# entropy of FIPS-181 automated password generator

NIST recommends 80-bits for the most secure passwords

Is there any estimation of entropy for FIPS-181 automated password generator?
Recommended length?

erinthec
therglaz
denybier
taillass
alkhoray
malteake

• FIPS 181 is a standard that describes converting random bits into a pronounceable string. The passwords have as much entropy as the process originally used to generate those random bits. Mar 9, 2014 at 9:08
• Software that uses it prompts for number of characters. How long the password should be? Mar 9, 2014 at 9:34
• By my rough calculations based on reading the paper, a 16-character password should give you over 64 bits of entropy. By the paper itself, a 10-character password corresponds to around 41 bits of input entropy. Mar 9, 2014 at 20:44

Note that FIPS 181 is from 1993, which is ancient, in computer security terms. The paper doesn't say how much entropy the passwords have. It does say:

Approximately 18 million 6-character, 5.7 billion 8-character, and 1.6 trillion 10-character passwords can be created by the program.

The question is whether those passwords are all equally likely. And indeed the answer is no according to A New Attack on Random Pronounceable Password Generators.

But what that does give us is an upper bound on the entropy. log2(1.6e12) is 40.5, so the best you could hope for is about 40 bits of entropy with a 10-character FIPS 181 password. Stephen's calculation of 64 bits for 16 characters seems right, since this estimate amounts to about 4 bits of possible entropy per character, though again that would be an upper bound. 20 characters would max out at 80 bits of entropy.

It would be better to use something like the apg program, which include upper case, digits and special characters by default and you can ask for pronounceable passwords or not.

I looked at NIST SP 800-63-2 Electronic Authentication Guideline (Aug 2013) and didn't see anything like "NIST recommends 80-bits for the most secure passwords". It does set out lots of scenarios and conditions. I suggest reading it and applying it to your threat model.

RFC 4086 - Randomness Requirements for Security presents some example threat models and how to calculate the entropy desired for each one. The answers vary between 29 bits and 128 bits of entropy needed.