Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Suppose I'm encrypting a file via AES using a password of my choice, or creating a TrueCrypt volume using a password and no keyfiles. Which of the following two passwords would be more secure:

nf890y9jqb

nf890y9jqb123456

The first one has a set of characters chosen at random, whereas the second one has the same characters but with an extra set of non-entropic characters added at the end. Does the extra length make it more secure, or the non-entropic part actually makes the file easier to decrypt, thus lowering security?

share|improve this question
    
How is suffix added - by user or by application? –  StupidOne Aug 6 '13 at 19:18

2 Answers 2

No, longer is not stronger.

What makes a password strong is its entropy: how much unknown the password is to the attacker. Adding a "non-entropic" suffix to the password does not add to the entropy (by definition) so it does not increase the hardness of the task for the attacker. It does increase the hardness for the normal user, though, since that means more keys to type in.

Adding a known suffix or prefix does not lower security either, except in the indirect effect of encouraging the user to choose a less entropic password to make his job easier. Unless the password processing makes something dumb, of course. For instance, suppose that passwords are truncated to their first eight characters (typical of old DES-based Unix crypt()) and that you add a fixed 6-letter prefix to your password, turning "o7843vD!" into "123456o7": in that case, the prefix makes the attack much easier.

share|improve this answer
    
Except WRT to brute-force non-dictionary attacks. Then longer is stronger, even if padded with As. –  tylerl Aug 7 '13 at 1:55
    
So is there anything that can calculate the entropy? For example, how can I know if a password like '=+*/-$' is stronger/weaker than 'thisismypassowrdIbetyoucantcrackit'? –  Lex Aug 7 '13 at 10:31
    
Entropy is a property of the password generation process, as the attacker knows it. You cannot calculate or even define the entropy of a password "alone". –  Thomas Pornin Aug 7 '13 at 11:07

Length does complicate brute force attacks; a longer password is stronger. High entropy passwords are stronger than low entropy passwords.

Even if the attack is based on rainbow tables, rainbow tables for short passwords are cheaper to calculate, store, and manage.

If the attacker is stealing the password from some other plaintext source, then the length and complexity are both meaningless; if the attacker is trying any form of a brute force attack, then the complexity of the attack is related to both entropy and length.

The relative value of an increment in complexity vs an increment in length would be interesting, but is probably related to specifics of the attack technique. For example, if you extend length by adding a digit to a password, (XXX vs XXX1), the increment is negligible, because most password crackers will automatically test every password with each digit appended, and the time to do 10 additional tests is imperceptible.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.