Password Based Encryption

[William Colls]

I am working on a project in which we will need to encrypt some files.
For reason beyond my control, we will have to use Password Based
Encryption, and for the most part we have that working. However, I have
not, so far, been able to find any guidance that we can give our users
with respect to the password it self: Minimum length? Maximum Length?
Does case matter? We assume that the usual rules for "Strong Passwords"
will apply.

If anyone has useful pointers or links that will help in this regard,
they will be greatly appreciated.

Thanks for your time.

William.

 

[Arne Vajhøj]

I am working on a project in which we will need to encrypt some files.
For reason beyond my control, we will have to use Password Based
Encryption, and for the most part we have that working. However, I have
not, so far, been able to find any guidance that we can give our users
with respect to the password it self: Minimum length? Maximum Length?
Does case matter? We assume that the usual rules for "Strong Passwords"
will apply.

To fully utilize a standard encryption algorithm like AES 128 then
you need a password that has 128 bits of real entropy and are
nit in any dictionaries. That will be a relative long password.
I guess you can call it passphrase!

Arne

 

[markspace]

I am working on a project in which we will need to encrypt some files.
For reason beyond my control, we will have to use Password Based
Encryption, and for the most part we have that working. However, I have
not, so far, been able to find any guidance that we can give our users
with respect to the password it self: Minimum length? Maximum Length?
Does case matter? We assume that the usual rules for "Strong Passwords"
will apply.

If anyone has useful pointers or links that will help in this regard,
they will be greatly appreciated.

Iirc, there's quite a lot of algorithms that are grouped under the
general description of "password based." Can you say specifically what
you are using, and what parameters you use in the Java API? (I assume
you're using the Java API.)

Otherwise, there might be far to many options to really cover anything
more than just general platitudes.

 

[Roedy Green]

I am working on a project in which we will need to encrypt some files.
For reason beyond my control, we will have to use Password Based
Encryption, and for the most part we have that working. However, I have
not, so far, been able to find any guidance that we can give our users
with respect to the password it self: Minimum length? Maximum Length?
Does case matter? We assume that the usual rules for "Strong Passwords"
will apply.

see http://mindprod.com/jgloss/jce.html
If will do most of the well known types of encryption.

If you need something very lightweight that you can verify for
yourself contains no trapdoors, see
http://mindprod.com/products.html#TRANSPORTER
--
Roedy Green Canadian Mind Products
http://mindprod.com
When you were a child, if you did your own experiment
to see if it was better to put to cocoa into your cup first
or the hot milk first, then you likely have the programmer gene..