Re: [fossil-users] OT: security/entropy (was Re: New Fossil user experiences)

2018-07-15 Thread Warren Young
On Jul 15, 2018, at 8:47 AM, Joerg Sonnenberger wrote: > > On Sat, Jul 14, 2018 at 05:24:26PM -0600, Warren Young wrote: >> On Jul 14, 2018, at 2:18 PM, Joerg Sonnenberger wrote: >>> >>> On Fri, Jul 13, 2018 at 03:27:14PM -0600, Warren Young wrote: For example, 100 a’s requires a

Re: [fossil-users] OT: security/entropy (was Re: New Fossil user experiences)

2018-07-14 Thread Warren Young
On Jul 14, 2018, at 2:18 PM, Joerg Sonnenberger wrote: > > On Fri, Jul 13, 2018 at 03:27:14PM -0600, Warren Young wrote: >> >> For example, 100 a’s requires a 7-bit run-length plus zero bits for our >> only code point > > You need more than zero bits to encode the original a though. There’s

Re: [fossil-users] OT: security/entropy (was Re: New Fossil user experiences)

2018-07-14 Thread Richard Hipp
On 7/14/18, Joerg Sonnenberger wrote: > If you can take the output > of any modern CPRNG as hex and don't get 4bpc, the entropy estimator is > broken. I've always understood the output of entropy estimators to me "the entropy is no greater than this", which is somewhat easier to define, since

Re: [fossil-users] OT: security/entropy (was Re: New Fossil user experiences)

2018-07-14 Thread Joerg Sonnenberger
On Fri, Jul 13, 2018 at 02:49:52PM -0700, Jungle Boogie wrote: > On Fri 13 Jul 2018 4:22 PM, David Mason wrote: > > So I guess this is what Warren had in mind. Posting this in case it helps > > somebody on the list. > > > > Taking this offtopic a little bit more...let's talk about VPNs. > >

Re: [fossil-users] OT: security/entropy (was Re: New Fossil user experiences)

2018-07-14 Thread Joerg Sonnenberger
On Fri, Jul 13, 2018 at 03:27:14PM -0600, Warren Young wrote: > On Jul 13, 2018, at 3:13 PM, Warren Young wrote: > > > > Now paste in an equivalent number of ‘a’ characters, and you get 0 bits of > > entropy. Strictly speaking, you get 1 bit of entropy for the whole > > message, but it shows

Re: [fossil-users] OT: security/entropy (was Re: New Fossil user experiences)

2018-07-13 Thread Jungle Boogie
On Fri 13 Jul 2018 4:22 PM, David Mason wrote: > So I guess this is what Warren had in mind. Posting this in case it helps > somebody on the list. > Taking this offtopic a little bit more...let's talk about VPNs. Don't use PPTP and don't get tangled up in ipsec configuration hell. Be happy

Re: [fossil-users] OT: security/entropy (was Re: New Fossil user experiences)

2018-07-13 Thread Warren Young
On Jul 13, 2018, at 3:13 PM, Warren Young wrote: > > 2. Add a dollar sign to the message, and bpc goes up a bit. (This conflicts > with your report that adding a special character didn’t change it, but it did > for me.) I just realized where the discrepancy comes from: you *replaced* one

Re: [fossil-users] OT: security/entropy (was Re: New Fossil user experiences)

2018-07-13 Thread Warren Young
On Jul 13, 2018, at 3:13 PM, Warren Young wrote: > > Now paste in an equivalent number of ‘a’ characters, and you get 0 bits of > entropy. Strictly speaking, you get 1 bit of entropy for the whole message, > but it shows 0 because the calculator is rounding the result off to 3 > significant

Re: [fossil-users] OT: security/entropy (was Re: New Fossil user experiences)

2018-07-13 Thread Warren Young
On Jul 13, 2018, at 2:22 PM, David Mason wrote: > > Acgq75VpCWjdsJaa5abe9JeX3I (don't worry, this isn't a real password to > anything) > > …I fed this through an online entropy calculator and got 4.29 bits of Shannon > entropy That calculator is giving you bits *per character*. You can

[fossil-users] OT: security/entropy (was Re: New Fossil user experiences)

2018-07-13 Thread David Mason
I use a password generator of my own design - basically takes the userid, concatenated with a fairly long secret phrase, and then I do SHA1 and convert it to base64, giving a password like: Acgq75VpCWjdsJaa5abe9JeX3I (don't worry, this isn't a real password to anything) After Warren's comment