Questions tagged [passphrase]
A passphrase is a longer password that typically consists of multiple words.
134 questions
1
vote
1
answer
73
views
Auto-unlock private key: which implications?
On my system (Ubuntu 22.04) I have encrypted my private key with a passphrase and added it to the ssh agent with ssh-add.
On use of the key, I am prompted with the option "Automatically unlock ...
- 141
3
votes
3
answers
2k
views
How resiliant is a private key passphase to brute force attacks?
in the documentation of Ubuntu ssh keys, I was surprised to read
"If your RSA key has a strong passphrase, it might take your attacker a few hours to guess by brute force.".
Really? A good ...
- 141
1
vote
1
answer
212
views
Hide password from server
I’m a beginner in cryptography and for my first project I use the client’s password to encrypt some data. More specifically, I use the password as passphrase in RSA private key generation). However, I ...
- 15
0
votes
0
answers
20
views
Relation between plain text and encrypted in URL [duplicate]
There are several plain text and encrypted text like:
Plain text
Encrypted text
10101004535
7Za9kHM9OH6tKTrtxy86gw==
10860586924
/nwjXW3MYkcATRS5Xyjx/A==
10480090635
/F0D9ePZffTIiH/P8mK+kw==
...
1
vote
0
answers
120
views
Windows decrypting TC volume without passphrase?
I remember having read a blog post or a forum post, some years ago, about a TrueCrypt user whose Windows machine sometimes, at boot, did not ask for the TC passphrase and decrypted automatically the ...
- 5,218
0
votes
3
answers
217
views
How to analyze the security of a custom passphrase?
Let's assume person A chooses 15 words for a passphrase with an average length of 5. The passphrase meets following conditions.
Word conditions:
The first word is not a valid word and can't be found ...
- 56
1
vote
1
answer
163
views
ssh server encrypted key vs password login [duplicate]
In an openssh-server login to a GNU/Linux machine
to use a private ssh key encrypted with an N-characters passphrase, then sshd_config:
PasswordAuthentication no
PubkeyAuthentication yes
is it ...
- 121
2
votes
1
answer
323
views
Static RAM: Detecting presence and wiping?
As I understand from reading another question here, SRAM may be more dangerous than traditional volatile RAM in terms of storing passwords and other sensitive information.
I know that when a computer ...
- 39
0
votes
0
answers
340
views
GPG passphrase in the cache as a hash?
I understand that nowadays passwords are not stored in plaintext, only as password + salt and hashed (minimum). But I haven't found any exact confirmation that gpg does NOT store (cache, place in RAM) ...
- 725
29
votes
6
answers
7k
views
Is it insecure to display the number of characters when users enter a new passphrase?
When users are entering a new passphrase somewhere, it's helpful to provide feedback on the number of characters received by the system.
In a user experience (UX) test I just ran, my user created a ...
- 399
-2
votes
2
answers
2k
views
Why should we only keep the private key secret, why not the public key? [duplicate]
If I am not wrong, both private key and public key are the same since communication is possible only if both keys are matching. So, why we should only keep the private key secret, why not public key? ...
- 43
0
votes
1
answer
159
views
Does knowing part of a passphrase for sure really mean that you can "disregard" that entire part when trying to crack it?
Alice bought 1 Bitcoin and encrypted her wallet.dat in Bitcoin Core.
Samantha, Alice's friend, notices the Bitcoin price skyrocketing and, while Alice is in the bathroom, steals Alice's wallet.dat as ...
- 1
2
votes
1
answer
174
views
How can the passphrase matter besides the very most obvious patterns? [duplicate]
Let's say that my passphrase is:
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaapassword9
Yes, it looks ridiculous. But only because we already know it. An attacker, trying to brute-force their way into this ...
- 21
3
votes
2
answers
462
views
How secure is the getapassphrase.com approach to password generation?
getapassphrase.com is a website that generates passphrases. The user sets a complexity in bits, and the site spits out results like:
liberal panda and ill asp decline young suit in Kansas
or
rowdy ...
- 133
12
votes
3
answers
3k
views
Diceware as a passphrase for online accounts
I'm reading about Diceware and cryptography in general and I know how secure Diceware can be. I stumble upon this part on The Intercept about Diceware and it says:
"You don’t so much need them ...
- 121
8
votes
2
answers
370
views
Randomly selected words converted into sentence. Did I lose passphrase strength or gain it?
I got 5 dice and opened EFF's wordlist, and generated a random five-word passphrase (all letters small with spaces, no punctuation) for my PC.
