Schneier on Security

Clive Robinson • August 17, 2010 8:56 PM

@ Dr. Jason Allan Graves,

“What is the best password length to use with Twofish and Blowfish?”

The simple but unhelpfull answer is “one that gives you the required entropy for your use”.

That is first of all determine how many bits of entropy are required for your specific application, which might not be the full number of key bits. Also be realistic on your expectations of what humans are capable of…

Then determine how the “password” to “key bits” algorthm works and make an appropriate length “password” (ignore any use of “hash functions” as these do not add entropy only obscurity).

As a rough rule of thumb each alpha char is worth between 1.5 and 4 bits of entropy in a plain text string such as “the cat sat on the mat”.

The low side estimate (1.5 bits/char) is due to the inability of a human to remember a random password, or even a random sentance of any length and is therefore is very likley to use a generally known plain text (like “to be or not to be that is…”)

You can immediatly see from this that there are other problems relating to the human mind. For 128bits of entropy you will need a plaintext of at least 32chars and more than 86 chars to be sure of getting the required entropy. You need to ask yourself just how many errors will be made on simple typos changes in the use of punctuation and white space etc are going to occur…

Realisticaly the human mind cannot reliably remember such long plain texts 100% accurately (for example think about word concatanation issues such as the use of “may be” or “maybe”, or “can not / can’t”).

Thus counter intuativly you may be better of using a real random string of characters and writing it down on a piece of paper and keeping it in your wallet.

However again due to human weakness a real random string of characters being read and typed in is liable to suffer transcribing errors.

Thus again you maybe better off using a real sentance or two of simple vocabulary words, written down with no punctuation.

What ever you do you end up realising that in reality you are going to be lucky to get 20-30bits of entropy with “jo average” due to their limitations…

Which is why you need to limit your expectations or use another method to generate the key.

Clive Robinson • August 19, 2010 2:10 PM

@ Jason T. Miller,

“It appears proceedings for 2010 and prior years are available on SpringerLink”

Springer host them for IACR (look at the IACR’s website) and IIRC the cost of joining the IACR (which gives you full access0 is for Sept 09-Aug 10 $88 considerably less for a student.

I don’t know what the student fees for an affiliated college/university part time course is around where you live but in the UK it’s way way more than the 50GBP equivalent.

For those students who realy don’t have much in the way of a personal PC and don’t have a bang uptodate OS or cannot run the VPN software or it kills their computer performance. Sometimes changing your web browser settings to use the University Web Cache will get you access to online Citation DB’s and other resources from your personal Internet connection without having to have the VPN software on the PC.

And to be quite honest I know quite a few students who have had their PC’s effecivly “bricked” when the VPN software has epired or does not play nicely with the latest AV software and they have tried to remove it.