Can you explain this passage from Wikipedia?
When a password (or passphrase) is used as an encryption key, well-designed cryptosystems first run it through a key derivation function which adds a salt and compresses or expands it to the key length desired, for example by compressing a long phrase into a 128-bit value suitable for use in a block cipher.
A longer password is more secure (in terms of bruteforce attack) than a short one, isn'it?
If the password is "pass", what's the resulting key?
Cryptographic keys are usually fixed-length values. Unfortunately, humans can't remember long strings of numbers, so we use passwords instead.
For example, this might be your 256-bit key:
d4f6d068b4e8c4e924ce9b28585a6009672e56d61215e7d9251b5d36283edd5d
Not too easy to remember, is it?
However, the above was generated by computing a cryptographic hash (in this case SHA256) of the word "waffles", which is much easier to remember. A hash function takes an arbitrary length input, and computes a fixed length output.
In reality, we need key-derivation functions (KDFs) to have special properties. One desirable property is that it should be computationally infeasible to compute m from h, where h = KDF(m), i.e. it's difficult to compute the input of the function if you only know the output. Another desirable property is that the function is computationally expensive (slow) enough to make computing millions of keys infeasible, without degrading performance for legitimate uses. As such, special KDF schemes such as PBKDF2 and bcrypt are usually used to compute these cryptographic keys from easily remembered passwords.
The only practical way to break a key generated by an ideal strong key-derivation function is to guess likely passwords. If your password is "password", it's likely to be broken. If you password is a string of 20 random letters and numbers, it's much less likely to be guessed.
To address the question you ask at the end:
If the password is "pass", what's the resulting key?
This isn't really a question that makes much sense. The result could be anything. There are lots of different hash functions (MD5, SHA1, SHA256, SHA512, Whirlpool, RIPEMD160, etc) and many different key-derivation functions (PBKDF2, bcrypt, scrypt), which can use salts or HMAC. The possibilities are endless!
KDF('hello') is almost exactly as fast as computing KDF('[email protected]$3.A0hello').
Commented
Aug 21, 2012 at 9:28
What the passage is saying is that the cryptosystem derive the key from a password.
For example, AES-256 uses a 256bit key. A (very) simple system might perform a SHA256 hash on your password as use the resulting 256bit output as the key for encryption.
All the usual caveats involving passwords apply - use bcrypt or pbkdf2 algorithms, use a salt etc. More information on proper password hashing can be found in the many questions already asked on the site. You might want to search the passwords or password-management tags.
A longer password is more secure (in terms of bruteforce attack) than a short one, isn't it?
Yes, a longer (and more random) password has more entropy and is thus more secure.
If the password is "pass", what's the resulting key?
This really depends on what hashing algorithm you are using.