-
-
Notifications
You must be signed in to change notification settings - Fork 1.5k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Update Password Strength indicator's rating #8519
Comments
AES key length and password entropy are very different concepts. Example passwords with their rating: g^gm6QKl%HqRuaG = Good (15 chars, 92 bits) I do think the "Good" rating needs to be raised to 75 bits. Excellent is impossible to reach without at least 16 chars and a lot of character groups included. @phoerious |
I understand that AES keys and passwords are completely different things but, what I had in my mind was this: I'm not a cryptographer, so maybe there is flaw in my logic. But, I just wanted to put it out there. |
NIST only changed their minimum recommendation. There is no proof that 128-bit key space is broken. I am sure there might be a couple of super computers capable of brute forcing the key space owned by some countries.... but that is definitely not equating to broken. In my opinion, quantum computing is a huge farce and I doubt we will ever see them implemented in the theorized ways. There is a huge jump between "this might be possible someday" to "quantum computers will break 128-bit keys in 5 years". The latter is definitely not on the table right now or even the near future. |
Summary
Currently, Keepass-XC rates passwords as Poor (Entropy < 40 bits), Week (Entropy between 40 and 65 bits), Good (Entropy between 65 and 100 bits) and Excellent (Entropy > 100 bits). In my opinion this rating should be updated as the computing power has dramatically increased over the years.
National Security Agency (NSA) announced their plan and timelines to transition the industry to a post-quantum world with Commercial National Security Algorithm Suite 2.0. Interesting, they do not consider AES with key length 128-bit to be secure anymore. The minimum key-length requirement for AES is 256 bit.
I was wondering if we should update the password-strength indicator as, in its current state, it could be misleading in the coming years.
Context
[NOTE]: National Security Agency (NSA) announced their plan and timelines to transition the industry to a post-quantum world with Commercial National Security Algorithm Suite 2.0.
The text was updated successfully, but these errors were encountered: