# Creating a random password based off of a prime number

So I am making an application that basically creates strings that must be encrypted before they are stored on a user's device. If the user blindly starts running the application without creating a password before hand OR they cannot come up with a long, strong password, would this method be appropriate? (Language is java)

1. Create a probable prime of 512 bit length
• BigInteger.probablePrime(512, new Random())
2. Add a random number of 512 bit length
• .add(new BigInteger(512, new Random()))
3. Convert number into Base32
• .toString(32);

The above steps will yield a Base32 string that is about 100-103 characters long and will look something like this: 2si95285qk2trk65hona7q0j27o81ph6adjs2obd2g83q9nho52tonku7s3uajtja54ri2dkbque39hil14f1nrlef0736mtda7rtll

And it is up to the user to safely store this password if they do not create one themselves.

So my question, is this a plausible method to create a random password if the user does not make one before hand or cannot create a password this long (though it is not required)?

• You depend heavily on the quality of the initialization of Random(), which itself depends on the particular version of Java, and on the platform. Thus the answer is context-dependent (and largely off-topic). – fgrieu Apr 8 '15 at 19:16
• Generating cryptographically strong random numbers is not hard. And a base64-encoded 128-bit random symmetric key is only 44 characters long. What do you believe you gain by performing voodoo with prime numbers? – Stephen Touset Apr 8 '15 at 19:51
• Is there a specific reason you are starting with a prime number? Is there a reason why a random number of the same size wouldn't work as well? Also, I second fgrieu's question about Random() -- should you trust it to generate cryptographical keys? – poncho Apr 8 '15 at 20:13
• @Stephen I used your link and came up with new BigInteger(512, new SecureRandom()).toString(32). I thought choosing a random prime number would help in my case of randomness but from what everyone is saying, it is rather pointless. – rdadkins Apr 8 '15 at 20:19
• Why not use something like the Diceware 8k list to generate a passphrase for the user, with SecureRandom? That way you get a secure passphrase they might actually be able to keep, instead of changing it for an (almost certainly weaker) custom password. – SAI Peregrinus Apr 8 '15 at 23:58