92

The keyfile will have a different header if it is password protected. Here's the top of a key without a passphrase: -----BEGIN RSA PRIVATE KEY----- MIIEogIBAAKCAQEA3qKD/4PAc6PMb1yCckTduFl5fA1OpURLR5Z+T4xY1JQt3eTM And here's the top of a key which is passphrase-protected: -----BEGIN RSA PRIVATE KEY----- Proc-Type: 4,ENCRYPTED DEK-Info: DES-EDE3-CBC,...


89

The difference is that: PBKDF2 by design is slow SHA256 is a good hash function; it is not slow, by design So if someone were to try a lot of different possible passphrases, say the whole dictionary, then each word with a digit appended, then each word with a different capitalisation, then two dictionary words, etc. then this process would be much slower ...


51

Password hashing algorithms such as PBKDF2, bcrypt, and scrypt are meant for use with passwords and are purposefully slow. Cryptographic hashing algorithms are fast. Fast is good in most situations, but not here. Slowing down the algorithm (usually by iteration) make the attacker's job much harder. Password hashes also add a salt value to each hash to ...


49

Just to play the devil advocate... You are as likely to be compromised as if you were using the same password on both site*. As most people have pointed, you probably don't have to worry. Not so much because a website cannot make the difference between a good or wrong password but rather because most websites that you will visit will likely not log your ...


45

It is not always so easy as described in the other answers. It works only with the old PEM keys. New openssh format of the keys (generated with -o option, more secure, since openssh-6.5) looks the same if you check the headers: $ head rsa_enc -----BEGIN OPENSSH PRIVATE KEY----- b3BlbnNzaC1rZXktdjEAAAAACmFlczI1Ni1jYmMAAAAGYmNyeXB0AAAAGAAAABCYdi7MhY $ head ...


44

In most password-protected systems it usually is possible, but very unlikely. Behind many password validation mechanisms is the use of salted hash functions. For the sake of simplicity, let's forget about salt for a moment. When a user sets its password, hash(password) is stored in the database When the user logs in presenting password', hash(password') ...


41

The whole point of having a passphrase is to lock out anyone who does not know it. Allowing it to be recovered would defy the principle and allow hackers who get access to your certificate to recover your keys. So no, there is no such thing. What you should do is declare the keys as lost to the issuer so that they revoke your certificate. Then, you have to ...


41

I don't understand why you don't want a password manager that works on both? Your non-tech friends that don't use a password manager yet are too limited by your requirements. You seem to be running in paranoid mode. Your friends want something that is convenient. If you can get them to move to Lastpass, that will be a huge improvement over their current ...


37

5 Diceware words = 77765 = 28430288029929701376 possible equiprobable passphrases. 9 random characters = 949 = 572994802228616704 possible equiprobable passwords. The 5 Diceware words are 49.617 times better than the 9 random characters. On the other hand, 10 random characters would be almost twice as good as the 5 Diceware words (but the Diceware words ...


37

You're probably fine - there is no particular distinction between a wrong password for the right site and a right password for the wrong site. Even if there was, the site which received the wrong password wouldn't know what site it was supposed to be used on. And that is before considering that it would be uncommon to log passwords for failed login attempts....


27

It does not decrease the security. What is actually happening is that your "entropy calculator" is giving you a false measure of entropy. It can only give an approximate estimate, after all. There's actually interesting proofs that show that one can never actually know the amount of entropy in a particular string of text unless you know something about ...


26

While I imagine most sane web developers wouldn't log cleartext versions of failed password attempts, it's still possible. If you want to be on the safe side you can consider it compromised and reset that password; however, I personally wouldn't really consider it an issue unless I felt beyond reasonable doubt that the first site could potentially present a ...


25

It is not the length of the passphrase which matters, but its randomness; namely, how much different it could have been. Length makes room for randomness, but does not generate it. Symmetric encryption of SSH private keys is not very well designed; it relies on some old features of OpenSSL, which date from before password hashing was a properly understood ...


24

A passphrase-encrypted key provides two-factor authentication, but only if used correctly. It is easy for the user to misuse the key, providing only a single factor, and the server cannot detect incorrect usage. Hence a passphrase-encrypted key cannot be considered two-factor without additional assumptions. From the point of view of the system as a whole, ...


22

The General Assumption of Security(*) is: The attacker is smarter than you, he has a bigger computer, he knows your own software better than you, and he is after you, specifically. So one has to assume that the keylogger will also monitor SSH session and slurp keys from thumb drives. Or, more appropriately, you cannot know how much secure you are if the ...


22

As with any password guessability/strength question, likely the most important factor is "who's the attacker". For online password guessing attacks, by an attacker who doesn't know you, the most important factor is ensuring that your password won't be guessed before the account lockout kicks in. For that as long as your password isn't in the top couple of ...


21

No. It doesn't matter how long your passwords are because that value is never transmitted during the WPA-PSK Key Exchange. Instead a CMAC is calculated based on the secret key, the client and server id, as well as client and server provided large random values. Regardless of how large your password is the resulting CMAC for WPA2-PSK will always be 128 ...


21

If you accidentally disclose your password -- either through typing it into the address bar, or in any other way -- it's best to change it. There's no need for any complicated checklist. Simply change that password, everywhere that you used that particular password. This will protect you. Is it absolutely necessary to change your password if you typed it ...


19

The only case in which I would change this password is if the site it secures is substantially more important to you than the site you typed it into. For an example, there are people in the world who have access to systems that nation-state actors would be interested in. If those people were to type their important password into some other site, they ...


19

Sorry, but you're not the first person to think of this so you can bet that this technique will be automated in some password cracking software. It's always best to assume that the hacker knows your generation scheme when evaluating these sorts of schemes. So how secure is this? Well a quick googling of "number of songs on spotify" threw up the number 30 ...


18

Likely the best option in this kind of scenario is to record the password/passphrase in a physically secure location (e.g. bank vault, safe deposit box). Relying on human memory to record this kind of information for 10+ years is an extremely bad idea. For example the person who knows the passphrase leaves the comapny/gets hit by a bus/forgets it. Writing ...


16

The "RSA key" is actually a set of values stored as an ASN.1 structure in the standardized DER binary format, then encoded in base-64 to get the final PEM file. A very easy way to determine whether a key is encoded or not is simply to check whether the ASN.1 header is present, and this is usually as simple as checking if the "key" begins with the letters ...


14

Bcrypt uses a 128-bit salt AND a 55 character (max) password. You do not need to add any other salt values; bcrypt handles that. The designers of bcrypt felt that the 55 character limit on the password wasn't an issue since the hash has a 128-bit output. If your password is greater than 55 characters, the designers assumed that you are already providing ...


14

A common word of the English language has approximately 11 bits of entropy. That means a 256bit passphrase (passtext?) would require 24 words. How could one make up a text of that length which is still easy to memorize? You could write a poem. The art of writing poetry and memorizing poems is not hard to learn. It doesn't even has to rhyme. In fact, not ...


13

If you protect your private key with a passphrase, then Apache is unable to use it unless you supply Apache with the passphrase each time it restarts or you reboot. And since keeping that passphrase stored in the filesystem would defeat the point of the passphrase, that means having some sort of method to pass the passphrase to Apache from externally, each ...


13

While the Diceware passphrase generation system is sound, you aren't the first person to express concerns about the default wordlist. The nice thing is that you can create your own wordlist that works with Arnold's system. That gives you flexibility in eliminating offensive words and replacing words deemed too short or obscure. In fact, several ...


13

$ man ssh-keygen [...] It is possible to specify a passphrase when generating the key; that passphrase will be used to encrypt the private part of this file using 128-bit AES. So this passphrase just encrypts the key locally. An attacker with access to your system will not be able to read the private key, because it's encrypted. (They could install a ...


12

From your description, it sounds like the server is currently using the key, which means the server "knows" the pass phrase. If this is correct and you have appropriate access to the server, you should be able to extract it. How you'd do that depends on what the server software is and how it's set up. Just as an example, if you were running Apache, and it ...


11

Throw out passphrases until you get one you can remember - If you look at 16 passphrases, and keep the one you like best, then you've reduced your entropy by at most 4 bits (log2 16 = 4). The intuition is similar to what you gave for rearranging: the worst case is that there is logically only 1 of those 16 passphrases that someone is likely to choose. In ...


11

Entropy is a measure of the password generation process. Suppose that you have a list of 32768 words to choose from. You select 5 words randomly and uniformly from that list (the words are chosen independently of each other, so you might get twice the same). Then you have exactly 75 bits of entropy. Your password generation process can result in precisely ...


Only top voted, non community-wiki answers of a minimum length are eligible