I have a very (read: very) strong passphrase for my private key. How reckless can I be with my .gpg directory? Put another way, how many bits of entropy would I need in my passphrase to safely post my .gpg directory on the web? Put yet another way, how strong is the encryption algorithm protecting my secret key?
-
You don't need a strong passphrase, you just need to reduce the validity time of your keys to something like 1 month.– BatchyXJan 12, 2013 at 9:28
Add a comment
|
2 Answers
This is not a statement about the security of public key pairs or gpg encryption, but WRT entropy and passwords, given a password taken from the range of ASCII alphanumeric characters (A-Z, a-z, 0-9), the possible number of combinations in 16 characters is:
n = 62^16 = 47672401706823533450263330816
If I have your key and try to "brute force" the password by peeling through all those possibilities, 1 million times per second, then:
n / 1000000 / 3600 / 8760 = 1511681941489838
3600 being the number of seconds in an hour and 8760 being the number of hours in a year, it could, as a worst case scenario, take more than 1.5e13 centuries (1.5 million aeons).
Which is why it is very naive to believe that anyone tries to break a password that way. Passwords are important and strong passwords are better than weak passwords, but having "a very (read: very) strong passphrase" is not going to protect you any better from attempts to steal the password, spoof exchanges, or other methods which are not simply about brute forcing the passphrase. An analogy might be cancer -- there are people who've never smoked, eat well, exercise, always wear sunscreen, etc., and still get cancer. That doesn't mean you might as well run out and eat plutonium.
answered Jan 12, 2013 at 10:27
-
"Spoof exchanges"? Also, I may have given the wrong impression in my question. I'm not trying to be reckless, I am just a bit paranoid. I don't want anyone to get my keys, but I also want redundancy in case my hard disk burns out. So, a slightly better phrasing might go along the lines of, "If I want to put my keys on potentially insecure media such as USB drives, web storage services such as Dropbox, etc., can I just use the default encryption on my keys or do I need to do more?"– fouricOct 30, 2014 at 4:49
-
By "spoof exchanges" I presume I meant something like man-in-the-middle style attacks -- having someone exploit a weakness in a mechanism in order to trick you/your software into giving things away inappropriately. I'm not a crypto expert; my thing about probability reflects ideally how a password should work, and how a key ideally should work, but WRT to the latter even, e.g. AES might have attacks that reduce this ideal relationship to probability (i.e., cracks that are not brute force) but are still too absurd to be generally viable. If that stuff was truly broken, presumably... Oct 30, 2014 at 8:25
-
...they'd let us know. So whatever the default password encryption on your key is, it can't be no good what-so-ever. WRT stunts such as "safely post my .gpg directory on the web", probably you do want to learn and do some more research. I kinda presumed someone who knew more would post a more interesting answer. Not that I think this one is wrong, it is just a common sensical thing highlighting that central concept of what exponential growth in possibilities means to brute force. Oh and not to eat plutonium anyway ;) Oct 30, 2014 at 8:29
I know this is an old question, but since it is so critical to have a correct answer and even though I am no expert I will answer this as good ad I can.
Do not be reckless with gpg keys, even encrypted!
The private keys are encrypted with a symmetric algorithm. That is as good as it gets. However, a side-channel attack(keylogger for example) will circumvent this. Side-channel attacks are increasingly sophisticated. Even the sound a computer makes during operation can reveal a key.
Also, (and this may be controversial), most cryptographic algorithms are not proven absolutely secure, except the one-time-pad(which would require you to use a very long key.) Sure, no one has found major flaws yet, but it could still happen. Standard polyalphabetic substitution was considered a strong basis, until 19th century cryptoanalist Kasiski invented his analysis. Also, quantum computers are becoming increasingly likely, which may or may not offer aditional capabilities. RSA is already proven vulnarable to such machines. And yes I know that a flawed algorithm means broken cryptography regardless of key security, but at least the key would still be usable for signing. Which also potentially allows getting a new key for another algorithm.
Overall, better safe then sorry.
