Timeline for What security considerations are there when developing a random password generator?
Current License: CC BY-SA 3.0
8 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| May 2, 2017 at 19:53 | comment | added | browly | Thanks for the link to the new EFF Diceware list. I had been using the old Diceware list to generate passwords for people at work and they were usually too vulgar or too creepy. | |
| Mar 17, 2017 at 14:28 | vote | accept | the_endian | ||
| Mar 15, 2017 at 13:49 | comment | added | Lie Ryan | All this means is that the encoding simply needs to be a one-to-one (injective) function, from the CSPRNG output domain to the password system's input domain. It's not the role of the CSPRNG to understand what the password system would accept, the CSPRNG is simply a source of random bits. | |
| Mar 15, 2017 at 13:48 | comment | added | Lie Ryan |
No, the role of CSPRNG is to produce an extremely large n-bit number (i.e. a bitstream), where n is your password's bit strength. This huge number is your "real" password. The role of the encoding algorithm is to convert that huge number to something you can type, copy paste, possibly memorize, and which the password system could accept. What you want to avoid during encoding is causing entropy losses, which filtering/rejecting inputs and producing rejectable passwords would. You don't need to add entropy in the encoding step as the CSPRNG already produced all the entropy you need.
|
|
| Mar 15, 2017 at 3:40 | comment | added | the_endian | So, essentially, the algorithm should be designed so that whatever the CSPRNG gives us is fully accepted by the system? If there are limitations on what is an acceptable password, then that should ideally be handled as part of the original CSPRNG mechanism rather than taking its output and then further filtering it with non-crypto-secure functions, which would reduce the entropy, thus defeating the purpose of the CSPRNG? ANd if this is not possible, we need a 1 to 1 encoding function which preserves the entropy | |
| Mar 15, 2017 at 2:29 | history | edited | Lie Ryan | CC BY-SA 3.0 |
added 12 characters in body
|
| Mar 15, 2017 at 2:22 | history | edited | Lie Ryan | CC BY-SA 3.0 |
added 602 characters in body
|
| Mar 15, 2017 at 2:13 | history | answered | Lie Ryan | CC BY-SA 3.0 |