[<prev] [next>] [day] [month] [year] [list]
Message-ID: <20120127011801.GA5887@openwall.com>
Date: Fri, 27 Jan 2012 05:18:01 +0400
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Subject: testing pwqgen
Hi,
I think we can and should use this list not only for discussing actual
vulnerabilities, but also for sharing information on what was audited,
tested, etc. even if found not vulnerable. Such information may be
helpful too.
In light of the pwgen vulnerability:
http://www.openwall.com/lists/oss-security/2012/01/17/5
http://www.openwall.com/lists/oss-security/2012/01/19/24
http://www.openwall.com/lists/oss-security/2012/01/22/6
I also tested our pwqgen (part of passwdqc) for (lack of) a similar
issue. Testing was easy with low random=... settings (like for 1 or 2
words), but I also wanted to test with our default settings (no options
on pwqgen's command line at all, which means 47 bits of randomness).
I happened to generate 466896327 such passwords (or phrases) until I
interrupted the script. Out of them, 779 appear twice and none more
than two times. Thus, 466895548 are unique.
For uniform distribution, the expectation is that we'll have about
466895552.5 unique passwords, or about 774.5 duplicates. The test
results match this pretty closely.
Of course, this heavily depends on the quality of /dev/urandom. I did
my testing on the same system where I had tested pwgen. This is an
8-core machine running Linux 2.6.18-274.3.1.el5.028stab094.3.owl1 (an
Owl revision/build of a RHEL5 branch OpenVZ kernel) for x86_64.
Alexander
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
