Length of encryption password aes-256-cbc I'm encrypting a file with sensitive information with 

cat secret | openssl aes-256-cbc -a -salt &gt; secret.enc

I am choosing a random encryption password with openssl rand -base64 32 | head -c [password-length]

Is there any standard, how long it should be? Given the password length, how long would it take to crack and view the contents of the file? 

I have read this article, but it seems it supposes that you use a password size of 256 bits. 

Edit: I found this picture, which pretty much answers my question. Is it reliable?

https://www.inetsolution.com/blog/june-2012/complex-passwords-harder-to-crack,-but-it-may-not
AES supports three key lengths. They are 128, 192 and 256 bits long. You chose to use the 256 bit algorithm that operates in CBC mode. It's a correct choice.

Now all you need is:


key - 256 bits long
initialization vector - 128 bits long


You can generate them using the command I found here:

openssl enc -aes-256-cbc -k secret -P -md sha1


where the "secret" is your password.

I suggest not using a truly random key and IV, because you have to save them somewhere, and adversary can just read it from your hard drive. It's much better to use a long and complicated password that he has to read from a post-it-note glued to your monitor, and derive the key and IV from it.

As for security, let me put it this way. If I wanted to crack 256 bits long key and 128 bit long IV on my work laptop, I would probably be around a fifth of way done when the universe would collapse. It's much simpler to use rubber-hose cryptanalysis in this case.

EDIT:

Just for you to know you shouldn't use password as a key directly. You need to derive a key from a password. The command I pasted does exactly that. About the security of the password you already answered yourself. 9 characters is the absolute minimum (if there is at least one uppercase letter, one lowercase letter, one number and one symbol). But I strongly suggest using a passphrase instead of a password. They are vulnerable to dictionary hacking, but if you use enough words a dictionary hack also takes years to complete.

There are over a milion words in the English language.

If we use only lowercase letters in our four word passphrase, the dictionary hack has to do in the worst case $1000000^{4} = 10^{24}$ searches. In comparison, there are around 100 characters on the keyboard. A password of 12 of those characters will be cracked in less than $100^{12} = 10^{24}$ searches.

This mean that "singing retracted eleventh elephant" is an equivalent of a 12 character password, and also it's much easier to remember. And if we use a comma somewhere, uppercase letter, or use a word from a different language it gets much safer.