In computing, entropy is the randomness collected by an operating system or application for use in cryptography or other uses that require random data. This randomness is often collected from hardware sources, either pre-existing ones such as mouse movements or specially provided randomness ...
3
votes
2answers
131 views
Computing entropy for a passphrase ( minimal word length … )
Edit: 2013-05-17
After reading first answer from Tom Leek and some docs around the web, I've begin to write some options to my tool genpassphrase.pl:
$ ./genpassphrase.pl -h
Usage: genpassphrase.pl ...
44
votes
11answers
6k views
How reliable is a password strength checker?
I've tested the tool from Microsoft available here which tests password strength and rates them. For a password such as "i am going to have lunch tonight", the tool rates it's strength as "BEST" and ...
3
votes
3answers
362 views
Pseudo Random Generator is not initialized from the (entropy pool)?
The RHEL5 manuals state that /dev/urandom will use the entropy pool until it's exhausted, and then it will resort to a fall-back pseudo-random algorithm, so that it will never block.
But when ...
31
votes
41answers
3k views
What is your way to create good passwords that can actually be remembered?
What are the methodologies which can be used to generate "human" good quality password?
They have to ensure a good strength and also easy to remember for a human being.
3
votes
1answer
69 views
PHP - Serializing user inputs
My entropy gathering system works by serializing user inputs:
$entropy=sha1(microtime().$pepper.$_SERVER['REMOTE_ADDR'].$_SERVER['REMOTE_PORT'].
...
15
votes
6answers
537 views
Is there additional security value in using passwords with words or phrases in non-English languages?
I was thinking about correct horse battery staple. I am not a native English speaker. In my language, the above could be written as:
vqrno kon bateriq telbod OR
вярно кон батерия телбод.
Keep in ...
6
votes
3answers
284 views
Is there a length beyond which increasing password length provides no additional security?
Assuming that the password is stored hashed and salted, and that it is a string of random characters, is there a point where adding to password length doesn't add security?
Since the hash will have a ...
371
votes
20answers
57k views
XKCD #936: Short complex password, or long dictionary passphrase?
How accurate is this XKCD comic from August 10, 2011?
XKCD 936: Password Strength
I've always been an advocate of long rather than complex passwords, but most security people (at least the ones ...
3
votes
3answers
191 views
For how much time should I randomly move the mouse for generating encryption keys?
When creating a Truecrypt volume, there is the wizard page in which the user is told to randomly move the mouse (the longer the better) to generate entropy, and that it will significantly increase the ...
12
votes
3answers
225 views
What statistics can be used to identify pseudorandom data?
I'm working on some code that attempts to identify files whose contents appear to be "random". As such, I'm looking for statistical measures that can be used to identify such randomness.
I've ...
3
votes
1answer
170 views
How genuine are password entropy calculations?
I apologise for perhaps the confusing title, I'll try and elaborate a little better.
Many discussions I see surrounding password entropy focus on the specific context of the range of choices ...
9
votes
3answers
983 views
Why are passwords limited to 16 characters?
What is the reason that most websites limit to 16 characters?
I would have thought the longer the password the more difficult it makes it for someone to crack it?
Is it something to do with hash ...
25
votes
9answers
3k views
How long should the password be?
The minimum password length recommended is about 8 characters, so is there any standard/recommended maximum length of the password?
1
vote
3answers
446 views
Recompute Rainbow table with salt?
So, as I understand it, you prepend a password with salt before you hash it so that the resulting hash can't be used with a rainbow table to find the original password, as you could if the password ...
-1
votes
6answers
279 views
Using passwords made of words
People say don't use passwords in the dictionary but if you use two words isn't it alright? Dictionaries have at least 10,000 entries so just two words will be 100,000,000 possibilities (and that's ...
16
votes
4answers
524 views
In hashing, does it matter how random a salt is?
I recently had a comment made to me in an online discussion after I'd stated that randomness in a salt doesn't matter -- and I got the following response:
Salts may not have to be "secure," but ...
-2
votes
6answers
337 views
Are passwords made up from concatenating a few foreign words better than shorter random characters?
Does it make sense to insert a foreign word into a paraphrase to mitigate against brute force? For example:
"pussiMeansCatInEskimo"
"caballoMeansHorse"
"CatIsGatto"
"SalopeMeansBitch"
...
5
votes
2answers
193 views
How is the available entropy in /dev/random calculated (or estimated)?
It seems (to a non-expert) that /dev/random is acclaimed to be useable as a source of pure random data. However, I am curious as to the analysis of the file /dev/random.
/dev/random is a collection ...
11
votes
4answers
2k views
Google Account: implications of using application-specific passwords
In the wake of the recent Mat Honan story I decided to try out two-factor authentication on my Google account. But in order to keep using it with Exchange, the Android OS, Google Talk and Google ...
10
votes
3answers
458 views
Does the salt need to be unique or not predictable?
I always thought that salts is simply used to prevent rainbow tables to be used. Other have suggest they should be unique on a per account basis. Currently i have been using a config file to use as ...
