0

Let's say one wants to encrypt a file using a passphrase (not a key), gpg can do that. Assuming a short passphrase, does it make sense to make use of a longer passphrase that is the short one concatenated many times?

Example:

Initial password:

foo

Long password:

foofoofoo... # many times

Is the long password stronger than the short one?

3
  • 1
    Password strength is going to be dependent on how easy it is to crack. foo is a bad password. f0o is better. A combination of letters (upper and lower cast), numbers and symbols is best. F0of0oFo0 is better than foofoofoo. F0*f0oF*8 is better than F0of0oFo0. One rule of thumb is to never use dictionary words.
    – Ben Plont
    Jun 28, 2013 at 23:50
  • 1
    "foo" was just a placeholder in my example, of course the initial passphrase can be strengthened like you suggest Jun 29, 2013 at 0:04
  • I understand. I was just expanding on the idea of using letters on their own.
    – Ben Plont
    Jun 29, 2013 at 1:49

3 Answers 3

1

Unfortunately it doesn't make sense. As @Scott said, while repeating the same password probably makes the key slightly more secure, it kind of defeats the purpose of using a passphrase over a key. I guess its analogous to using "1111" as a 4 digit pin as opposed to no pin at all.

Security.stackexchange is probably a better place for this question, and indeed has it, and has answered it - https://security.stackexchange.com/questions/31153/passphrase-using-same-word-several-times

2

Password strength can be measured using entropy. Depending on how your password is generated (length, different kind of characters ie. capitals, numerics, special characters, etc.), you get a weaker or a stronger password. Here is what Wikipedia says about Password strength:

It is usual in the computer industry to specify password strength in terms of information entropy, measured in bits, a concept from information theory. Instead of the number of guesses needed to find the password with certainty, the base-2 logarithm of that number is given, which is the number of "entropy bits" in a password. A password with, say, 42 bits of strength calculated in this way would be as strong as a string of 42 bits chosen randomly, say by a fair coin toss. Put another way, a password with 42 bits of strength would require 242 attempts to exhaust all possibilities during a brute force search. Thus, adding one bit of entropy to a password doubles the number of guesses required, which makes an attacker's task twice as difficult. On average, an attacker will have to try half the possible passwords before finding the correct one.

Since a picture is worth a thousand words, just read this strip from xkcd. You will get why it is not necessary to get a "complex" password, but a long enough easy to remember password can be preferable than a weaker complex password.

enter image description here

Finally, you can test the entropy of your password thanks to strength tests like this one. You'll noticed that the repetition of your initial password increases its entropy. Except if the hacker (or bruteforce algorithm) knows you're using repetition in your password generation, your password will be harder to guess.

3
  • This doesn't directly answer the question, but it's good advice nonetheless. It'd be better if you provided more than just a link, however. Jun 28, 2013 at 23:49
  • 1
    Welcome to Superuser.com. To attach a picture, you first save it to your computer. Then you press "control + G" then "Enter". Now you can browse to the picture you wanted people to see and select it. This will embed it in your response. It will take you an extra 15 seconds to do compared to posting a link, but people will actually see it in your response on this website without having to go to a 3rd party site. We hope you enjoy learning to use this site. Jun 29, 2013 at 0:00
  • Bradd, I edited my answer to provide some more information. @Austin, I was not comfortable with including a (potentially) copyrighted picture in my answer, I just checked and xkcd is under CC by-nc.
    – ssssteffff
    Jun 29, 2013 at 0:44
1

In the past year or two, I have seen several articles, posts, whatever, suggesting lengthening passwords (and/or passphrases) by appending to them, repetitively.  For example, foo might become foo77777 or foo#####.  Your idea is similar.  The bad guys probably read these same articles, and probably have updated their password-guessing software to anticipate such tricks.

So I would say the answer is, yes, foofoofoo is more secure than foo.  It might take the bad guy two minutes to crack it, rather than two seconds.

Not the answer you're looking for? Browse other questions tagged .