pwgen's seeding looks insecure

2007-01-10 Thread Andrew A. Khlebutin
Hello, Mon Jan 8 12:41:40 PST 2007 your wrote: Hmm.. it seems that the project hasn't been updated in eons (2001): http://sourceforge.net/projects/pwgen. I'll still try to get a hold of the dev, but I'm not sure if they are still administering the project. see here -

pwgen's seeding looks insecure

2007-01-08 Thread RW
Someone recently recommended sysutils/pwgen for generating user passwords. Out of curiosity I had a look at how it works, and I don't like the look of its PRNG initialization: #ifdef RAND48 srand48((time(0)9) ^ (getpgrp()15) ^ (getpid()) ^ (time(0)11)); #else srand(time(0) ^ (getpgrp() 8)

Re: pwgen's seeding looks insecure

2007-01-08 Thread Dan Nelson
In the last episode (Jan 08), RW said: Someone recently recommended sysutils/pwgen for generating user passwords. Out of curiosity I had a look at how it works, and I don't like the look of its PRNG initialization: #ifdef RAND48 srand48((time(0)9) ^ (getpgrp()15) ^ (getpid()) ^

Re: pwgen's seeding looks insecure

2007-01-08 Thread Garrett Cooper
On Jan 8, 2007, at 9:53 AM, RW wrote: Someone recently recommended sysutils/pwgen for generating user passwords. Out of curiosity I had a look at how it works, and I don't like the look of its PRNG initialization: #ifdef RAND48 srand48((time(0)9) ^ (getpgrp()15) ^ (getpid()) ^ (time(0)

Re: pwgen's seeding looks insecure

2007-01-08 Thread Garrett Cooper
On Jan 8, 2007, at 10:36 AM, Dan Nelson wrote: In the last episode (Jan 08), RW said: Someone recently recommended sysutils/pwgen for generating user passwords. Out of curiosity I had a look at how it works, and I don't like the look of its PRNG initialization: #ifdef RAND48

Re: pwgen's seeding looks insecure

2007-01-08 Thread Dan Nelson
In the last episode (Jan 08), Garrett Cooper said: On Jan 8, 2007, at 10:36 AM, Dan Nelson wrote: Even better: make RANDOM() call random() instead of rand(), and initialize the rng with srandomdev(). Another random password generator is in security/apg, and that one already uses

Re: pwgen's seeding looks insecure

2007-01-08 Thread RW
On Mon, 8 Jan 2007 10:42:12 -0800 Garrett Cooper [EMAIL PROTECTED] wrote: On Jan 8, 2007, at 9:53 AM, RW wrote: Someone recently recommended sysutils/pwgen for generating user passwords. Out of curiosity I had a look at how it works, and I don't like the look of its PRNG initialization:

Re: pwgen's seeding looks insecure

2007-01-08 Thread Garrett Cooper
Dan Nelson wrote: In the last episode (Jan 08), Garrett Cooper said: On Jan 8, 2007, at 10:36 AM, Dan Nelson wrote: Even better: make RANDOM() call random() instead of rand(), and initialize the rng with srandomdev(). Another random password generator is in security/apg, and that one

Re: pwgen's seeding looks insecure

2007-01-08 Thread Garrett Cooper
Garrett Cooper wrote: Dan Nelson wrote: In the last episode (Jan 08), Garrett Cooper said: On Jan 8, 2007, at 10:36 AM, Dan Nelson wrote: Even better: make RANDOM() call random() instead of rand(), and initialize the rng with srandomdev(). Another random password generator is in

Re: pwgen's seeding looks insecure

2007-01-08 Thread RW
On Mon, 8 Jan 2007 10:56:50 -0800 Garrett Cooper [EMAIL PROTECTED] wrote: On Jan 8, 2007, at 10:36 AM, Dan Nelson wrote: In the last episode (Jan 08), RW said: Someone recently recommended sysutils/pwgen for generating user passwords. Out of curiosity I had a look at how it works, and I