1
vote
2answers
213 views
Password entropy match for alphanumeric but there are special characters in password
I have a problem cracking some of the fundamentals on passwords' entropies. Namely: I have read this article about a guy cracking DKIM of Google (maybe more noticing that the keys are only 512 bits)
...
10
votes
3answers
419 views
Is a predictable MAC address a risk?
If you knew from the public internet that a certain IP address belonged to a machine with a certain MAC address, can you see any security exposure associated with that? I know that some software will ...
10
votes
3answers
1k views
Confused about (password) entropy
There seem to be many different 'kinds' of entropy. I've come across two different concepts:
A) The XKCD example of 'correcthorsebatterystaple". It has 44 bits of entropy because four words randomly ...
3
votes
3answers
614 views
Calculating complex password entropy?
Whenever I look at password entropy, the only equation I ever see is E = log2(R)*L, or alternatively E = log2(R^L), where E is password entropy, R is the range of available characters, and L is the ...
5
votes
6answers
606 views
Does having a minimum number of digits improve password security?
Some password systems will enforce at least X of a type of character - a common one I see is 'minimum 3 numeric characters'. As far as I understand, simply allowing certain character classes, like ...
12
votes
2answers
510 views
Are there some good papers (or discussions) on using Markov chains or Hidden Markov Models for password auditing/cracking?
As a programmer and language enthusiast I've been very interested in Markov chains for some time. Considering the influence of natural language on password and passphrase selection (by humans of ...
3
votes
3answers
184 views
When changing a password, does it have to be completely different?
When changing a password how important is it to have a significantly different one? For example is it bad to reverse the sequencing of the old password to make a new one or change a few numbers?
4
votes
3answers
272 views
password complexity policy for non “English” passwords
In an internationalized application, what is the best practice for a policy on complexity of passwords? I am not having luck searching for the answer. Wikipedia lists these items for password ...
2
votes
4answers
204 views
If the attacker knows part of the password but not the length, does that help him in any way?
The idea behind this is that if knowing part of the password and not the length is useless, "passwords" can be easily stored in cleartext or paper since you would just add your own n characters ...
30
votes
8answers
1k views
Why do password strength requirements exist?
Password strength is now everything, and they force you to come up with passwords with digits, special characters, upper-case letters and whatnot. Apart from being a usability nightmare (even I as a ...
4
votes
3answers
164 views
What would the cryptographic impact be of knowing the output of /dev/urandom?
Another noob question, I know, but something I'm unsure about.
If I somehow magically knew the output of /dev/urandom at any given time, how much would that weaken a given encryption system? Or, ...
15
votes
3answers
458 views
If I have two identical linux virtual machine images, will they generate identical random numbers?
A really noob question, I know, but something I was wondering about this morning. If this were the case, would they encrypt things identically?
Or maybe someone could direct me to a helpful research ...
2
votes
1answer
126 views
How to estimate the number of entropy bits & search space of a signature system like passtouch?
Apologies if I'm using the wrong lexicon, I'm just reading up about password systems out of interest.
After seeing the xkcd strip on passphrases and coming across the passtouch system (youtube demo) ...
2
votes
1answer
272 views
Does client certificate authentication demand more server-side entropy?
We have a secure web service running Apache that requires client certificates for access. This service has a problem with running out of entropy. We have several other sites that use TLS that get ...
5
votes
1answer
118 views
General purpose slow/unique hash routine for dup checking of private data, without storing the data itself?
I am wondering if there is a percentage of uniqueness known to be lost with every repeat of various hash routines, like MD5, SHA1, and how that might compare with other algorithms.
If theoretically I ...
7
votes
1answer
2k views
Can a dictionary attack crack a Diceware passphrase?
Everyone knows the words used in Diceware passwords (all 6^5 = 7776 words are published) -- they're all common words.
Everyone seems to know that we're not supposed to use dictionary words for ...
3
votes
2answers
958 views
/dev/random security holes
I'm doing some reading into the security issues surrounding /dev/random but it's proving to be hard to find good sources of information. Can anybody help? I've asked Google and got a bunch of articles ...
6
votes
4answers
911 views
Password entropy in layman's terms
Entropy is a term used often in relation to password security and brute-force attacks, but it is a topic that can get complicated quickly. What is the best way to describe password entropy (what it is ...
5
votes
2answers
549 views
How should I make diceware passphrases more memorable?
I find that truly random diceware passphrase, more often than not, either contain a word that is easily misspelled or has an order that is illogical. I think there are three ways to make a diceware ...
11
votes
2answers
602 views
Evaluating the entropy gathering in a PRNG
I'm reviewing the random number generator (expected to be of cryptographic quality) on an embedded device. My point of view here is the operating system and crypto library implementer. I'm ...
13
votes
2answers
542 views
How does varying character type increase strength of password?
When creating a new password, people often recommend you use both uppercase and lowercase characters, numbers, and symbols. How does adding any of these increase the strength of a password?
There ...
13
votes
2answers
636 views
How can we accurately measure a password entropy range?
I've given myself the task of writing code that determines the strength of a password, and really want to break out of a lot of already established ways we do that, as they're often lacking, not ...
