Lets say we have an arbitrary but dictionary attackable password that is less than 256bit. (Lets just say the password is '1234Password').
We encrypt this password with a securely random 256bit key using AES.
So we have
encrypted_password = aes(password, key).
The key is ONLY used to store this password, and is not used anywhere else.
Assuming someone has the encrypted_password and unlimited processing power, will they be able to bruteforce the password? Of course they can run through all the possible keys and one of them will output 1234Password, but will there be copious of other human readable passwords, and thus the attacker wouldn't have a useful output? Or would this set be limited and thus not impactical to find the password.
Let me rephrase for clarity.
- We live in a universe where processing power is unlimited and bruteforcing all of the possibilities is practical.
- We have a password p, less than 256bit that isn't random. (very limited entropy)
- it was encrypted with k, a random key of 256bit. This key is unique to this use case and does not encrypt anything else.
- encrypted_password ep = aes(p, k).
- If the attacker obtains ep, can they determine what p was? Or will different keys produce too many results that are also very limited entropy, and thus could also be the possible password.