Package Details: correcthorse-git 1.0.r23.g2a214af-4

Git Clone URL: https://aur.archlinux.org/correcthorse-git.git (read-only, click to copy)
Package Base: correcthorse-git
Description: Passphrase generator based on https://xkcd.com/936/
Upstream URL: https://github.com/rmartinjak/correcthorse
Licenses: WTFPL
Conflicts: correcthorse
Provides: correcthorse
Submitter: None
Maintainer: TrialnError
Last Packager: TrialnError
Votes: 0
Popularity: 0.000000
First Submitted: 2012-06-09 14:06 (UTC)
Last Updated: 2022-02-27 22:02 (UTC)

Latest Comments

MarsSeed commented on 2022-02-25 23:02 (UTC)

GitHub is discontinuing git:// protocol access by mid-March.

Please kindly update source array to use git+https:// as protocol.

TrialnError commented on 2017-04-10 22:54 (UTC)

Forgot to mention, that the latest update on this PKGBUILD replaces the PRNG at whole. At least the mentioned issue should be gone.

TrialnError commented on 2017-04-04 00:27 (UTC) (edited on 2017-04-04 01:58 (UTC) by TrialnError)

Added a patch which address the timing issue. But it is still _the same PRNG (pseudo random number generator)_ and as I don't know what math is behind this one it could be still rather insecure (all depends if someone can get the used seed). Dinghy, do you intend to take it upstream? As a side note, I will take a further look into using other RNGs (like the one provided by gsl or pcg) Edit: all I can tell is, the gsl doc mentions unix rand and notes it doesn't provide high quality randomness. So it should be replaced (especially since a chacha based rng is used to feed a weaker one...)

dinghy commented on 2017-02-09 22:56 (UTC)

Careful! This software does use actual randomness. The correcthorse algorithm needs perfect randomness and non-reproducibility to create secure passwords (as does any password generator, in fact). But THIS IMPLEMENTATION by rmartinjak HAS A FLAW: successive commands within about a second generate the same password. This implementation is therefore time-based and not making use of /dev/(u)random. Proof: the following is [ENTER]+[UP] as fast as possible. ~  correcthorse goneededpurposewhy ~  correcthorse unusualgovernmentgirlyesterday ~  correcthorse unusualgovernmentgirlyesterday ~  correcthorse unusualgovernmentgirlyesterday ~  correcthorse unusualgovernmentgirlyesterday ~  correcthorse unusualgovernmentgirlyesterday ~  correcthorse weakhispleasantthey ~  correcthorse weakhispleasantthey ~  correcthorse weakhispleasantthey ~  correcthorse weakhispleasantthey ~  correcthorse weakhispleasantthey ~  correcthorse johnnyparallelrecognizenumeral