GPG keys for multiple email accounts

[Robert J. Hansen]

On 07/07/2013 03:42 AM, Heinz Diehl wrote:
> will calculate your passwords entropy in bits. Your 19-chars password
> accounts for 124 bits of entropy, which is nearly half of AES-256's
> strength (there are P^L different passwords).

Not hardly.  Theoretically speaking [*], AES-256 will fall to brute
force after 2^255 attempts.  A keyspace of 2^124 is nowhere near half of
2^255; it's not even particularly close to the square root of 2^255.

Assuming you meant AES-128 instead of AES-256, it's still not very
close.  A 128-bit keyspace will (again theoretically) fall after 2^127
attempts.  A keyspace of 2^124 is a factor of 8 less than this -- not
"nearly half."




[*] All this handwaves, of course, the fact that breaking AES-256 by
brute force is impossible given the physical constraints of the
universe, and breaking AES-128 by brute force is impossible given the
fact we'd like the Earth to remain a habitable planet.  People who
obsess over the amount of entropy in their passphrases are living in
sin.  Spend more time worrying about how to keep your passphrase secure,
and less time worrying about whether it has 128 bits of entropy or
instead "only" 80.