Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [passphrase]

A passphrase is a longer password that typically consists of multiple words.

2
votes
1answer
61 views

Why are passphrases protecting GPG / SSH private keys needed?

SSH and GPG each ask for passphrases during key generation. GPG also (at least from my experience) displays warnings if one is not provided and asks for confirmation that no security is indeed ...
1
vote
1answer
76 views

Partially forgotten encryption password for Windows users [duplicate]

I encrypted important files with Veracrypt and I remember most of the password but some parts are forgotten. I need some advice as to what would be the most efficient way of getting the encryption ...
2
votes
1answer
108 views

Partially forgotten encryption password

I encrypted important files with Veracrypt and I remember most of the password but some parts are forgotten. I need some advice as to what would be the most efficient way of getting the encryption ...
1
vote
0answers
47 views

SSL Certificates and Private Key passhprases

I'm trying to put together a new PKI program for my company, and I'm a little turned around on the concept of Private Keys and passphrases. We'd like to implement Microsoft Active Directory ...
1
vote
2answers
408 views

Details of a good WPA2 pre-shared key (password)?

From the following answer, I understand a strong pre-shared key must be 15 characters at minimum and randomly generated: https://security.stackexchange.com/a/56646/37051 However, from other reading, ...
1
vote
1answer
130 views

Does the length of each word of a passphrase matter?

Since they won't brute force a 19-char password, I was wondering if the attacker's dictionary is simply sorted by frequency? could these passwords have roughly the same strength? carp ably feud whir ...
3
votes
1answer
68 views

gnupg keys and pass database - Protecting both from unauthorised access and loss

My target is to use pass to store a lot of passwords and be able to access those passwords from wherever I need them, possibly using just a single pass-thing (password, passphrase, my voice, my ...
4
votes
3answers
102 views

Using a simple 5-character pass for event vs. QR/barcode

I plan on doing a "ticketing" system, where a user would buy a "tour ticket" online. The part that I'm puzzled about is: After they buy, what mechanism to use to verify the ticket? I've been looking ...
1
vote
2answers
92 views

GPG secret key and passphrase

I generated a public/secret key pair with GnuPG. I know that the secret key must keep secret. However, I am wondering what are the risk to expose the secret key without the passphrase? If Eve steals ...
0
votes
2answers
87 views

Generating multi-word passphrases from a wordlist

As part of pentesting NT hashes where the underlying passwords are minimum 16 characters of length, I have created a wordlist of common words, sports teams, movies, names, years etc. - inspired by the ...
0
votes
1answer
217 views

Checking if an RSA private key is passphrase protected

I have generated an RSA key-pair on a computer, and I want to check if the RSA private key is encrypted (protected) with a passphrase. Note that the problem is not that I forgot the passphrase, but ...
5
votes
1answer
113 views

Why does the EFFs unique-prefix-wordlist have so long words

A while ago, the EFF published new wordlists to be used with diceware, to create passphrases with “better” words. One variant is the “short word list (with words that have unique three-character ...
2
votes
2answers
131 views

Is passphrase strength increased with this strategy?

I have been reading a bit about passphrases strength and weaknesses. I will take this answer as example. TTT says, among the other points: Although there are hundreds of thousands of words in the ...
3
votes
1answer
194 views

Time to crack passphrase of 4 English word combinations at 7 terahashes/sec

This site suggests using 4 common English words as a password is no longer safe. Apparently the top 5000 English words in any combination of 4 words can be hashed in 1.5 minutes at 7Thash/sec. The ...
3
votes
1answer
495 views

gpg does not require passphrase to decrypt

Suddenly the behaviour of gpg has changed and my world crumbles. I have several keys, all but one for testing purposes. The one is my personal key. Up to now I have been able to encrypt with this ...
1
vote
0answers
46 views

Password protected secrets on Vault

We're currently improving our custom secrets management system and I'm looking into different solutions such as Hashicorp Vault or AWS KMS. So far Vault seems to meet most of our current requirements,...
1
vote
1answer
674 views

ssh-keygen: What is the passphrase for?

