Archiving Password

[xdivenx]

I didn't know where to put this, but since it is storage, ill try here first.

I have been recently encrypting some of my storage files, using 7z. With AES 256, is a password containing 9 numbers and 7 letters mixed together, all lowercase enough to be secure?

 

[xenotype]

Should be -- as long as its not a word or a simple variation of a word. Its very difficult to crack open an encrypted archive, and the one's I've seen are simple brute force / dictionary crackers.

 

[xdivenx]

Yeah, nothing in a dictionary is part of my pass...Thanks for the reassurance!

 

[Python]

Do not forget about rainbow table attacks also. 16 digits is a little short for someone who really really wants the data. I have a MD5 rainbow table that covers alphanumeric and special chars up to 32 digits in length.

But once again, it depends on how valuable the data is.

 

[xdivenx]

Its not that valuable, just stuff about weather balloons and forests.

 

[hmz]

Notepad.

 

[Drudenhaus]

Do not forget about rainbow table attacks also. 16 digits is a little short for someone who really really wants the data. I have a MD5 rainbow table that covers alphanumeric and special chars up to 32 digits in length.

But once again, it depends on how valuable the data is.

AES vs MD5 isn't really a valid comparison.

 

[pallesen]

AES vs MD5 isn't really a valid comparison.

AES is the actual encryption algorithm. A hashing algorithm is used on the user password to generate the key used by AES. I think 7z uses SHA-256 for that.

 

[Drudenhaus]

AES is the actual encryption algorithm. A hashing algorithm is used on the user password to generate the key used by AES. I think 7z uses SHA-256 for that.

Right. SHA-2 (256) is relatively secure as opposed to earlier SHA algorithms and definitely more secure than MD5 (which you can easily find rainbow tables for).

I wouldn't worry about anybody trying to look up your SHA-2 hash in order to crack the archive...at least not at this time.

 

[pallesen]

You cannot even use a normal rainbow table in a case like this, because 7z executes the hash algorithm a lot of times (2^18 according to http://en.wikipedia.org/wiki/7z).

 

[Michaelius]

Truecrypt advices 20+ for password.
And btw if you are paranoid you can put those zipped files into hidden truecrypt file with some decoy data

 

[pallesen]

Truecrypt advices 20+ for password.
And btw if you are paranoid you can put those zipped files into hidden truecrypt file with some decoy data

And then the bad guy just installs a trojan and grabs the files when he accesses them. Done.

 

[Michaelius]

Trojan with keylogger will get all your passwords anyway.

 

[pallesen]

Well, the key might not come from the keyboard. So a simple keylogger might not cut it.

 

[Drudenhaus]

And then the bad guy just installs a trojan and grabs the files when he accesses them. Done.

That's an entirely different security issue.

 

[pallesen]

Yes, it is. It was just to point out that you can use the strogest encryption possible (#11), but still lose to the bad guy that wants your data.