Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

I am wondering if AES only supports 64 character passwords?

When using truecrypt, the maximum character limit on passwords is 64 characters; however, when using WinRAR, the limit is 128 characters.

What determines the length of passwords I can use with AES?

share|improve this question
    
I edited this one as well to help you with your English - it should read better now. As always, if there's anything I've mis-interpreted, feel free to fix it :) –  Ninefingers Apr 9 '12 at 14:23
    
perfect, thanks –  rezx Apr 9 '12 at 14:34
1  
Don't confuse AES the algorithm with an implementation of AES as part of a cryptosystem. –  David Schwartz Apr 19 '12 at 0:57
add comment

1 Answer 1

up vote 2 down vote accepted

Key sizes for AES are 128-bit, 192-bit and 256-bit. Depending on how you pack characters into bits, will determine how many characters that makes up. For example, you could pack 1000 characters into a 128-bit encryption key using something like PBKDF2 or scrypt.

That said, I wasn't aware that Truecrypt only supports 64 character passwords. Assuming that is correct (and I have no reason to doubt you yet), you could always use a keyfile with Truecrypt if you need a longer password, but keep in mind that a randomly chosen, 64 character password is surely infeasible to break any time soon.

share|improve this answer
    
The maximum volume password length has been decreased from 100 to 64 characters. This was necessary to avoid the following: When a password longer than 64 characters was passed to HMAC-SHA-1, the whole password was first hashed using SHA-1 and the resultant 160-bit value was then used instead of the original password (which complies with HMAC-SHA-1 specification), thus the password length was in fact reduced. –  rezx Apr 9 '12 at 11:58
    
@rezx, even with 64 characters, the password length will have to be reduced to work for AES, no? If you use 7 bits to store each character (which works for ASCII), you are left with a 448 bit password. –  mikeazo Apr 9 '12 at 12:24
    
so i can use 1000 characters password in AES PBKDF2, cuz PBKDF2 convert the password to something else that used to encrypt the data, right –  rezx Apr 9 '12 at 12:39
2  
@rezx: Somewhat tangentially, that quote from the TrueCrypt version history does not exactly fill me with confidence, since it shows a misunderstanding of how HMAC works. The effective key length of HMAC is limited by the internal state size of the hash, which for SHA-1 is 160 bits. As the output length of SHA-1 is also 160 bits, it makes no noticeable difference whether the key is fed through the hash before use or not. The extra hashing pass just serves to distill the entropy of a long passphrase down to a more compact key string. –  Ilmari Karonen Apr 9 '12 at 14:21
    
what i understand now that every algorithm need a hash to work with, is that right –  rezx Apr 9 '12 at 14:37
show 4 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.