Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'd like to know what a good minimum password length for a putty passphrase is. This depends on the amount of entropy the passphrase needs to have, which in turn depends on the length one attempt takes, which in turn depends on the algorithm used to encrypt the private key.

Assuming a slow enough setup of PBKDF2, just 6 random alphanumeric characters would be almost 36 bits on entropy, and take a very long time to brute force. But if the encryption is trivial, it might be possible to try billions (or in parallel trillions) of attempts a second, and I'd want more like 64 bits of entropy at a minimum - at least 11 characters.

So which is it - does putty use something nice and slow like PBKDF2/bcrypt/scrypt/whatever or do I need to worry about making sure passphases are long?

share|improve this question
Incidentally, I hope this is the right place to post - or would superuser be better? – Eamon Nerbonne Feb 20 '13 at 17:18
This may be more appropriate for security.SE, but check the FAQ and previous questions before asking there. – mgorven Feb 20 '13 at 17:41
Would appreciate if someone answered the actual question. Does PuTTY use key stretching for encrypting private keys or not? – Attila Szeremi Mar 20 '14 at 9:49

This should provide all the information you need: correct horse battery staple from XKCD

share|improve this answer
+1 -- There is a reason it's called a "SSH key passphrase" -- an obscure line from a favorite book is what I often advise people to use. I have a friend who uses long palindromes. – voretaq7 Feb 20 '13 at 18:23
That comic is retarded. Use KeyPass and it's irrelevant because then you have long passwords AND special characters, capitals, etc. Without having to remember every single one of your passwords my heart. – gparent Feb 20 '13 at 18:30
The 3 upvotes speak for themselves. – Tom O'Connor Feb 20 '13 at 19:18

Just follow this advise or read this and follow the links... at least 8 characters, not only letters, not in any dictionary, no l337 speak, ... Make sure your machines limit the rate of tries from a given IP address. The processing power available to miscreants is staggering.

share|improve this answer
Most of your advice is sound (if a bit dated -- see the XKCD cartoon in Tom's answer), but no l337 speak is not: You just reduced your potential entropy pool substantially. If someone wants to use 1 instead of l or 0 instead of o you should let them. General rule for passwords: Never eliminate options. – voretaq7 Feb 20 '13 at 18:21
@voretaq7 Yes, but many of those "transliterations" are in the dictionaries used by e.g. Jack the Ripper. – vonbrand Feb 20 '13 at 18:34
That doesn't change the fact that they add entropy (i.e. Jack needs to search a larger key space). Any "You can't do that" restriction on a password narrows the search space, and most software is good about telling you these scope-narrowing requirements so you can trim your dictionary... – voretaq7 Feb 20 '13 at 18:44
Unpredictable entropy is more entropic ;-) ["Brute force" attacks try predictable passwords/phrases, and o --> 0, e --> 3, t --> 7 is predictable, perhaps o --> z3r0 is better...] – vonbrand Feb 20 '13 at 19:05
You're either completely missing or deliberately ignoring what I'm saying - The point isn't "can you do it better" (because the answer is "Correct horse battery staple!"), the point is "Don't restrict your users password choices, because you'll make their passwords less secure. – voretaq7 Feb 20 '13 at 19:17

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.