search

freitagbr / diceware

Command-line strong password generator
MIT License
0 stars 0 forks source link

Which dictionary does this use? #3

Open nfischer opened 6 years ago

nfischer commented 6 years ago

Does this use the 7776-word Diceware dictionary? If not, how big is the dictionary? Is it possible to just ship the Diceware dictionary along with the CLI tool?

Also, how many bits of entropy can we expect? If this uses the diceware dictionary, it would be good to quote their site's calculations for entropy; otherwise, it would be good to see your own calculations.

Related: could you document how this generates random numbers (and if that impacts security/entropy)? After all, from the FAQ:

I have an electronic dice throw generator. Should I use it?

No! Unless you know how the electronics generate the randomness and can evaluate its strength, stick to old-fashioned real dice.

freitagbr commented 6 years ago

The default dictionary is /usr/share/dict/words, which varies from system to system. The dictionary on my linux box has 99171 words by default, but the one on my mac has ~260000 words. You can pick a different dictionary file with -dict DICTIONARY. The dictionary file should be a newline-delimited list of words.

I haven't calculated the bits of entropy, and it really depends on the dictionary used. Perhaps several dictionaries could be included, and the dictionary used could be picked from the command line (Note to self, include a dictionary from this tool: http://app.aspell.net/create).

Random numbers are generated with crypto/rand, which is "cryptographically secure".