[arch-general] How long do you make the passphrase for the private key?

[Eli Schwartz]

On 6/24/19 4:31 PM, Manuel Reimer wrote:
> On 24.06.19 18:00, mpan wrote:
>>    If you’re using a password manager, you should not care about the
>> password being “too long”. After all it’s not you who type it. Go for 16
>> or 20 random chars.
> 
> If the key is too complicated to remember or to type in manually, then I
> have to use a password manager which now saves my password to local disk
> again. Maybe encrypted with a master password.
> 
> Then we are back at the starting problem.
> 
> If someone can take my private key file, then he can also take my
> password manager database.
> 
> How strong would you make this master password and where to save this
> one? A second password manager?
> 
> I think if really someone takes over control over my PC, then I have to
> expect the password to be gone, too. I someone is really able to take my
> private key file, then I think he should also be able to install some
> kind of key logger.
> 
> And I really think that finally someone *has* to come up with some
> replacement for this password nightmare. Some kind of hardware key maybe.
> 
> I could protect the private signing key with an UUID (just call uuidgen
> on console). This should be pretty hard to crack but is impossible to
> remember so I would have to keep this written down somewhere and need
> this piece of paper every time I unlock the key for signing.

I'm not sure where you're going with any of this.

The purpose of a PGP signing key is that it does interesting crypto
things that prove your identity in a way that passwords don't (passwords
can be guessed).

The purpose of password-protecting your PGP private key is to prevent
someone who gains access to the filesystem, from gaining access to the key.

Password managers, like PGP keys, are things that "should be encrypted
with a password to prevent an attacker with disk access from gaining
your secret material".

How you protect the master password for a password manager, has nothing
to do with whether it's intelligent to use a password in the first
place. Personally, I find it very easy to remember *one* master password
(or even, to be honest, two or three), which exists only in my own head
and unlocks the secrets that are stored on disk -- like PGP keys and
password databases.

...

As for hardware keys, there is no need to come up with a replacement for
the password nightmare. Hardware keys have existed for some time now,
and they were already intended as a replacement for the password
"nightmare", something they do an excellent job at. Did you try getting one?

-- 
Eli Schwartz
Bug Wrangler and Trusted User

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 1601 bytes
Desc: OpenPGP digital signature
URL: <https://lists.archlinux.org/pipermail/arch-general/attachments/20190624/64c2ebec/attachment.sig>