When using ssh-keygen: What is the passphrase for? Why is it optional? What are the security implications of specifying (or not specifying) one? Below is an excerpt taken from a shell session (...
3
votes
6answers
297 views

Good way to protect lots of private keys

I'm working on a software which deals with lots (several millions) of RSA private keys. Keysize is 2048, I'm going to store them in database in PEM format. I want keys to be encrypted to mitigate ...
5
votes
1answer
3k views

Passphrase vs. password entropy

For a while now I have been interested in the passphrase concept as a potentially more secure replacement for classical passwords. My interest stemmed from a gut feeling that passphrases would be of a ...
6
votes
4answers
382 views

multiple dice ware lists to make memorable passphrases?

I understand the basics of why diceware produces good security and why seven word passphrases are a good idea these days. The EFF has helpfully produced updated diceware lists that eliminate lots of ...
0
votes
1answer
208 views

Does it make sense to store RSA private keys instead of password hashes?

I'd like to encrypt some private data by every user and I was wondering if I could use the same secret as passphrase for an RSA private key and as password for authentication. How secure is using an ...
2
votes
3answers
392 views

How secure is a password made up of three or four three-letter words?

According to this, a password such as dinwryran is secure against a brute-force attack. Is this true? If not, why?
0
votes
0answers
229 views

WPA2-PSK / EAP-PEAP MSCHAPv2: Do user-name, passphrase or SSID have any official restrictions?

I am testing a new WLAN client mode of a device. So that the device can handle preferably every possible case, I have to know which characters and lengths are generally allowed in the SSID, user-name ...
5
votes
1answer
222 views

“Just add a word or two” advice

When using a passphrase, and someone shows concern about it being cracked in a short number of years due to significant advances in technology or whatnot, often you'll hear the advice "Just add a word ...
4
votes
1answer
116 views

Using a list of three-letter words with variable capitalization as a DiceWare dictionary

This is partly an exercise to see if I understand passphrase generation from a given dictionary using the DiceWare technique. But also for possible personal usage. All three-letter word lists I can ...
2
votes
1answer
108 views

How to determine how entropy changes when using uppercase, numbers and special characters in a dictionary based passphrase?

I know the general math behind using character-based and dictionary-based passwords/passphrases and how to determine the entropy of the result. But I am unclear how adding uppercase letters, numbers ...
1
vote
1answer
758 views

What does it mean when Reaver returns a PIN but no passphrase?

Usually when it's done, the WPA passphrase/password is listed immediately below the WPS PIN. Any idea what it means when it's absent from the results? I also tried entering the PIN directly, using ...
0
votes
1answer
272 views

Some questions about protecting recovery seed for Trezor/Nano S

If someone stole recovery seed (24 words) but you would protect it with additional passphrase, is it likely they could brute force your passphrase? How many guesses can there be made per second? ...
24
votes
7answers
6k views

Song Lyrics as passphrases [duplicate]

I have a question slightly similar to this question. I am familiar with the correct horse battery staple example from xkcd, yet I am leaning towards songlyrics as a passphrase, since I have a brain ...
2
votes
1answer
817 views

Forgot OpenPGP key's passphrase, can I recover key or files somehow?

I had two OpenPGP key files on two separate TAILS OS USB flash drives, but the most recent one fails to boot up. Then I discovered that I don't remember the old keys passphrase on the first USB flash ...
1
vote
2answers
224 views

Value of using passphrase on private key

I am implementing HTTPS with Nginx and I generated private key with passphrase. Now I wonder what is the practice in production environment, using unprotected keys or protected with ssl_password_file ...
0
votes
0answers
69 views

Is my passphrase compromised?

While at the login screen for my Google account, I pulled up my password manager and began entering my master passphrase, so that I can retrieve my password for the login. However, while I was looking ...
35
votes
5answers
7k views

Password manager: safer on laptop or on smartphone?

