Kragen at inexorable:~/devel/inexorable-misc$. Generate a random, memorizable password: Just two days ago, Kragen Javier Sitaker posted a program to do this at (gone now - try ) This is not ultimately strong in all cases, but already very strong (it could be defeated with a budget which will be counted in months and billions of dollars, not mere millions). Thus, with 13 characters, you get 78 bits of entropy. With an alphabet of length 64, you get 6 bits of entropy per character (because 2 6 = 64).
Then, for each password character, get one byte from os.urandom(), reduce the value modulo 64 (this is unbiased because 64 divides 256) and use the result as index in your chars array.
letters (uppercase and lowercase), digits, and two extra punctuation characters (such as '+' and '/'). To make things simple: choose an alphabet of length 64, e.g. You should work with os.urandom() all along. Then you use it as seed in random, which is less good: that one is a non-cryptographic PRNG, and its output may exhibit some structure which will not register in a statistical measurement tool, but might be exploited by an intelligent attacker. For any practical purpose (even cryptography), the output of os.urandom() is indistinguishable from true alea. You use Python's os.urandom(): that's good. If the password is not meant to be remembered by a human being, then it is not really a password. The difficult thing with passwords is to make them strong enough and still be able to remember them.
0 kommentar(er)
