23

If a computer is doing the selection of PIN numbers, then you would be very lucky indeed to guess a PIN in three times. The entropy - assuming that all numbers are valid - is of course $\log_2{10^8} \approx 26.57$ bits. The chances of guessing the PIN correctly in 3 tries is $$1 - \frac{x-1}{x} \cdot \frac{x - 2}{x-1} \cdot \frac{x-3}{x-2} = 1 - \frac{x-3}{...


9

The Bitcoin Bip-39 dictionary with 2048 words can create $\approx 2^{263}$-entropy by tossing the coin 256 times to choose the words randomly. The random bits are converted into 24 11-bit blocks and every block is mapped into one of the 2048 words by ID. Since the random choice allows repetition, we need $n^r$ not $P(n,r)$; $$2048^{24} \approx 2....


7

The chance to guess right is just $$\frac{3}{10^x}$$ where in your case, $x$ is $8$. You could write it as $$1-\frac {99999999}{100000000}\cdot\frac {99999998}{99999999}\cdot\frac {99999997}{99999998}=1-\frac {99999997}{100000000}=\frac 3{100000000}$$ To simplify it, just imagine a one digit PIN. You have ten possibilities, from 0 to 9. With three tries, ...


4

Yes, 7-8 words selected truly at random make a strong password. First we should consider what is a strong password, we measure the strength of a method of generating passwords by how much entropy is in it. The XKCD method https://xkcd.com/936/ uses 4 random commom words and has 44 bits of entropy. This is considered a reasonable compromise if you want a ...


3

Like Ray, I'd like to point out that if the PINs are not chosen randomly but selected by humans and there is no rejection of the easiest pins, the same rules as for passwords apply: some are very, very, very common. This analysis of 4-digit pins shows that 3 tries will allow you to break over 18% of 4-digit pins, not the 0.03% you would expect from the ...


2

Only randomly generated components matter for passwords/passphrases. 6 randomly generated symbols: lower/uppercase letters and numbers. You have 26+26+10 possible characters, so 62. The entropy of a password is $L\log_{2}N$, where $N$ is the number of possible symbols and $L$ is the number of symbols in the password. So you have $6\log_{2}62=35$ bits ...


2

Using the HKDF algorithm would work: prk = HKDF-EXTRACT(salt, master_key) Key1 = HKDF-EXPAND(prk, "info 1", digest_len) Key2 = HKDF-EXPAND(prk, "info 2", digest_len) This creates two keys that are generated from the master key, but given Key1, someone else wouldn't be able to generate Key2, as they don't know the master key.


1

You should expect that an attacker will sooner or later know your algorithm, no matter how complex you construct it. The security is more reliable when it depends not on the secrecy of algorithm, but on the secrecy of data. This approach is known as Kerckhoffs's principle. If we apply this principle to your case, we should expect that the attacker can ...


1

In terms of English language, what you are asking about are digram frequencies. http://www.viviancook.uk/SpellStats/DigFreqs.html


Only top voted, non community-wiki answers of a minimum length are eligible