What is the most secure encryption algorithm to encrypt my password database?

Question

The password manager I use lets me choose an algorithm from the list below in order to encrypt my password database:

Microsoft Base Cryptographic Provider v1.0:

• RC2-128
• RC4-128
• DES-56
• 3DES TWO KEY-112
• 3DES-168

Microsoft Enhanced Cryptographic Provider v1.0:

• RC2-128
• RC4-128
• DES-56
• 3DES TWO KEY-112
• 3DES-168

Microsoft Enhanced RSA And AES Cryptographic Provider:

• RC2-128
• RC4-128
• DES-56
• 3DES TWO KEY-112
• 3DES-168
• AES-128
• AES-192
• AES-256

Microsoft RSA SChannel Cryptographic Provider:

• AES-128
• AES-256
• RC2-128
• RC4-128
• DES-56
• 3DES TWO KEY-112
• 3DES-168

Microsoft Strong Cryptographic Provider:

• RC2-128
• RC4-128
• DES-56
• 3DES TWO KEY-112
• 3DES-168

The default value is RC4 with the key length of 128 bits from Microsoft Strong Cryptographic Provider.

Now I have two questions:

1. Which algorithm is the most secure?
2. Does the algorithm provider matter?

Edit:

@mikeazo♦: I use Kaspersky Password Manager v5.(Unluckily, I don't have enough reputation to leave a comment!)

Answer 1

The number denotes the size of the key used - for a given algorithm, the larger the key, the more secure it is - hence AES-256 is better than AES-192 is better than AES-128.

The key size is measured in bits - so in terms of its protection against a brute force attack (attacker tries all possible keys) a 256 bit password is not twice as hard to break as a 128 bit password, it is 34000000000000000000000000000000000000 times as hard.

But there are other ways to attack encryption - exploiting mathemetical flaws/coincidences in the algorithm. Although 3DES uses 3 56 bit keys, the effective key size is only around 120 bits. But it is still considered better than RC2-128.

Which algorithm is the most secure?

Of those you have listed, AES-256

Does the algorithm provider matter?

No. In effect, it is just a list of available algorithms. But you do need to ensure the algorithm is available anywhere you want to decode the data.

Answer 2

AES-256 is the strongest of them all. 3DES-168 is the strongest (and satisfying if correctly used) among the ones available in all cryptoproviders, which might be a good idea if compatibility with old versions of OSes is an issue (and the software allows to change).

But the matter is moot. What limits security is more likely to be :

• the integrity of the environment in which the software is run: OS; key-logger (software or hardware); camera or microphone to tap the master password;
• the master password's strength, combined with the entropy/key stretching used by the software to turn master password into a key of the algorithm;
• goof or backdoor in the software or cryptoprovider.

Because of the later point, choice of cryptoprovider might matter, but who knows which is safest.. and again that's moot compared to the first and second bullet.