Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
Does higher encryption mean that my password could be shorter? If the time to decrypt is longer, then the chance to bruteforce gets lower too, right?
I've created a KeePass database, and at the creation you get to choose the decryption time (to 100 ms to 5 seconds). I was wondering if this implies a more secure way to use a short password, since the time to decrypt trying with each password would be higher.
Does bruteforce work like this, or other way?
Yes, up to a point. When your password is used for encryption/decryption, it first goes through a key derivation phase, to convert your password into a key suitable for encryption (e.g an AES key). The key derivation function is tuneable, it is designed to be deliberately slow to compute. And you can choose how slow. We should assume the attacker is more efficient than we are and uses better/more suitable hardware to break the KDF, so brute force time will be much less than your decryption time*number of possible passwords. Yet we still expect a strong linear relationship between the two.
However, a high entopy password is still desired, various improvements in cryptanalisis can speed up the KDF, so if I had to chose purely on security (disregarding time for honest decryption, or cost of saving the secret) between twice the password space or twice the rounds of a KDF, I would choose twice the password space any day of the week.
