5

I found the pwgen Linux utility that seems to provide easily-rememberable and reasonably secure passwords. But the man page says :

The pwgen program generates passwords which are designed to be easily memorized by humans, while being as secure as possible.
Human-memorable passwords are never going to be as secure as completely completely random passwords. In particular, passwords generated by pwgen without the -s option should not be used in places where the password could be attacked via an off-line brute-force attack.

Does using one of those pwgen passwords generated with default settings pose a real security risk, in the case of a brute-force attack ? Is it possible to work around the limitation by setting a bigger password size, like pwgen -n 13 ?

My use cases are mostly my password manager, local Linux user account, and Full Disk Encryption, all of which requiring brute-force-resistant passwords.

1

It's somewhat hard to quantify what is a 'real security risk'. A password created with pwgen defaults (all lowercase letters, 8 in length) stored using a fast hash (MD5 or SHA1) could be offline brute-force cracked with a single modern GPU in anywhere from a few minutes (just trying lowercase) up to around 9 days against all characters (trying lowercase, uppercase, numbers, symbols). If this same password is stored using a stronger hashing algorithm (scrypt, bcrypt, argon2, etc.) then it might be cracked using a brute-force against only lowercase letters but probably not by a full brute force against all characters (because it would take too long).

Your password manager and disk encryption should be using these slower hashing algorithms for key derivation. With online accounts you often don't know what type of hashing they implemented so the safe bet is to assume fast hashes.

By my estimates, moving to a minimum password length of 11 characters for slow hashes and a minimum of 14 characters for fast hashes should help offset the weakness of using passwords constructed with only lowercase characters. You can quickly increase strength by adding more length as your memory (or password policies) allow.

I will caution that these estimates assume attackers must use brute-force attacks (even if against a restricted selection of characters, like lowercase) to guess your password. My understanding of pwgen is that, by default, it doesn't randomly create the passwords and instead attempts to structure them in a more memory friendly arrangement of consonants and vowels. This probably causes a significant reduction in the number of possible passwords out of the total pool of lowercase random passwords.

So theoretically an attacker could identify only the possible passwords generated by pwgen and target those in their password cracking attempts to save time. If this pool of pwgen passwords is 15% of the total lowercase possibilities (I have no idea what it actually is) then 11 characters would probably not be a sufficient minimum length. You'd need to go with a 12 characters minimum, adding more characters to satisfy your particular paranoia and future-proofing preferences.

  • I think you kind of sidestepped OPs question. Because the passwords generated by pwgen are indeed not completely random. The question now becomes how not-random they are. The documentation doesn't really talk about how they are generated, and I haven't looked at the source code, but the developers seem to think it's insecure enough to warn against using it for important passwords at all, no matter the length (your suggested 12 characters seems rather low to me, but recommending a better length is difficult without knowing how exactly pwgen works). – tim Sep 18 '16 at 20:14
  • @tim I didn't sidestep OP's question. They wanted to know about 'real security risks', which in my mind involves how an attacker is likely to attempt to crack their password. Unless an attacker specifically knows Ydob is using pwgen they're not going to try to optimize their attack against pwgen passwords. I do agree that the unknown here is just how bad it would be if an attacker does attempt to focus on cracking only pwgen formatted passwords. – PwdRsch Sep 18 '16 at 20:31
  • I wouldn't make the assumption that an attacker doesn't know the generation method. pwgen is one of the first results when searching for how to generate passwords with linux, and OP did post a question about using it here :) But even if we do assume that the method is unknown, the question is still how secure the passwords are.My guess would be that eg the incremental mode of jtr would deal a lot better with these passwords than with random passwords. But without knowing how pwgen actually generates passwords it's difficult to tell if it is secure, or how long passwords need to be to be secure – tim Sep 18 '16 at 20:42
  • OK, looking at your estimations, I guess I can trash the default easy-to-read passwords. I'll go with the -s option. Thank you ! Still, would be interesting to read the source code and estimate the security of the defaults. – Elzo Sep 19 '16 at 17:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.