openssl des3 -salt -k SUPER_SECURE_PASSPHRASE < inputFile > outputFile
Everything's working, but now I have to choose a final, fixed encryption passphrase. It doesn't need to be memorized, so obviously I'd choose some sort of randomly generated characters. However, how random is useful, and how long is useful? I'm concerned that I'll unknowingly be throwing away useful entropy.
AZQBB would be a poor passphrase, probably both because of length and limited character set. But, would
kecqnutaspyyhgheikfzuwkjaoitqooasujjfhhsiiwqoekihaeyhflpijfmnhssdyyy be poor due to its limited character set? Or, would
dU# i?|m:v be poor due to its length? It all matters how openssl uses the passphrase to generate the bits of the encryption keys, and I haven't found that documented anywhere.
As another example, if openssl just gets its 156 bits from the 8-bit ASCII representation of the first 21 characters of my passphrase, then if I restrict myself to non-control-character low-ASCII I'll be throwing away approximately 30 bits of entropy.
So, for a highly secure passphrase, my questions are:
- How long a passphrase do I need?
- How diverse a character set do I need?