Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

The main reason why reusing a password for different accounts is not recommended is that if the password is compromised, all accounts are compromised.

This question is about vulnerabilities other than that.

For example you may want to generate two different PGP keys, one for signing, one for encryption, that you generated through separate processes but using the same very strong password.

If an adversary has both public keys and some messages encrypted with them, is he more likely to break your keys because of the fact they were both generated by a single password? If yes why? If yes, the more keys you generate with the same password the more vulnerable the keys?

The example was PGP, but the question generalizes to any other situation where the same password is reused, in separate instances - to generate either keys, or encrypted volumes or encrypted files - that are made public.

My guess is that the repetition of a password could generate some kind of observable regularity in the keys or files. Nevertheless there's always the moment of randomly moving the mouse to generate what you want, and if files and keys get generated by different instances of random mouse movements ain't that what counts? I ain't sure.

share|improve this question
    
The question is legitimate, clear and not repeated. Why the downvote? –  Strapakowsky May 31 '13 at 8:08

2 Answers 2

up vote 1 down vote accepted

If you used good encryption, repeating the same password won`t make difference.

for asymetric schemes

You generate a key pair: public and private. Its generation is based in many elements, and your password isn`t included among them.

Then your private key is there, unprotected, so anyone who could have access to your computer could get it and all the secrecy is gone. So it`s good to protect it: then your password is used, to encrypt it. In general, the private key is like a bunch of random bytes, and no attack is possible by knowing that two private keys were protected using the same password.

for symetric schemes

In good encryption algorithms, so many actions are used over your password that even knowing two documents, generated with the same password, and knowing what the original document would look like, won`t be of much help to the attacker.

share|improve this answer

The password (passphrase) you mention is used to symmetrically encrypt your private asymmetric key. You use the private key (not your password) to decrypt/sign your messages, this process is not affected by your password.

In case that the attacker obtains all your encrypted private keys she won't have much chance either, even if you used the same password in many cases, modern ciphers are designed to prevent that and much stronger attacks:

https://en.wikipedia.org/wiki/Attack_model

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.