Tell me more ×
Database Administrators Stack Exchange is a question and answer site for database professionals who wish to improve their database skills and learn from others in the community. It's 100% free, no registration required.
up vote 1 down vote favorite

I am trying to figure out how to create the best secure password for AES_ENCRYPT. Specifically, how long should the password be, and how it translates into the 128 bit key length that AES typically uses.

share|improve this question
Are you planning to use AES_ENCRYPT to encrypt and then store account or user passwords? – Nick Chammas Sep 20 '11 at 3:22
Well, actually no. Passwords I would store in a one-way encryption with good salt and multiple steps. Other sensitive information requires two-way encryption, I was advised to use AES_ENCRYPT, but I instead plan to AES encrypt before sending to MySQL. But I still have that question,, if AES key length is 128 bits,, how is the password converted to the AES key? – George Bailey Sep 20 '11 at 12:39

2 Answers

up vote 1 down vote

This really isn't a mysql question, more of a "how does encryption work" question. If you have some time to kill you might want to watch this series

http://www.youtube.com/watch?v=dlS5_qfxAss&feature=results_main&playnext=1&list=PLDCC9179604F435AB

Here's what I felt was a good explaination of password strength I came across a while back

http://www.reddit.com/r/programming/comments/9pu3k/how_long_would_it_take_to_bruteforce_crack_an_aes/c0dv7sx

Remember though, the theoretical security of your password is moot if it's stored in source code that is not secure (world readable, ending up in a .mysql_history when working from the commandline, etc).

share|improve this answer
Actually, it is not "how does encryption work". Unless I am mistaken, AES encryption would encrypt with a 128 bit (16 byte) key. My question was, how is it that MySQL (and perhaps other databases) convert the password to the 128bit key. – George Bailey Sep 20 '11 at 12:44
This question can be tagged a MySQL question. In fact, there is an AES_ENCRYPT function (dev.mysql.com/doc/refman/5.1/en/…) in the MySQL Documentation. There is also AES_DECRYPT. – RolandoMySQLDBA Sep 21 '11 at 20:14
up vote 1 down vote accepted

It seems someone else has already found the answer on security.stackexchange.com

Sorry but I found that later from RubyForum

"The algorithm just creates a 16 byte buffer set to all zero, then loops through all the characters of the string you provide and does an assignment with bitwise OR between the two values. If we iterate until we hit the end of the 16 byte buffer, we just start over from the beginning doing ^=. For strings shorter than 16 characters, we stop at the end of the string."

share|improve this answer
+1 for finding your answer, and a good one at that !!! – RolandoMySQLDBA Sep 21 '11 at 20:11

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.