There's no difference between that and just requiring the user to use a longer password.
Anyone trying to attack the system will just program their cracker to be more likely to try concatenating words together awkwardly in the password somewhere.
It's easier for humans to remember two distinct passwords with individual complexity requirements than one gigantic passphrase.
By forcing the user to choose two passphrases which are then concatenated, the result is one gigantic passphrase that a cracker can't easily crack, yet is easy for humans to remember. It seems like this solves the problem of rainbow tables.
A keylogger could still break this system. But if an adversary has planted a keylogger, they could've simply stolen your keyfile.
Comments
There's no difference between that and just requiring the user to use a longer password.
Anyone trying to attack the system will just program their cracker to be more likely to try concatenating words together awkwardly in the password somewhere.
It's easier for humans to remember two distinct passwords with individual complexity requirements than one gigantic passphrase.
By forcing the user to choose two passphrases which are then concatenated, the result is one gigantic passphrase that a cracker can't easily crack, yet is easy for humans to remember. It seems like this solves the problem of rainbow tables.
A keylogger could still break this system. But if an adversary has planted a keylogger, they could've simply stolen your keyfile.
I mean, you could just tell users to pick two sentences, if that's what you're after.