CODEWITHSUNDEEP
securityrandompasswordsbrute-forceentropy
Jakub Bochenski
Jakub Bochenski

Reputation: 3277

Just how much (or little) entropy passwords generated in this way have

So I know generating a password in the following way is a bad idea. I'd say it has only a few (like maybe 5 or so) bits of entropy, but I'm unable to calculate it properly.

Can someone show me, how to calculate the average amount of tries needed to guess a password of length n generated in the following way using Oracle's JDK 7?

I assume the relevant factors are:

But I can't get the exact numbers.

char[] generate(int n) {
    char[] pw = new char[n];
    for (int i = 0; i < n; i++) {
        int c;
        while (true) {
            c = randomCharacter(c);
            if (c == '0' || c == 'O' || c == 'I' || c == '1' || c == 'l') 
                continue;
             else 
                break;
        }
        pw[i] = (char) c;
    }
    return pw;
}

int randomCharacter(int c) { 
    switch ((int) (Math.random() * 3)) {
    case 0:
        c = '0' + (int) (Math.random() * 10);
        break;
    case 1:
        c = 'a' + (int) (Math.random() * 26);
        break;
    case 2:
        c = 'A' + (int) (Math.random() * 26);
        break;
    }
    return c;
}

Upvotes: 0

Views: 132

Answers (1)

CL.
CL.

Reputation: 180162

Assuming that Math.random() is unpredictable, for the randomCharacter function, the probability of a specific digit being returned is 1/3 * 1/10, and of a letter, 1/3 * 1/52.

For entries in the pw array, some characters are invalid, so the remaining characters' probability becomes higher. You need to rescale the probabilities so that the sum again becomes 1, i.e., divide by the sum of the remaining probabilities. The result is that a digit has the probability 1/3 * 1/10 / (8 * 1/3 * 1/10 + 47 * 1/3 * 1/52), and a letter, 1/3 * 1/52 / (8 * 1/3 * 1/10 + 47 * 1/3 * 1/52).

Plugging all these values in the formula for the Shannon entropy gives the result of about 5.7 bits of entropy per character.

If you would use a single array of the 57 valid characters, and use a single random number to index it, you would get an entropy of about 5.8 bits per character.

Upvotes: 1

Related Questions