Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Entropy calculation on website doesn't match tool #32

Open
dgrant opened this issue Jun 29, 2017 · 1 comment
Open

Entropy calculation on website doesn't match tool #32

dgrant opened this issue Jun 29, 2017 · 1 comment

Comments

@dgrant
Copy link

dgrant commented Jun 29, 2017

The following config says 61 bits with full-knowledge on https://xkpasswd.net/ but when I run locally I get WARNING - Crypt::HSXKPasswd::_update_entropystats_cache(): for attacks assuming full knowledge, the combination of the loaded config and dictionary produces an entropy of 33bits, below the minimum recommended 52bits at /usr/local/bin/hsxkpasswd line 448

{
"num_words": 3,
"word_length_min": 4,
"word_length_max": 8,
"case_transform": "RANDOM",
"separator_character": "-",
"padding_digits_before": 0,
"padding_digits_after": 0,
"padding_type": "NONE"
}
@frei0
Copy link

frei0 commented Oct 23, 2017

Seems to be if you choose case_transform: RANDOM, you get double the entropy, when you should really only get num_words more bits of entropy. XKCD config should be 44 bits, not 80 bits.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants