# If the encryption algorithm broken or analysed, can an attacker find my password?

If the encryption algorithm broken or analysed, can the attacker know what my password was?

• The question seems very vague. What is the exact scenario? Apr 12, 2012 at 18:36

One of the rules upon which cryptography is based is that everything must be supposed known to the attacker. The only thing that is secret is the key. Some famous algorithms which follow this principle are DES, AES and RSA. So an attacker can't find your password only by studying the encryption algorithm.

• does the password encrypted with the same algorithm or with anther one.?
– rezx
Apr 7, 2012 at 11:06
• @rezx are you talking about a specific algorithm? Apr 7, 2012 at 11:12
• sure AES if someone analyze it will he know what is my password, and is that possible to analyze algorithm and become useless.?
– rezx
Apr 7, 2012 at 11:27
• @rezx It's not possible to find out the key, knowing how AES works, in a short amount of time. Of course, having a theoretically infinite amount of time, one can always crack an algorithm by a brute-force attack. But the fact is that doing so is usually a problem computationally speaking: in order to crack AES (especially with 192- and 256-bit keys) you need an enormous amount of time. Thus, finding out the key becomes practically unfeasible. Apr 7, 2012 at 11:44
• i know that if i use the full key 64 for the password ( letter,number...) it will be 96^64 = 7334304125596190624668832643061791071911921761558623296040973972480495126634460976537700765146565217101386328744001668808441856 possibility. and even the fastest computer on the planet cant dont it in a year, but there is other ways than brute-force, right
– rezx
Apr 7, 2012 at 11:50

There is a principle in security called the Kerckhoff's Principle, which most modern things in security follow, including cryptographic algorithms. Essentially it means that systems should not rely on secret algorithms, but rather secret keys. One of the big reasons for this is that keys are really easy to change if compromised, but this is not so with algorithms. In general, "security through obscurity" is frowned upon in security, and certainly major crypto systems don't derive their security from obscurity of the algorithm.

but there is other ways than brute-force, right

The only weakness to AES is a brute force attack. There are no other ways to compromise it at this time. Please understand AES can still be weak if they key is not long enough.

256 and 512 are the suggest key lengths. The only way to decrypt AES encrypted data is to know all the information.

If the encryption algorithm broken or analysed, can the attacker know what my password was?

If an algorithm is broken, then it should not be used, because its well broken.

The AES algorithm has been analysed, it has been determined by people smart then you and most people even on this website, that its also secure.

An algorithm must be secure, it has to be determined that its strong enough, not to fall apart because some simple trivial error like WPA for instance.