search

trichards57 / zxcvbn-cs

C#/.NET port of Dan Wheeler/DropBox's Zxcvbn JS password strength estimation library
MIT License
59 stars 18 forks source link

Crack times calculations mismatch #24

Closed cearprm closed 3 years ago

cearprm commented 3 years ago

Thanks for the recent updates. I think there is an issue with the crack time estimates though. The calculations don't match up with zxcvbn-ts:

zxcvbn-cs

var crackTimesSeconds = new CrackTimes
{
    OfflineFastHashing1e10PerSecond = guesses / (100.0 / 3600),
    OfflineSlowHashing1e4PerSecond = guesses / 10,
    OnlineNoThrottling10PerSecond = guesses / 1e4,
    OnlineThrottling100PerHour = guesses / 1e10,
};

zxcvbn-ts

const crackTimesSeconds: CrackTimesSeconds = {
  onlineThrottling100PerHour: guesses / (100 / 3600),
  onlineNoThrottling10PerSecond: guesses / 10,
  offlineSlowHashing1e4PerSecond: guesses / 1e4,
  offlineFastHashing1e10PerSecond: guesses / 1e10,
}
trichards57 commented 3 years ago

Ah, good spot. Definitely wrong. Update on it's way in now.