Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
It's my understanding that using "normal" passwords, such as an easy to remember sentence, is bad practice. Is that because such a string will not be random enough, or something else?
From Ruby's OpenSSL documenation
There are a lot of ways to create insecure keys, the most notable is to simply take a password as the key without processing the password further.
A distinction needs to be made between the password you provide an encryption tool and the internal key it actually uses.
There is nothing inherently wrong in using a plain-text password providing it is long enough to be unguessable within a reasonable electronic timeframe. The level of unguessability is generally considered the level of entropy in the data set; although even very sophisticated statistical tests can only make educated guesses about actual unguessability (e.g. A truly random string is entirely guessable if everyone in the world has memorised it).
Most encryption algorithms require a fixed amount of internal entropy to work. Your password will contain a certain amount of entropy, usually less than the cipher uses. So your password is usually converted into its pure entropic bits which are then "stretched" across the internal key space in a manner appropriate to the cipher.
The stretching (or shrinking) is also required to ensure that semantic similarity across, say, natural language passwords, does not deform the possible range of cipher-text output. You do not want natural languages passwords (i.e. most passwords) to only produce cipher-text of predictable fraction of all possible outputs; as you could then infer type and even the length of password used.
As an end-user of any competent encryption tool you do not need to worry about this as it occurs behind the scenes. But you will need to know if directly using these libraries.
