0
There are tools like gpg or ccrypt that use the AES algorithm to symmetrically encrypt a file, which I've read it is quite safe, and uses 128/256 bit keys. Now, maybe I'm missing or not understanding something, but these tools generate that key based on the passphrase that you type.
So then isn't the encrypted data as vulnerable as your passphrase is ? Meaning, if you use a weak passphrase, wouldn't that be vulnerable to brute-force attack ?
I mean, if you use a let's say 6 characters passphrase, the amount of tries to match the passphrase would be much much less then to guess a 128 bit key.
If true, what's the common way of doing things ? Just use a long hard to guess passphrase ?