Password entropy much lower than entropy of encryption keys. Why is this acceptable?

Question

When talking symmetric encryption, a 56 bit key is known to be so weak. If you use it for your encryption, you are considered a goner.

When talking passwords however, the standard these days is about 8 characters selected from about 94 characters on the keyboard. This translates to about $94^8$ possible passwords, which means about 52 bits of entropy.

Now, 52 bits is obviously less than 56 bits. But somehow a 56 bit key is considered weak while a 52 bit password is considered safe (i.e., many systems force you to use the 8 characters). Why is this so; I mean why are the standards lower when we talk passwords yet both passwords and keys are subject to the same kinds of brute-force attacks?

I know that humans would find it impossible to maintain a 128 bit password -- however, I wonder if there is some technical reason why a 52 bit password would not be as weak as a 52-bit encryption key for that matter.

Answer 1

I know that humans would find it impossible to maintain a 128 bit password -- however, I wonder if there is some technical reason why a 52 bit password would not be as weak as a 52-bit encryption key for that matter.

First, I would argue that 128 bits is not impossible to remember. My current password manager master password is almost 100 bits (6 words from a large dictionary) and I could increase it to 128 bits if I wanted to by tacking a couple of extra words at the end.

However, yes, there are reasons passwords with much less entropy are often considered acceptable:

1. It is good practice to use a good password hash that slows down attacks to a similar degree as e.g. an extra 20 bits of entropy would.
2. Many uses of passwords do not allow an offline attack with as much computing power as the attacker has. E.g. a login password on a website can only be attacked online, usually with a strict rate limit. (Until the password hashes are stolen.)
3. Two-factor authentication is seeing some use. With it finding the password alone is insufficient.

When some of the above factors do not apply you need to make sure you have enough entropy. E.g. a "brainwallet" Bitcoin password does not benefit from 2. or 3. so it should have at least the 50+ bits so that a password hash makes attacking it too expensive to be worth the effort.

Answer 2

1. I seriously doubt the standard for passwords these days being 8 characters. I would consider anything below 10 characters seriously flawed. I personally always use 20 character passwords.

2. Often, encryption keys are used as such, while passwords are (or at least should be) strengthened with a KDF. The vulnerability of an n bits password or key depends on the attack speed, and a heavy KDF (such as scrypt) significantly decreases the attempts per second that can be done to brute force the password.

3. Rare exceptions excluded, humans are not supposed to remember (or create) passwords in the first place. There's software for that which does a much better job.

Answer 3

Passwords and encryption are two different problems.

Passwords are relatively short-lived, and can be changed or suspended if an attack is suspected. The password is one component in determining permission or identity, and is only one link in that chain. So long as it isn't the weakest link, it has done its job. As mentioned by others, it's the strength combined with the difficulty of testing combinations that matters. What's more, high-entropy passwords are inconvenient and hard to remember (especially if you have dozens to remember), so requiring high entropy can weaken the overall system: the system needs to support legitimate users who have lost or forgotten their passwords, which introduces other ways to break in.

A cyphertext may be copied, cached, archived, and stolen and still be robust against attack. A chat message might be needed by its recipient for only five minutes, but dangerous if unencrypted decades later, once new attacks on the encryption algorithm have cut the effective key length in half. Therefore the key length may be 2-4 times what seems reasonable against an attack today, and particular algorithms may be avoided based on fear of future technology. For example, US government agencies today avoid encryption algorithms that are not robust against quantum algorithms, even though no quantum computers today are powerful enough to break encryption.