🚀 go-pugleaf

 -=> Quoting Stu to All <=-

 St> The security of PGP's key encryption alogorithm is, as it should be,
 St> only as strong as it's key.  While an 8 byte alphanumeric password is
 St> hardly as secure as they 1024 bit key it protects, it would keep one
 St> busy for a little while trying to break it..

 St> Assuming an 8 letter password, and say about 70 choices for each
 St> letter ....... it would take
 St> 5.765*10^8 seconds, or about 18 years - that seems awfully secure for a
 St> simple password... if I boo boo'd, let me know..

 The maths gives only part of an answer. I think the main points might be:

        a. The expected safe time against any exhaustive attack is half 
        the maximum.
        b. The single variable with the most effect on pass word/phrase safe 
        life is the number of characters used to compose the pass**** . By my 
        calculation and assuming, as you do, a 70 char selection field and
        given a powerful attack of 10,000,000 cpm, the following expected
        safe-times would apply:
                1. Emma's boyfriend uses guess what length of password? 
                Expected safe time 4 minutes.
                2. 10 char password, EST of 2.69 million years.
                3. 11 character password, EST of 209.91 million years.
               
However, such figures only hold true if password selection is truly random. 
With no electronic aid, it took me less than 30 seconds to crack the 
example 1 password. Given the vagaries of language construction and of human 
nature, 8 letter passwords can often be broken in a matter of hours/days by 
relatively cheap attack. 

I think that the length of pass phrase allowed by PGP goes at least some way 
to redress the balance. A memorised phase of not less than 90 characters, 
consisting of more than one language and containing just a few high ASCII 
characters might prove quite tough. However, its use does require a different 
level of self discipline (and keyboard skill) than plain old 'Emma'. Even 
then, I believe that the passphrase is a point of relative vulnerability for 
serious users. 



___ Blue Wave/QWK v2.11