9

For wifi the Max password length is 63 characters. When I choose such a long password will this lead to notably higher power consumption of the network device (router, smartphone, ...)? I would guess that the longer the password the more effort is required for cryptographic operations applied to the transmitted data which leads to higher power consumption. Is this true? And is the increased power consumption noticable when using a very long password (like 60 chars for example)?

2
  • 14
    Note that if this were the case, it would be a security problem, because it would leak information about the password. – Nonny Moose Feb 28 at 17:32
  • @oystermanu How could it? Aren't the two possibilities which could take more power transmitting your longer password in itself or at the other end, analysing the password? What else could come into this? Transmitting a longer password might take more power if no masking or compression was involved and in all cases, roughly how much more power do you imagine might be involved? How would you even measure it? Further, analysing the password is a purely off-line process conducted entirely at the server end; nothing to do even with transmission, let alone power consumed in transmission. – Robbie Goodwin Mar 3 at 23:07
26

will this lead to notably higher power consumption of the network device?

No. The password isn't used in literal. PBKDF2 is used on the password (with the SSID as salt and 4096 rounds of SHA1) to produce 64 hexadecimal digits = 256 bits, which are then used to derive the actual encryption key. Since that happens only once the password length has no impact.

4
  • Thanks for answering. So no matter how long the user's password is, it will always be converted to 64 hex digits? – oystermanu Feb 28 at 14:22
  • Yes - the actual key is always the same length and the encryption effort doesn't differ. – Zac67 Feb 28 at 14:50
  • 1
    Which is why my WiFi password consists of 54 (or 55, I do not remember) lower case ASCII characters. A choice that I regret each time that I have to type it ;) – Carsten S Mar 1 at 16:12
  • @CarstenS Yes - since a password can be brute forced, it needs sufficient length to be secure (got 47 mixed characters here at home, certificates at work). – Zac67 Mar 1 at 16:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.