it, thanks –  rezx Apr 10 '12 at 9:49
1  
a cryptographic hash can't have repeats. –  ewanm89 Apr 10 '12 at 10:49
    
@ewanm89 - Yes, that's what i assumed and wrote in the answer, but since i cannot prove that no such algorithm exists, i formulated it cautiously. –  martinstoeckli Apr 11 '12 at 22:15
    
that's why I stated "cryptographic hash" specifically :P –  ewanm89 Apr 12 '12 at 12:58

No, repeats in your password will not be visible in the password hash.

However, if you are thinking using this to strengthen your password: don't. It is not a good strategy. Repeating a secret word multiple times does not appreciably increase the strength of your password. Sadly, there are no shortcuts for password choice; your password needs to be long, strong, and unpredictable.

share|improve this answer
    
why not increase the strength of my password, it will be long and hard to predict, and contain all 96 characters. exp: !2Qw!2Qw!2Qw!2Qw!2Qw!2Qw ( numbers, symbols, capital and small letters) –  rezx Apr 11 '12 at 8:01
1  
@rezx, as I already wrote, this does not appreciably increase the strength of your password -- like it or not. That's because it does not make it that much harder to predict. –  D.W. Apr 11 '12 at 8:25
    
ok, lets forget about 'predict' for now cuz when u try to break a file u cant know how i choose my password, so about strength it hve all what it need to make strong password, length, numbers, symbols, capital and small letters –  rezx Apr 11 '12 at 9:19
3  
@rezx, I find this conversation puzzling. You seem certain that repeating a string many times will increase the strength of your password. If you're sure you already know the answer, why are you asking here? I'm telling you that your assumptions are wrong, and that repeating a string many times does not significantly increase the strength of your password. It is up to you whether you want to listen or not. P.S. I suggest reading about "security through obscurity". –  D.W. Apr 11 '12 at 9:27
    
sure 'll read about it, thanks –  rezx Apr 11 '12 at 11:09

Some encryption algorithms that work on blocks may use a method known as block chaining, whereby each previously encrypted block is XOR'd with the next consecutive block to prevent repeating patterns. If this or other methods aren't used then repeating patterns will be seen in the encrypted data as in algorithms that use an Electronic Code Book method.

Wikipedia - Block Cipher Modes

Hashing algorithms are generally very good at disguising repeating patters as they strive to achieve the avalanche effect, whereby the changing of one individual bit creates a massive change in the output so even with a repeating pattern the change would be massive.

Wikipedia - Avalanche effect

share|improve this answer

If what the password is subject to, was encryption, and if that encryption was poorly done, then patterns in clear data could be seen in the encrypted output. However, properly done encryption does not have this problem, and, more importantly, passwords are hashed, not encrypted. Encryption uses a key and has an output size which is roughly proportional to the size of the input; hashing uses no key, and has a fixed output size.

Of course, repeating a password in a long sequence does not make it stronger; it just makes it longer. Password strength comes from randomness, not from length. A long password has more room for randomness (so it can help fitting more of it), but if you repeat the same string, then you are not putting any randomness in it, so the extra length comes to naught. You just made the password frustratingly harder to type.

Using the word "secure" in a password does not make it secure either -- quite the contrary, indeed, because "secure" and "password" are among the most common words used in passwords by unwary users (who certainly styled themselves as "witty").

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.