-3
$\begingroup$

I want ask you how important is to have complicated personal password for AES-256 crypto?

For example if I use these two "types" of passwords:

  1. pass123
  2. Tre$%#CDS-98$$DWEsde985#@

then how different are these for helping protecting more my plaintext encrypted using AES-256?

Is AES is using my letters from my personal key to generate that the 256 bits required or is my personal password used for another purpose in AES?

What I read is always that a key with more bits is more stronger against brute force attack. If I understand this correctly then 256 bits key in AES is $2^{256}$ strong.

But here is my private password used if AES is using a fixed 256 bits key? What do I need my personal password for?

$\endgroup$
5
$\begingroup$

AES is a block cipher. FIPS 197 - the standard that defines AES - doesn't specify anything with regards to passwords - it just discusses AES using keys.

There are other protocols that do specify what to do with passwords of course. The most referenced one is possibly PKCS#5 which specifies Password Based Encryption (PBE). It uses PBKDF1 or 2 to derive (AES) keys from a password, salt and iteration count. OpenSSL uses its own derivation function and there are of course also higher level protocols such as PGP.

AES itself assumes that the key used has the same security as a randomly generated key. Therefore brute forcing would take $2^{255}$ tries on average. Or it would if that kind of number was even remotely possible to try. There simply isn't enough time nor energy in the universe. However, the assumption that the AES key has this kind of security fails if it is derived from a password, as a password is extremely unlikely to contain 256 bits of uncertainty to the attacker.

So this question then becomes: how much time would it take to find the password? The AES key is derived from the password, hopefully using a deterministic function such as PBKDF2 rather than direct conversion. If the password is guessed correctly then the same key will be derived, and the attacker can verify the key by decrypting the ciphertext by comparing the decrypted plaintext against expected values or structure.

So if the password is "pass123" rather than something more complicated then this password can be found pretty quickly by a dictionary attack. The salt and iteration count used in PBKDF2 make it harder to perform attacks on the password, but they provide only limited protection against such weak passwords.


So a directly answer to your questions given the information above:

I want ask you how important is to have complicated personal password for AES-256 crypto?

Very, very important as that 256 bit security doesn't just rely on the security of AES alone.

Is AES is using my letters from my personal key to generate that the 256 bits required or is my personal password used for another purpose in AES?

No, AES is a block cipher. It "doesn't know" about passwords, just keys. AES itself isn't doing anything with your password.

But here is my private password used if AES is using a fixed 256 bits key? What do I need my personal password for?

AES doesn't use a fixed key. The key should be specific for a certain purpose. Your password is used to derive that particular key.


Notes:

  • More advanced crypto-systems such as PGP can provide a much higher security level than "direct" encryption using a password (derive then encrypt/decrypt).
  • Any crypto API that allows you to use a textual string directly as key should be distrusted. AES examples that use a readable string as key should not be trusted either.
$\endgroup$
  • $\begingroup$ With password based security you might as well use AES-128. No adversary would attack AES itself if it can also attack the password used to derive the key. And precious few real life passwords will have anything near 128 bits of security. $\endgroup$ – Maarten Bodewes Jun 29 '17 at 10:56

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.