The words were making up a meaningful scene in my mind, ...
- 275
0
votes
2
answers
689
views
openssl, recover passphrase with encrypted and not encrypted file
Some of my colleague give me 2 file of private key (one is encrypted and the other is decrypted) and a passphrase. But it seems that is the wrong passphrase.
Is it even possible to recover the pass ...
- 3
0
votes
1
answer
933
views
PGP encryption passphrase
We are using Symantec PGP encryption for AIX to encrypt/decrypt files. Keys are generated with passphrase and the passphrase are set by the business users. The IT admin is responsible to perform the ...
- 1
3
votes
2
answers
388
views
How strong is a password consisting of words arbitrarily chosen from the dictionary?
Diceware wants us to actually randomly pick n words from a given set of m=65 words.
Assume a user does not actually use a dice. Instead they take a physical dictionary of m words and "randomly" picks ...
- 6,585
4
votes
3
answers
464
views
Given Diceware, why does the requirement to contain uppercase, numerics & punctuation in passwords still stand?
Example strong diceware password:
widow stout harvey crest zomba zloty butyl
This password will be rejected by most sites, for example by Outlook.com. (Notable exceptions: Gmail, Stackoverflow, ...
- 6,585
0
votes
1
answer
177
views
Security of adding letter in front of passphrase [duplicate]
I am wondering about the security of adding a letter in front of a long passphrase to help me have different passphrases for each site I use while not requiring me to remember several different N word ...
- 3
3
votes
1
answer
582
views
PCI DSS minimum password strength equivalent in passphrase
The PCI DSS requirement 8.2.3 says:
Passwords/passphrases must meet the following:
Require a minimum length of at least seven characters.
Contain both numeric and alphabetic characters.
...
- 1,129
2
votes
3
answers
1k
views
What should a secure passphrase look like?
We all know that passwords should not only be randomly generated, but also look random. The reason is that attackers can use patterns or existing words to be able to bruteforce the passwords faster, ...
- 15.9k
3
votes
1
answer
486
views
Why are passphrases protecting GPG / SSH private keys needed? [duplicate]
SSH and GPG each ask for passphrases during key generation. GPG also (at least from my experience) displays warnings if one is not provided and asks for confirmation that no security is indeed ...
- 6,585
1
vote
1
answer
289
views
Partially forgotten encryption password for Windows users [duplicate]
I encrypted important files with Veracrypt and I remember most of the password but some parts are forgotten. I need some advice as to what would be the most efficient way of getting the encryption ...
- 41
3
votes
2
answers
5k
views
Partially forgotten encryption password
I encrypted important files with Veracrypt and I remember most of the password but some parts are forgotten. I need some advice as to what would be the most efficient way of getting the encryption ...
- 41
2
votes
0
answers
802
views
SSL Certificates and Private Key passhprases
I'm trying to put together a new PKI program for my company, and I'm a little turned around on the concept of Private Keys and passphrases.
We'd like to implement Microsoft Active Directory ...
- 21
1
vote
2
answers
6k
views
Details of a good WPA2 pre-shared key (password)?
From the following answer, I understand a strong pre-shared key must be 15 characters at minimum and randomly generated:
https://security.stackexchange.com/a/56646/37051
However, from other reading, ...
- 340
2
votes
1
answer
822
views
Does the length of each word of a passphrase matter?
Since they won't brute force a 19-char password,
I was wondering if the attacker's dictionary is simply sorted by frequency? could these passwords have roughly the same strength?
carp ably feud whir
...
- 33
3
votes
1
answer
187
views
gnupg keys and pass database - Protecting both from unauthorised access and loss
My target is to use pass to store a lot of passwords and be able to access those passwords from wherever I need them, possibly using just a single pass-thing (password, passphrase, my voice, my ...
- 183
4
votes
3
answers
392
views
Using a simple 5-character pass for event vs. QR/barcode
I plan on doing a "ticketing" system, where a user would buy a "tour ticket" online. The part that I'm puzzled about is: After they buy, what mechanism to use to verify the ticket?
I've been looking ...
- 141
2
votes
2
answers
2k
views
GPG secret key and passphrase
I generated a public/secret key pair with GnuPG. I know that the secret key must keep secret. However, I am wondering what are the risk to expose the secret key without the passphrase?
If Eve steals ...
user160373
0
votes
2
answers
6k
views
Generating multi-word passphrases from a wordlist [closed]
As part of pentesting NT hashes where the underlying passwords are minimum 16 characters of length, I have created a wordlist of common words, sports teams, movies, names, years etc. - inspired by the ...
