"Anyone who considers arithmetical methods of producing random digits is, of course, in a state of sin"
-- John von Neumann
Stipulated, but I am beset by closer devils, and I've tinkered with a mild solution I like. Let me tell you more
I've been badgered as some web sites have moved to Java-script evaluation routines for site passwords. Some require mixed case; others punctuation; no doubled letters; minimum length. Contrariwise some limit the character set to prohibit what others require
As such, for the last year or so I have been playing with a quick script on my CentOS 5 box, to generate a unique password per website, and keep a master index of the userid, email address used, and password used. This of course limits my ability to connect to those sites when away from that list. Open-ID roll-in seems to be coming however, and I have a rather clever device, backed by Verisign, and using an inexpensive OTP -- one time password -- hardware device as part of the authentication process
The little generator I wrote is based on simple shell tools -- md5sum, df, date, ps, cut, tr and so forth. It gathers a bit of entropy from a few sources froma few systems around the office, which should be non-correlated from a theoretical basis in the time frames at issue. It does some hashing to get good dispersion. Then it expands into 3 or 4 character vectors each 16 characters wide, using the hexidecimal digits that md5sum emits, as translated by tr; the first three are letters, upper, lower, and digits; the fourth character set are selected specials and punctuation excluding some shell meta's. Depending on a limitation by an option to -a, that vector may be limited to the alpha-numerics only, or also stir in the specials
That 'deck of characters' is handed off to a 'repeated cut of the deck' shuffler, and returned mixed once more just for good measure
I then add a 'bumper' of a letter or digit at each end [one site prohibited starting with a special], and a second character of 'bang' to prevent a mouse slip from dropping a password into the bash history in the case of a panel slip
The results are assembled, trimmed to an optionally specified length, and displayed, where I harvest them as mentioned above
Really, passwords need to die, die, die, but that is for another post
[herrold@centos-5 bin]$ for i in `seq 1 10 `; do ./gen-pw.sh ; done
e!~YJAJ{e:sU[4
2!R5K*U#)LoH~2
c!T)T7A10RjS}7
1!cGJ5T@]YjW>4
5!Q+#)K8:@rT]2
8!^)S~FF:5lV<4
b!dJ:TcKK{tQ)9
2!1dEa:fe~mR{4
3!cD1:eH^6wO*d
d!U*5(UEFWsI:e
[herrold@centos-5 bin]$ for i in `seq 1 10 `; do ./gen-pw.sh -a ; done
5ec280RSY5wIfd
0ddQ31EdJGmIdb
7eb52645U1tH06
0bfb401eG1jUa5
c2cT85QY22pS2d
ba8EALA9RRtR1f
35f59JRD6KpN04
7ed956UbA9pV59
402H3YLLR8hR3e
f2a0Aa9J0JrPde
[herrold@centos-5 bin]$Completely un-memorizable of course, so really only suitable to a protected physical environment where one may write them down
Random number sin, of course, but the cyber-ninja can more readily put my thumb between pliers jaws, than predict the pseudo random source values I used, I'll readily spill the secret to access my LOL CATS site account. ... I still have to get around to building a few non-correlated hardware random number generators -- diode based, lava lamp based, dice tumbling machine for serious entertaining, I guess
