Mixed in, BTW, thanks for bring all this up, I had been wondering about it.
From: "Mark Rode"
clipped
> DES3, Blowfish, and AES is a whole different level of encryption. Not
> even the CIA, using super computers could crack a full length key, in any
> kind of reasonable time frame. This is why law enforcement doesn't like
> encryption, and why they have always asked, at least in the US, for some
> kind of back door, which kind of defeats the purpose of encryption.
Are you (Rode) saying WinZip has (or had) a back door,
(or will "they" ever let us find out)?? <grin> (Tin hat time???)
> When evaluating your security, look to the weakest link. If you have things
> set up right the weak points are usually the single password, that accesses
> other keys, and passwords, and your trust in the manufacturer of the
> software of the encryption program you are using. I trust Winzip as a
> manufacturer. However, I will be happier with them when they get around to
> having a AES256 self extracting program.
Thanks for pointing that out, I never noticed it was missing, (and just checked it...)
I guess a self extracting "wrapper" can't be strong enough to handle the AES stuff...
Maybe it would need all the new "code" that is in the main program that handle that...
I had wondered about all this, and checked into it after this question...
WinZip program Help says he following: (Below, with the * before the lines).
It is from the section "Encryption Passwords",
which they seem to use instead of the term "Key"... They get even more lax,
(on the KISS principal no doubt), and then use the single term "Password" as
a form of shorthand for both terms... While that may not be "exactly" correct,
when you are reading their technical information you helps to understand the
way THEY are defining the terms they are using... IMHO, when used "in context"
all of the above terms can be used.
*In general, longer passwords are more secure than shorter passwords.
*In fact, taking maximum advantage of the full strength of AES encryption
*requires a password of approximately 32 characters for 128-bit encryption
*and 64 characters for 256-bit encryption.
FWIW, I only use "a single digit" number of characters for my super strong
"password"... (Opps...) (Less than ten.)
I guess that is my way of using the KISS principal ...
Tin hat disclaimer: If they "are" out to get me, I haven't noticed them yet...
Rick Glazier
"Hold No Punches.." Rode brings you great shareware/freeware
programs with his honest opinions in this weekly column.
http://freepctech.com/rode
|
