Giters

bbusschots / hsxkpasswd

A Perl module and terminal command for generating secure memorable passwords inspired by the fabulous XKCD web comic and Steve Gibson's Password Hay Stacks. This is the library that powers www.xkpasswd.net

Home Page:http://www.bartb.ie/xkpasswd

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Entropy calculation on website doesn't match tool

dgrant opened this issue · comments

commented

The following config says 61 bits with full-knowledge on https://xkpasswd.net/ but when I run locally I get WARNING - Crypt::HSXKPasswd::_update_entropystats_cache(): for attacks assuming full knowledge, the combination of the loaded config and dictionary produces an entropy of 33bits, below the minimum recommended 52bits at /usr/local/bin/hsxkpasswd line 448

{
"num_words": 3,
"word_length_min": 4,
"word_length_max": 8,
"case_transform": "RANDOM",
"separator_character": "-",
"padding_digits_before": 0,
"padding_digits_after": 0,
"padding_type": "NONE"
}
commented

Seems to be if you choose case_transform: RANDOM, you get double the entropy, when you should really only get num_words more bits of entropy. XKCD config should be 44 bits, not 80 bits.