[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-Id: <D8208736-1731-4DD1-ADB0-71AB80FE9BB4@goldmark.org>
Date: Mon, 29 Apr 2013 01:05:30 -0500
From: Jeffrey Goldberg <jeffrey@...dmark.org>
To: crypt-dev@...ts.openwall.com
Subject: Representing the crack resistance of a password.
In a discussion on Twitter, Matt Weir has persuaded me that talking about the Shannon Entropy, H, of a password generation system doesn't get what we want. H doesn't capture appropriate facts about the distribution of passwords within the set of possible passwords.
The far more meaningful notion would be "what is the prob of an attacker cracking a pw under that policy after N guesses". This, as I now understand, is not in general computable from H. (It is computable from H when the distribution is uniform, but the whole point is that humans do not select passwords uniformly from some set.)
I asked how we should characterize, or even name, this notion. I tossed out
C(X, k) = 2 log_2 G(0.5, X, k)
where k is the key or password, X is this distribution, and G(p, X, k) is is the number of Guesses needed to hit k in X with probability p.
My idea is to have C(X,-) = H(X) when X is a uniform distribution.
Matt, however, thinks that that is not the direction to go in, and will probably be able to point out the error of my ways. But I'm presenting it anyway as starting point for discussion.
I've actually been drafting an article about this (well, about the non-randomness of humans and how this matters for considering password strength), and I would love to have some language for talking out this. Some way to talk about how crack resistant a password is.
Cheers,
-j
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