- 33
5
votes
1
answer
17k
views
Checking if an RSA private key is passphrase protected
I have generated an RSA key-pair on a computer, and I want to check if the RSA private key is encrypted (protected) with a passphrase.
Note that the problem is not that I forgot the passphrase, but ...
- 955
5
votes
1
answer
427
views
Why does the EFFs unique-prefix-wordlist have so long words
A while ago, the EFF published new wordlists to be used with diceware, to create passphrases with “better” words.
One variant is the “short word list (with words that have unique three-character ...
- 153
2
votes
2
answers
401
views
Is passphrase strength increased with this strategy?
I have been reading a bit about passphrases strength and weaknesses. I will take this answer as example.
TTT says, among the other points:
Although there are hundreds of thousands of words in the ...
- 159
5
votes
1
answer
3k
views
Time to crack passphrase of 4 English word combinations at 7 terahashes/sec
This site suggests using 4 common English words as a password is no longer safe.
Apparently the top 5000 English words in any combination of 4 words can be hashed in 1.5 minutes at 7Thash/sec.
The ...
- 171
5
votes
1
answer
5k
views
gpg does not require passphrase to decrypt
Suddenly the behaviour of gpg has changed and my world crumbles.
I have several keys, all but one for testing purposes. The one is my personal key. Up to now I have been able to encrypt with this ...
- 51
1
vote
0
answers
316
views
Password protected secrets on Vault
We're currently improving our custom secrets management system and I'm looking into different solutions such as Hashicorp Vault or AWS KMS.
So far Vault seems to meet most of our current requirements,...
- 11
42
votes
2
answers
74k
views
ssh-keygen: What is the passphrase for?
When using ssh-keygen:
What is the passphrase for?
Why is it optional?
What are the security implications of specifying (or not specifying) one?
Below is an excerpt taken from a shell session
(...
- 1,809
3
votes
6
answers
908
views
Good way to protect lots of private keys
I'm working on a software which deals with lots (several millions) of RSA private keys. Keysize is 2048, I'm going to store them in database in PEM format.
I want keys to be encrypted to mitigate ...
- 131
15
votes
2
answers
12k
views
Passphrase vs. password entropy
For a while now I have been interested in the passphrase concept as a potentially more secure replacement for classical passwords. My interest stemmed from a gut feeling that passphrases would be of a ...
- 2,751
8
votes
4
answers
1k
views
multiple dice ware lists to make memorable passphrases?
I understand the basics of why diceware produces good security and why seven word passphrases are a good idea these days.
The EFF has helpfully produced updated diceware lists that eliminate lots of ...
- 83
0
votes
1
answer
1k
views
Does it make sense to store RSA private keys instead of password hashes?
I'd like to encrypt some private data by every user and I was wondering if I could use the same secret as passphrase for an RSA private key and as password for authentication. How secure is using an ...
- 489
2
votes
3
answers
1k
views
How secure is a password made up of three or four three-letter words?
According to this, a password such as dinwryran is secure against a brute-force attack. Is this true? If not, why?
- 21
5
votes
1
answer
299
views
"Just add a word or two" advice
When using a passphrase, and someone shows concern about it being cracked in a short number of years due to significant advances in technology or whatnot, often you'll hear the advice "Just add a word ...
- 325
3
votes
1
answer
356
views
Using a list of three-letter words with variable capitalization as a DiceWare dictionary
This is partly an exercise to see if I understand passphrase generation from a given dictionary using the DiceWare technique. But also for possible personal usage.
All three-letter word lists I can ...
- 325
3
votes
1
answer
498
views
How to determine how entropy changes when using uppercase, numbers and special characters in a dictionary based passphrase?
I know the general math behind using character-based and dictionary-based passwords/passphrases and how to determine the entropy of the result. But I am unclear how adding uppercase letters, numbers ...
- 325
1
vote
1
answer
2k
views
What does it mean when Reaver returns a PIN but no passphrase?
Usually when it's done, the WPA passphrase/password is listed immediately below the WPS PIN.
Any idea what it means when it's absent from the results?
I also tried entering the PIN directly, using ...
- 1,809
0
votes
1
answer
453
views
Some questions about protecting recovery seed for Trezor/Nano S
If someone stole recovery seed (24 words) but you would protect it with additional passphrase, is it likely they could brute force your passphrase?
How many guesses can there be made per second?
...
