[talk] passwd entropy and strength

[James]

On Sun, Nov 5, 2017 at 11:32 AM, George Rosamond
<george at ceetonetechnology.com> wrote:
> This is something I've tinkered with for a long while, and thought I'd
> raise it on talk@ even though it's a bit OT from BSD land.
>
> Looking for feedback/correction on my argument here.
>
> I toyed a bit with the xkcd passwds... the well-known https://xkcd.com/936/.
>
> The passwords in question are:
>
> Tr0ub4dor &3 (aka "Tr0")
>
> versus
>
> correct horse battery staple (aka "correct")
>
> There is a unix program called ent in all BSD ports
> (https://www.fourmilab.ch/random/) which calculates entropy with a bunch
> of different measurements.  I fully don't understand all the tests, but
> I generally look at the first one "Entropy" which is bits of entropy per
> byte, ie, how much entropy/randomness per digit. So if you have a five
> digit passwd and 3 bits of entropy per byte, the passwd entropy would be
> 5 digits X 3 bits of entropy per byte = 15 bits of entropy.  I think
> that's correct.
>
> Now the first Tr0... passwd has 3.546... bits per byte, and the second
> correct... has 3.590... Therefore:
>
> Tr0.. 3.546 x 12 digits (including space) and is 42.48 bits of entropy
>
> correct... 3.590 x 28 digits and is 100.5 bits of entropy
>

Hi,

I don't think that you can multiply the entropy per byte by the
length of password to get those values for total entropy of the
password and then compare them.

Eg. If you were to look at the entropy at the bit level would you
expect the same values?

Let's try:

$ echo -n Tr0ub4dor \&3|ent -b # :D
Entropy = 0.984604 bits per bit.

Optimum compression would reduce the size
of this 96 bit file by 1 percent.

Chi square distribution for 96 samples is 2.04, and randomly
would exceed this value 15.30 percent of the times.

Arithmetic mean value of data bits is 0.4271 (0.5 = random).
Monte Carlo value for Pi is 4.000000000 (error 27.32 percent).
Serial correlation coefficient is -0.021729 (totally uncorrelated = 0.0).
$ bc
0.984604 * 96
94.521984

So does the Tr0 password have 94.521984 or 42.48?

Actually, there is a small algebraic potatoe here:
Going over your calculations I think you have included
the newline in the password entropy calculation.

I hope this is constructive:


$ echo -n Tr0ub4dor \&3|ent # :D
Entropy = 3.418296 bits per byte.

Optimum compression would reduce the size
of this 12 byte file by 57 percent.

Chi square distribution for 12 samples is 286.67, and randomly
would exceed this value 8.42 percent of the times.

Arithmetic mean value of data bytes is 79.9167 (127.5 = random).
Monte Carlo value for Pi is 4.000000000 (error 27.32 percent).
Serial correlation coefficient is 0.051733 (totally uncorrelated = 0.0).
$ echo Tr0ub4dor \&3|ent # :D
Entropy = 3.546594 bits per byte.

Optimum compression would reduce the size
of this 13 byte file by 55 percent.

Chi square distribution for 13 samples is 282.38, and randomly
would exceed this value 11.49 percent of the times.

Arithmetic mean value of data bytes is 74.5385 (127.5 = random).
Monte Carlo value for Pi is 4.000000000 (error 27.32 percent).
Serial correlation coefficient is 0.126675 (totally uncorrelated = 0.0).
$



Cheers,
James



>
> _______________________________________________
> talk mailing list
> talk at lists.nycbug.org
> http://lists.nycbug.org/mailman/listinfo/talk