From owner-freebsd-questions@FreeBSD.ORG Sat Apr 16 13:06:11 2005 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 63E1F16A4CE for ; Sat, 16 Apr 2005 13:06:11 +0000 (GMT) Received: from smtp7.wanadoo.fr (smtp7.wanadoo.fr [193.252.22.24]) by mx1.FreeBSD.org (Postfix) with ESMTP id E18D043D45 for ; Sat, 16 Apr 2005 13:06:10 +0000 (GMT) (envelope-from atkielski.anthony@wanadoo.fr) Received: from me-wanadoo.net (unknown [127.0.0.1]) by mwinf0704.wanadoo.fr (SMTP Server) with ESMTP id 84B1014000A3 for ; Sat, 16 Apr 2005 15:06:09 +0200 (CEST) Received: from pix.atkielski.com (ASt-Lambert-111-2-1-3.w81-50.abo.wanadoo.fr [81.50.80.3]) by mwinf0704.wanadoo.fr (SMTP Server) with ESMTP id 618181400096 for ; Sat, 16 Apr 2005 15:06:09 +0200 (CEST) X-ME-UUID: 20050416130609399.618181400096@mwinf0704.wanadoo.fr Date: Sat, 16 Apr 2005 15:06:09 +0200 From: Anthony Atkielski X-Priority: 3 (Normal) Message-ID: <956136323.20050416150609@wanadoo.fr> To: freebsd-questions@freebsd.org In-Reply-To: <42610AC3.4090202@makeworld.com> References: <1197988274.20050416123145@wanadoo.fr> <42610AC3.4090202@makeworld.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Subject: Re: Encryption of login passwords--where and how is it done? X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: freebsd-questions@freebsd.org List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 16 Apr 2005 13:06:11 -0000 Chris writes: > Ummm - Somehow, somewhere, I was always taught that the longer the > password, the better. So, how can a short passward (say 10 bytes) be as > secure as a 128 byte? It depends on how the password is encrypted and stored. A short, random password may be more secure than a long, less-random password--especially if the password logic discards all characters beyond a certain point, or doesn't hash the entire password in a way that maximizes the extraction of entropy from the password. For example, on a system that uses only the first eight bytes of a password, you'd want a pretty random string of eight bytes, like "uhhxuapo48", but on a system that accepts 128 bytes and pumps them through a message digest algorithm to maximize the amount of randomness it extracts from the string, you could use something like "tiles cloven thru *STARZ/, and zen pop-tarts conceal," and get something that is both easier to remember _and_ more secure (because it provides more bits of entropy if properly processed). -- Anthony