# How important is length and complexity of personal password for AES-256 encryption?

I want ask you how important is to have complicated personal password for AES-256 crypto?

For example if I use these two "types" of passwords:

1. pass123
2. Tre$%#CDS-98$$DWEsde985#@ then how different are these for helping protecting more my plaintext encrypted using AES-256? Is AES is using my letters from my personal key to generate that the 256 bits required or is my personal password used for another purpose in AES? What I read is always that a key with more bits is more stronger against brute force attack. If I understand this correctly then 256 bits key in AES is$2^{256}$strong. But here is my private password used if AES is using a fixed 256 bits key? What do I need my personal password for? ## 1 Answer AES is a block cipher. FIPS 197 - the standard that defines AES - doesn't specify anything with regards to passwords - it just discusses AES using keys. There are other protocols that do specify what to do with passwords of course. The most referenced one is possibly PKCS#5 which specifies Password Based Encryption (PBE). It uses PBKDF1 or 2 to derive (AES) keys from a password, salt and iteration count. OpenSSL uses its own derivation function and there are of course also higher level protocols such as PGP. AES itself assumes that the key used has the same security as a randomly generated key. Therefore brute forcing would take$2^{255}\$ tries on average. Or it would if that kind of number was even remotely possible to try. There simply isn't enough time nor energy in the universe. However, the assumption that the AES key has this kind of security fails if it is derived from a password, as a password is extremely unlikely to contain 256 bits of uncertainty to the attacker.

So this question then becomes: how much time would it take to find the password? The AES key is derived from the password, hopefully using a deterministic function such as PBKDF2 rather than direct conversion. If the password is guessed correctly then the same key will be derived, and the attacker can verify the key by decrypting the ciphertext by comparing the decrypted plaintext against expected values or structure.

So if the password is "pass123" rather than something more complicated then this password can be found pretty quickly by a dictionary attack. The salt and iteration count used in PBKDF2 make it harder to perform attacks on the password, but they provide only limited protection against such weak passwords.

I want ask you how important is to have complicated personal password for AES-256 crypto?

Very, very important as that 256 bit security doesn't just rely on the security of AES alone.

Is AES is using my letters from my personal key to generate that the 256 bits required or is my personal password used for another purpose in AES?