# Advice in password auto-generation

I'm creating a program with key access for a determined term. I've made a code that will generate a key (password) with 16 characters length. The following information is encoded:

• initial date 6 characters, ex. 010120;
• term up to 3 characters length, ex. 1 or 10 or 365 days;
• term length identificatior, ex. 1 or 2 or 3, depending on term number length;
• 6 randomly generated symbols: lower/uppercase letters and numbers. These characters are scattered in the password string using some logic (to be decoded by password verification code).

Encoding is simply based on ASCII codes of symbols.

Example of coding letters: a b c d e f = ASCII codes 126 + 127 + 128 + 129 + 130 + 131 = 771 = 7 + 7 + 1 = 15. 15 is the control sum. Thus generating a key my code loops through random codes ASCII until the control sum will be equal 15 - this is the generated letter part of the password. This control sum is after used to verify is the password is correct. Digits for the date are encoded simply by adding a constant value to the ASCII number code (48 to 57) to get a letter.

Here are examples of keys (used another control sum):

3Y6CEecb0MYc1e1c, oPFjeefcAD8m2dmd, bF5bGfdb4dud2ejd, ClEigfdbydcd2ezd


My question is about the "strength" of this password: how easily it could be hacked, or date and term part discovered?

• These characters are scattered in the password ????!!!! Jan 2 '20 at 21:33
• You have to assume the attacker knows how you generate your password. And then it just comes down to combinatorics.
– tylo
Jan 3 '20 at 0:40
• If it's a downloadable program, someone will just delete the function that checks if the password is valid and change it to boolean IsPasswordValid(string password) {return true;} Jan 3 '20 at 15:46

## 2 Answers

Only randomly generated components matter for passwords/passphrases.

6 randomly generated symbols: lower/uppercase letters and numbers.

You have 26+26+10 possible characters, so 62.

The entropy of a password is $$L\log_{2}N$$, where $$N$$ is the number of possible symbols and $$L$$ is the number of symbols in the password. So you have $$6\log_{2}62=35$$ bits of entropy. You want a minimum of 80 to be considered reasonably strong.

This is ridiculously weak. For all practical purposes it's a 6-character alphanumeric password.

You should expect that an attacker will sooner or later know your algorithm, no matter how complex you construct it. The security is more reliable when it depends not on the secrecy of algorithm, but on the secrecy of data. This approach is known as Kerckhoffs's principle.

If we apply this principle to your case, we should expect that the attacker can calculate all characters of the password except of 6 randomly generated symbols. That's why your password is as strong as 6 random symbols, which is about $$10^9$$ combinations or 35 bits of information.

How much time is needed to brute-force these $$10^9$$ combinations? It depends.

If your passwords are intended for ZIP encryption, then it would take less than 1 hour (here is statistics from 2011, on a single GPU it was possible to break your password in ~30 min in year 2011, now even quicker).

If your passwords are intended for user authentication: If you use password stretching, then you can slow down brute-forcing. But you cannot do it arbitrary slow. Suppose you have 1000 user logins per second on each server. Users will not accept if login takes longer than 1 sec. Means, password stretching should not take longer that 0.001 second. Means, to brute-force $$10^9$$ passwords the hacker needs $$10^9 * 0.001 = 10^6$$ seconds = 28 hours on a single computer. It means the hacker does not need parallel calculation in a network/cluster of 100 or 1000 computers. A single person can do that on a single home computer in a short time.

If you want prevent easy brute-forcing, you need longer passwords. How long? It depends on what are you protecting by passwords. If this is access to a web site of the local bowling club, then may be compromising means little harm. Then even these 6 characters could be sufficient. If this is access to the online banking, then the consequences can be more serious and you want to use for this purpose longer passwords. You mentioned 16 characters. Make all of these 16 characters random.

If you want to associate some additional information with password (like expiration date), do it as separate attributes in your password database.