When using BitLocker To Go, given that removable drives are inherently offline and may have to resist such attacks, what are the best practices / recommendations for password strength?
Add a comment
|
1 Answer
In this case, the password takes the role of a symmetric encryption key. So you can use the recommendations for symmetric keys given by various trusted institutions.
For example, if you want to have a password of 128 bits of security, you can generate one of at least 22 alphanumeric characters (a-z, A-Z, 0-9). You can use a password manager for this, to ensure you do not introduce some bias in the generation process. (For the math: 128/log2(26×2+10) = 21.5)
answered Feb 25, 2019 at 17:16
-
When wanting confidence that a potential password / key is sufficiently strong, will a standard password strength / entropy calculator suffice or will a calculator specifically for symmetric keys be needed? Commented Feb 26, 2019 at 9:41
-
The entropy of a password once generated is 0 (look up the definition of entropy, log(1)=0). What you can measure is the method to generate passwords. You can also estimate the resistance to guessing attacks, but this is unreliable, and unnecessary if you know how the password was generated. Commented Feb 26, 2019 at 10:22