How strong would be create a password through AES ECB encryption?

BillyJoe

5/4/23, 1:19 PM

Suppose that I want to use a "poor man" password management working as follows:

1. I choose and remember one single master password (for example "78HK+jm?329");

2a. for any bank, site, etc. that I need to access I build a password by encrypting with AES ECB the name of the bank, site, etc. (for example "bankmyne") using the same master password as key, then I translate the encrypted text to Base64 (or ASCII hex representation) encoding: the result will be the actual access password;

2b. all like in 2a. but instead of encrypting the name of the bank, site, etc. I encrypt a progressive index (e.g. "bankone" is 001, "banktwo" is 002, etc.) annotated in a notebook.

How strong would be a similar algorithm? Is it the same as the "standard" way of encrypting all chosen passwords? Would 2b. be safer than 2a.?

0 + 0

encryption

aes

passwords

ecb

password-based-encryption

A. Hersean

5/4/23, 1:37 PM

Not an answer to your question, but food for your thoughts: What do you do when a website requires no digits in the password, or limits its length, or requires you to update your password? You would have to remember or write down custom settings for your scheme for many websites. So, why not use your single master password with a password manager? Because in the end you'll need one with your scheme (you're not the first with this idea). Then just use the password manager to randomly generate independent passwords.

kelalaka

5/4/23, 2:49 PM

[KDF1 is sometimes called the poor men's KDF](https://crypto.stackexchange.com/q/67280/18298). And, use password managers....

Score:2

Crypto

mentallurg

5/4/23, 7:18 PM

Your scheme will be strong.

AES ECB is resistant to preimage attacks. If somebody knows the plain text (in your scheme it is the name of the bank or the name of the web site) and knows the encrypted text, it is not possible to recover your password.

See answers here:

Thus, nobody will be able to recover your real password and thus will not be able to construct your password for other web sites. The only way is brute-forcing. Thus the strength of your passwords depends on the entropy of your original password. If it is a word from a dictionary or it is relatively short, then brute-forcing can be successful.

But: Consider what happens if some sites require you to change password. E.g. one site requires to change password every 3 months, other every year, and some sites may require it randomly, e.g. they have new authentication system and require all users change their passwords. Then you will have to go to every web site and change your password. Also you will need to keep information what original password you used or what "generation" it is (like is it second password reset, third password reset). As others said in comments, password manager can be much more efficient than implementing your scheme.

0 + 0

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: How strong would be create a password through AES ECB encryption?

TH: จะสร้างรหัสผ่านที่แข็งแกร่งเพียงใดผ่านการเข้ารหัส AES ECB

RO: Cât de puternică ar fi crearea unei parole prin criptarea AES ECB?

RU: Насколько сильным будет создание пароля с помощью шифрования AES ECB?

VI: Tạo mật khẩu thông qua mã hóa AES ECB mạnh đến mức nào?

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.