—–BEGIN PGP SIGNED MESSAGE—– Hash: SHA512
Date: 2015-03-10
For a number of reasons, I’ve recently set up a new OpenPGP key, and will be transitioning away from my old one.
The old key will continue to be valid for some time, but I prefer all future correspondence to come to the new one. I would also like this new key to be re-integrated into the web of trust. This message is signed by both keys to certify the transition.
“How long does my password have to be to be uncrackable?”
This question was asked recently on IRC. The person asking it was, no doubt, expecting a simple answer such as “20 characters” or “32 letters, numbers, and punctuation”, but I wondered if there was a proper answer to this.
So, let’s start with some background. What do we mean by and “uncrackable password”? We immediately dicounted the trivial solution of cracking the password by knowing it. So, we’ll go with the usual problem of “brute-forcing” the password. This involves checking one password, then the next, then the next; if your password was a number, brute forcing would start at 1, then try 2, then 3 and so on. For any given number of possibilities, the average password will be found in half the tries.