search

anakod / flipper_passgen

Flipper Zero Password Generator
MIT License
52 stars 10 forks source link

DRAFT: Remove bias and clarify use of TRNG #4

Closed henrygab closed 1 year ago

henrygab commented 1 year ago

Fixes #2

Tested and works.

  1. Remove existing bias towards characters earlier in the allowed alphabet. This is done by dynamically determining the maximum integral multiple value in a char, and excluding TRNG data that is outside the range.

  2. Avoids calls to rand() because that is (normally) not cryptographically random.

  3. No new memory allocations are used.

  4. Every call to furi_hal_random_get() takes a semaphore and re-initializes the TRNG hardware. This is inefficient and slower than using furi_hal_random_fill_buf().

  5. Iteratively call furi_hal_random_fill_buf() until the required password length is filled with valid (unbiased) characters.

  6. Overwrite password buffer when free'ing state. Again ... just good security hygiene.

  7. CI enabled -- automatic build via official ufbt GitHub Action ... FAP is built by GitHub!

henrygab commented 1 year ago

Something's odd about the PR ... will close/reopen new one.