Linked Questions

23
votes
11answers
4k views

One liner to create passwords in linux?

How do you create a readable password using bash with one line? What if i'm looking for 128 bits of entropy? EDIT By readable I mean the 94 printable ascii characters (without space). It can use ...
28
votes
9answers
14k views

Feeding /dev/random entropy pool?

Which way of additionally feeding /dev/random entropy pool would you suggest for producing random passwords? Or, is there maybe a better way to locally create fully random passwords?
22
votes
4answers
3k views

What should be used as a salt?

I always hear that it is best to use salts on top of stored passwords, which then somehow gets concatenated and hashed afterwards. But I don't know what to use as a the salt. What would be a good ...
15
votes
3answers
618 views

Why CSRF Token has to be a Cryptographically Strong Random number, in Double Submit Cookies method?

I was just going through the OWASP's Cheat Sheet for CSRF Prevention. In the Double Submit Cookies method, I saw this the site should generate a (cryptographically strong) pseudorandom value ...
10
votes
3answers
2k views

Java SecureRandom doesn't block? How?

I know from experience that reading from /dev/random blocks when the Linux kernel entropy pool runs out of entropy. Also, I've seen many articles and blog entries stating that when running on Linux, ...
8
votes
2answers
580 views

Is a rand from glibc's rand secure for a login key?

Same question as Is a rand from /dev/urandom secure for a login key, but with glibc's rand function instead of /dev/urandom. And what would be a sufficiently secure seed generator?
8
votes
4answers
697 views

Hash(master + hostname) password scheme for a server pool

I manage about 20+ Linux servers and I am considering using an md5 scheme similar to following to generate the admin passwords: echo 'masterpassword' 'serverhostname' | md5sum Which returns ...
4
votes
3answers
886 views

Pseudo Random Generator is not initialized from the (entropy pool)?

The RHEL5 manuals state that /dev/urandom will use the entropy pool until it's exhausted, and then it will resort to a fall-back pseudo-random algorithm, so that it will never block. But when ...
3
votes
3answers
392 views

If the code to shuffle an array is known, is it possible for the randomized shuffle to stay secure?

I recently was looking at Poker shuffles that were hacked and made to be guessable within a reasonable degree and this was because of the weakness of the shuffles. Is it possible to make a shuffle ...
1
vote
2answers
715 views

How to generate a highly unpredictable random bytes

void vncRandomBytes(unsigned char *bytes) { int i; unsigned int seed = (unsigned int) time(0) + getpid() + rand(); srand(seed); for (i = 0; i < CHALLENGESIZE; i++) { bytes[i] = (unsigned ...
3
votes
2answers
2k views

/dev/random security holes

I'm doing some reading into the security issues surrounding /dev/random but it's proving to be hard to find good sources of information. Can anybody help? I've asked Google and got a bunch of articles ...
3
votes
1answer
1k views

Requirements for a secure session id?

I'm writing a web service which stores data which will be shared between two separate systems. /session/requestNewSession?args=<data> => returns session id ...
5
votes
1answer
972 views

Is this admin area secure enough? V2

This is a response to my previous question, Is this admin area secure enough?. There were some very helpful answers there, for which I am very grateful. So I went back to the drawing board and here ...
9
votes
2answers
564 views

Can I use hardware random number generation on my computer? Am I already using it?

A lot of computer security depends on encryption: SSL connections, TCP packet sequencing, encrypted files, etc. These depend on random number generation to ensure that attackers can't guess the ...
6
votes
2answers
754 views

How is the available entropy in /dev/random calculated (or estimated)?

It seems (to a non-expert) that /dev/random is acclaimed to be useable as a source of pure random data. However, I am curious as to the analysis of the file /dev/random. /dev/random is a collection ...

15 30 50 per page