The OpenPGP (private) key format stores the key symmetrically encrypted. The \"i

Question

The OpenPGP (private) key format stores the key symmetrically encrypted. The "iterated and salted" setup derives this key from a passphrase, taking a "octet count" parameter that determines the complexity of expanding the passphrase into a symmetric key. With the highest value for this parameter (~65 million), key expansion takes about a second on my computer (GPG).

With this kind of setup, is it possible to make it hard enough to brute-force that it's sane to have the private-key publicly available?

I expect the answer depends on the passphrase complexity. E.g. if you somehow managed to have a passphrase with 256 bits of entropy, then an attacker would be better off just guessing the derived key instead of the passphrase - which in this case amounts to brute-forcing an AES key (which I'd consider hard enough to be "safe"). So the question might really be "how complex does your passphrase have to be to make this safe?".

Explanation / Answer

You've already answered your own question. The question becomes, how many resources can the attacker put on cracking your password, and how good are people at choosing passwords?

The largest supercomputer currently has around 3 million cores. Let's assume each core has about the same amount of processing power as your workstation. That's 3 million cracks/second.

In a year, such a machine could crank through about 47 bits of entropy. In 10 years, that number only goes up to 50 bits of entropy. With 64 bits of entropy, the cracking time goes up to a million years. Of course, computers get faster, so if we assume a doubling time of 1.5 years, you can remove 2 bits of entropy every 3 years. So in 10 years, 53 bit keys will be crackable in a year. In 20, 60 bit keys. So that sounds really great, right? 64 bits of entropy is pretty easy if people use the the simple xkbcd comic http://xkcd.com/936/

Now... the reality is that most people WON'T pick good passwords, and don't understand entropy. They'll still pick "password123", their dogs name, or their phone number. They don't understand offline attacks. Those are all low entropy sources, and could be cracked by a single individual very easily even with a garden variety PC.

So what can you, yourself crack, with just your piddly little PC at 1/second? In just a day you can go through 86,000 tries, or all the words in the a largish dictionary. In a month, you can try 2.6 million.

So I'd say if you're talking about posting private keys encrypted for anyone to just download, you'd be asking for trouble. Some other means of protecting these keys would be more appropriate.

Related Questions

Navigate

• Browse (All)
• Browse T
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.