> -----Original Message----- > From: open-iscsi@googlegroups.com [mailto:open-is...@googlegroups.com] > On Behalf Of Ulrich Windl > Sent: Wednesday, December 16, 2009 1:08 PM > To: open-iscsi@googlegroups.com > Subject: Re: minimum password length check > > On 15 Dec 2009 at 22:47, shyam_i...@dell.com wrote: > > > From the spec: > > " > > CHAP secrets MUST be an integral number of bytes (octets). A > > compliant implementation SHOULD NOT continue with the login step > in > > which it should send a CHAP response (CHAP_R, Section 11.1.4 > > Challenge Handshake Authentication Protocol (CHAP)) unless it can > > verify that the CHAP secret is at least 96 bits, or that IPsec > > encryption is being used to protect the connection. > > " > > You picked up an "interesting" issue: The Microsoft Initiator limits > the length of > the secret to 16 characters (AFAIR). I wrote a lottle program that > generates > random secrets and estimated the entropy (i.e. number of bits): > > With 16 random letters, you are at about 92 bits (e.g. mMPuhxfKAYuIFTjZ) > With 16 random letters with digits you are at about 95 bits (e.g. > b3v4B8mRoiFWjpF9) >
What algorithm are you using to arrive at this ... Googling(and some of my information theory lit..) almost always hints me to shannon's theorem to find the randomness of a character string ... Check this http://www.redkestrel.co.uk/Articles/RandomPasswordStrength.html -- You received this message because you are subscribed to the Google Groups "open-iscsi" group. To post to this group, send email to open-is...@googlegroups.com. To unsubscribe from this group, send email to open-iscsi+unsubscr...@googlegroups.com. For more options, visit this group at http://groups.google.com/group/open-iscsi?hl=en.
