What would be the most secure cipher?

Hi folks,
I'm re-designing an old password manager, you know a web app that manages all my passwords, forums/shops/servers whatever, they are so many, you really need something like this, however, I need the data to be encrypted on the database, so if anyone breaks into my database server, he won't have a clear view of all my passwords.

It must be a symmetric cipher, so it can de decrypted back to clear text to be read by me when I need to login somewhere, I've collected a few symmetric ciphers, but not sure which one to go for, it must be one that's hard to decrypt using brute force/dict or computing power, which of these is the better:

DES, 3DES, AES, Serpent, Blowfish, Twofish, CAST, RC2, RC4, RC5

Do you guys know more?
Which one should I go for?

DES is only 56 bits. AES will give you up to 256 I think. Blowfish is 160 bits. (All off the top of my head - double check that.)

But the number of bits will only affect direct attacks on the actual cipher used. And since anything at 128 or higher is basically not-crackable, the only real way to crack a password is through brute force. (If anyone has cracked AES or any of the others, they aren't saying anything - it's really rocket science to do so and only major research labs have the man power to even attempt it.)

That being said, no matter what cipher you use, they are all basically the same against a brute force attack whether it's 2-bits or a million bits.

Given the state of computing power, the best way is to come up with a password that is long enough to require an unreasonable amount of time to crack. Over a network, this is makes things even slower, but on a local machine, it's much faster.

A key of 6 characters is easily quickly cracked. Once you get up to 8 or more, it becomes incredibly more difficult. Including upper and lower case, numbers, and symbols makes the space much larger and more difficult to crack.

A password that includes 10 characters with upper, lower, numeric, and symbols would take longer than the universe has been around to crack by brute force.

A solid password creation technique that I use is to create a phrase and add something else like a number or symbol to the phrase. This renders brute force impossible and makes the password easy to remember. e.g. "ThisismyPassword123" or "trytocrackthisbuddy)(*", "In the beginning, I created the world! 666".

The space for upper, lower, numbers and symbols is 26 + 26 + 10 + 30 (about) = 92. The space for a dictionary attack is all the words in the dictionary, and using only the 1,000 most common words, this is already 1,000, or using a comlete dictionary is about 50,000, but we'll use 10,000 as that's closer to the number of words that people actually know.

So a 10 character password space is 10^92 (about) (= 1*10^92) and a 4 word passphrase with "3 character extra" (as above) space for a dictionary hybrid attack is 4^10,000 * 3^92 (= 3 * 10^6,064).

If you brute force the passphrase above, assuming the words are 4 characters each, the space is 4 * 10^117.

In either case, the space is far too large for a brute force attack by even the most determined hacker.

In short, the longer a password, and the more types of characters included (upper, lower, numbers, symbols), the safer it is.

I hope that helps.

Cheers,

Ryan

hiya.

in one app im making and used in a few others i use the 2 encryption keys.

Main

encryption Key

then for each record i use a salt key

this is stored with each records is 8 charters random (new one per record).

any details within this record are encrypted with the salt key.

and before the salt key is entered into the database, its encrypted by the main system key

and that is something like 'dfsfg_213^sd_d-Sa!'

so that encrypting a 8 charecter salt key.

and the salt key is encrypted after being added to the end of the record details and encrypted .

its not the most secure method but the results are like

'Key=I3%A6%A4%91%82%F1%E1%D0%DB%16%08%1DrSO%3D%A0&Acc=%3C5%3C%3B%CC5&UserID=Njjh%92i%5EWdt %7F%7C&Status=%3A3%3E6%CF7%03%2D%3E2%3E%3E%2B3%2BG87%3D'

that is used on another app i have, it stores the account ID, Username and a key, the key is used on the account ID and Username and status.

then the key is encrypted using the system Key.

burn ur data on cd.. then run the cd in grinder.. the best one way encryption one can get..