Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update Password Strength indicator's rating #8519

Closed
Rex-0x7CB opened this issue Sep 30, 2022 · 3 comments · Fixed by #8523
Closed

Update Password Strength indicator's rating #8519

Rex-0x7CB opened this issue Sep 30, 2022 · 3 comments · Fixed by #8523
Milestone

Comments

@Rex-0x7CB
Copy link

Summary

Currently, Keepass-XC rates passwords as Poor (Entropy < 40 bits), Week (Entropy between 40 and 65 bits), Good (Entropy between 65 and 100 bits) and Excellent (Entropy > 100 bits). In my opinion this rating should be updated as the computing power has dramatically increased over the years.
National Security Agency (NSA) announced their plan and timelines to transition the industry to a post-quantum world with Commercial National Security Algorithm Suite 2.0. Interesting, they do not consider AES with key length 128-bit to be secure anymore. The minimum key-length requirement for AES is 256 bit.
I was wondering if we should update the password-strength indicator as, in its current state, it could be misleading in the coming years.

Context

[NOTE]: National Security Agency (NSA) announced their plan and timelines to transition the industry to a post-quantum world with Commercial National Security Algorithm Suite 2.0.

@droidmonkey
Copy link
Member

droidmonkey commented Sep 30, 2022

AES key length and password entropy are very different concepts.

Example passwords with their rating:

g^gm6QKl%HqRuaG = Good (15 chars, 92 bits)
c|;7o\d8#XO/'Am1` = Excellent (19 chars, 112 bits)
^p,JLR@!"4MP\95Av = Good (17 chars, 98 bits)
h2>'O/V3B:#z = Good (12 chars, 74 bits)
%B6N6Nu$xO2J = Weak (12 chars, 62 bits)
#Y:5*p_"U# = Good (10 chars, 65 bits)

I do think the "Good" rating needs to be raised to 75 bits. Excellent is impossible to reach without at least 16 chars and a lot of character groups included. @phoerious

@droidmonkey droidmonkey added this to the v2.8.0 milestone Sep 30, 2022
@Rex-0x7CB
Copy link
Author

I understand that AES keys and passwords are completely different things but, what I had in my mind was this:
If there are computers powerful enough to brute-force small key-spaces, aren't they also powerful enough to brute-force low-entropy passwords? After all, the size of the key-space is the representation of entropy in the key, right?

I'm not a cryptographer, so maybe there is flaw in my logic. But, I just wanted to put it out there.

@droidmonkey
Copy link
Member

droidmonkey commented Sep 30, 2022

NIST only changed their minimum recommendation. There is no proof that 128-bit key space is broken. I am sure there might be a couple of super computers capable of brute forcing the key space owned by some countries.... but that is definitely not equating to broken.

In my opinion, quantum computing is a huge farce and I doubt we will ever see them implemented in the theorized ways. There is a huge jump between "this might be possible someday" to "quantum computers will break 128-bit keys in 5 years". The latter is definitely not on the table right now or even the near future.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants