Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

The title pretty much explains it all: I have a very (read: very) strong passphrase for my private key. How reckless can I be with my .gpg directory? Put another way, how many bits of entropy would I need in my passphrase to safely post my .gpg directory on the web? Put yet another way, how strong is the encryption algorithm protecting my secret key?

share|improve this question
    
You don't need a strong passphrase, you just need to reduce the validity time of your keys to something like 1 month. –  BatchyX Jan 12 '13 at 9:28

1 Answer 1

up vote 3 down vote accepted

This is not a statement about the security of public key pairs or gpg encryption, but WRT entropy and passwords, given a password taken from the range of ASCII alphanumeric characters (A-Z, a-z, 0-9), the possible number of combinations in 16 characters is:

n = 62^16 = 47672401706823533450263330816

If I have your key and try to "brute force" the password by peeling through all those possibilities, 1 million times per second, then:

n / 1000000 / 3600 / 8760 = 1511681941489838

3600 being the number of seconds in an hour and 8760 being the number of hours in a year, it could, as a worst case scenario, take more than 1.5e13 centuries (1.5 million aeons).

Which is why it is very naive to believe that anyone tries to break a password that way. Passwords are important and strong passwords are better than weak passwords, but having "a very (read: very) strong passphrase" is not going to protect you any better from attempts to steal the password, spoof exchanges, or other methods which are not simply about brute forcing the passphrase. An analogy might be cancer -- there are people who've never smoked, eat well, exercise, always wear sunscreen, etc., and still get cancer. That doesn't mean you might as well run out and eat plutonium.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.