I want to recommend a password manager to my non-tech friends and family and help them set it up and use it. One of the decisions I have to make is whether I recommend one that works on laptops or one ...
4
votes
1answer
3k views

GPG/GnuPG secret key passphrase recovery and/or .gnupg/private-keys-v1.d/ file format

Bad news: I forgot a GnuPG secret key passphrase. Good news: I do know the words it is constructed of. So, I can easily use john or similar to recover (too many combinations to do it manually, ...
3
votes
1answer
121 views

private key passphrase protected, symmetric key location

If I protect my private key with a passphrase, then it will be encrypted Where is the symmetric key stored for it ? Is it somehow in the certificate itself? What if I have specified that it's not ...
5
votes
3answers
4k views

Why are passwords with special characters considered more secure than longer length passwords? [duplicate]

For example, OWASP considers 10-128 characters, with lower, upper, digit, and special characters (I don't get why there's an upper limit). Using the OWASP's minimum guidelines and assuming there are ...
0
votes
1answer
130 views

Increase entropy by making passphrase more complex [duplicate]

I have just started reading on the use of passphrase to increase a password entropy and have gained a rough understanding of it. However, I'm wondering if it's possible to further increase the entropy ...
2
votes
2answers
94 views

Are complex passwords necessary in web applications? [duplicate]

If there is a web application that holds important data, how important is it to use a complex/long/secure passphrase? When I use for example something like "applefreezer" as password for my admin ...
2
votes
1answer
233 views

Is it safe to encrypt multiple files with the same strong passphrase?

I use GPG to symmetrically encrypt multiple files, and it would be more convenient if they all had the same strong passphrase. It's possible that someone could gain access to several of these files. ...
1
vote
3answers
698 views

SSH keys - passwords policy - can passphrase be the same as password?

I have some doubts regarding keys passphrases I have many machines (around 5) where I use ssh from Every machine has different password for user I log in from every machine to any other machine So ...
4
votes
4answers
813 views

Passphrase vs starting characters

Passphrases are (if created correctly) a pretty secure option for a password. They are easy to remember and have a high entropy. They have one big disadvantage: It's really easy to have a typo because ...
0
votes
2answers
299 views

What is the chance that my WiFi passphrase has the same WPA2 hash as a PW present in an adversary's char. based brute force password search space?

What is the chance that my WiFi passphrase has the same WPA2 hash as a password present in an adversary's character based brute force password search space, after a 30% is searched. WiFi PSK WPA2 ...
2
votes
2answers
1k views

Master Password vs Passphrase

About a year ago, I tried using LastPass but found the user experience very lacking, and went back to my tried-and-true method of just having a bunch of different passwords (some password reuse, but I'...
15
votes
3answers
3k views

Is there a better Diceware word list?

I use Diceware to generate passphrases, and am very happy with the ease of the process and the security of the results. Where I have an issue is with the word list itself. It contains problematic ...
43
votes
4answers
28k views

How to check if an SSH private key has passphrase or not?

Let's say I have access to the private portion of an RSA key-pair. How can I check if this key has associated passphrase or not?
4
votes
1answer
930 views

Change LUKS encryption key (not passphrase) without dataloss

You can change the LUKS passphrase without dataloss, but can you also change the actual key? I reckon you would have to re-encrypt the whole disk, but that would be acceptable to me. Background We ...
6
votes
1answer
587 views

Why use a passphrase for RSA key?

Today I generated my first key pair, so my knowledge here is - so to speak - very limited. On client side I am using Windows and to log in I use PuTTY and I used PuTTYGen to create the keys. Here (...
27
votes
5answers
2k views

Would turning a Diceware phrase into a sentence decrease its security?

Diceware passphrase lengths are on the rise - up to six or seven words now. The old adage that passphrases are easier to remember may be true for shorter phrases, but six truly random words can be ...
3
votes
1answer
127 views

Single randomly generated passphrase for both identity and authentication

There are questions about using a password only to identify and authenticate a user, rather than an email address or username plus password: Why do we authenticate by prompting a user to enter both ...
12
votes
5answers
22k views

Is it possible to recover a lost passphrase for a private key file?

We have a set of public and private keys and certificates on the server. The problem is that while public encryption works fine, the passphrase for the .key file got lost. So, when trying to execute ...