Package Details: correcthorse 1.0-6

Git Clone URL: https://aur.archlinux.org/correcthorse.git (read-only)
Package Base: correcthorse
Description: Passphrase generator based on https://xkcd.com/936/
Upstream URL: https://github.com/rmartinjak/correcthorse
Licenses: WTFPL
Submitter: None
Maintainer: TrialnError
Last Packager: TrialnError
Votes: 10
Popularity: 0.000003
First Submitted: 2012-06-09 14:07
Last Updated: 2018-02-01 23:41

Dependencies (1)

Required by (0)

Sources (2)

Latest Comments

TrialnError commented on 2017-04-10 22:54

Forgot to mention, that the latest update on this PKGBUILD replaces the PRNG at whole. At least the mentioned issue should be gone.

TrialnError commented on 2017-04-04 00:42

Like with the -git packages.
The added patch does only address the use of time() with the PRNG.
It is still the _same PRNG_, so propably still not enough to make this a good password generator (as I currently don't know what this PRNG uses).
I will take a look into updating the source to use more secure (P)RNG.

Regarding the pending requests. I let the people decide with more insight.

Edit: all I can tell is, the gsl doc mentions unix rand and notes it doesn't provide high quality randomness. So it should be replaced (especially since a chacha based rng is used to feed a weaker one...)

TrialnError commented on 2017-04-03 23:30

It's clearly visible from the source, that this program is time based.
It uses the pseudo generator from stdlib and initialises srand() with time(). So yes, very valid point.
Did you take it upstream? I could propably add a patch which uses genrandom() from glibc-2.25 to intialize the pseudo (maybe not the greatest solution), or completly replace it with something from gsl, said function from glibc-2.25, or maybe pcg?
But I would first wait what the response of upstream is

Edit: Further thinking about it. Well. Hastily patching isn't that bad. But I can only say the seed for srand will be random. Still the same pseudo rng at work

dinghy commented on 2017-02-09 22:55

Careful! This software does use actual randomness. The correcthorse algorithm needs perfect randomness and non-reproducibility to create secure passwords (as does any password generator, in fact).
But THIS IMPLEMENTATION by rmartinjak HAS A FLAW: successive commands within about a second generate the same password. This implementation is therefore time-based and not making use of /dev/(u)random.
Proof: the following is [ENTER]+[UP] as fast as possible.
~  correcthorse
goneededpurposewhy
~  correcthorse
unusualgovernmentgirlyesterday
~  correcthorse
unusualgovernmentgirlyesterday
~  correcthorse
unusualgovernmentgirlyesterday
~  correcthorse
unusualgovernmentgirlyesterday
~  correcthorse
unusualgovernmentgirlyesterday
~  correcthorse
weakhispleasantthey
~  correcthorse
weakhispleasantthey
~  correcthorse
weakhispleasantthey
~  correcthorse
weakhispleasantthey
~  correcthorse
weakhispleasantthey
~  correcthorse
johnnyparallelrecognizenumeral

Anonymous comment on 2012-06-09 15:40

@josephgbr: You're right. I removed the unneeded junk

rafaelff commented on 2012-06-09 14:45

A software from xkcd idea - lol!
My 2 cents: You can remove from the PKGBUILD commented lines and unused variables. It improves readability