Problem - Kevin Tafuro

8.5 Generating Random Passwords and
Passphrases
Problem
You would like to avoid problems with easy-to-guess passwords by randomly generating
passwords that are difficult to guess.
Solution
For passwords, choose random characters from an acceptable set of characters using
spc_rand_range( ) (see Recipe 11.11). For passphrases, choose random words from a
predefined list of acceptable words.
Discussion
In many situations, it may be desirable to present a user with a pregenerated password.
For example, if the user is not present at the time of account creation, you will
want to generate a reasonably secure password for the account and deliver the password
to the user via some secure mechanism such as in person or over the phone.
Randomly generated passwords are also useful when you want to enforce safe password
requirements. If the user cannot supply an adequately secure password after a
certain number of attempts, it may be best to present her with a randomly generated
password to use, which will most likely pass all of the requirements tests.
The primary disadvantage of randomly generated passwords is that they are usually
difficult to memorize (and type), which often results in users writing them down. In
many cases, however, this is a reasonable trade-off.
The basic strategy for generating a random password is to define a character set that
contains all of the characters that are valid for the type of password you are generating,
then choose random members of that set until enough characters have been chosen
to meet the length requirements.
The string spc_password_characters defines the character set from which random
password characters are chosen. The function spc_generate_password( ) requires a
buffer and the size of the buffer as arguments. The buffer is filled with randomly chosen
password characters and is properly NULL-terminated. As written, the function
will always succeed, and it will return a pointer to the buffer filled with the randomly
generated password.
#include
static char *spc_password_characters = "abcdefghijklmnopqrstuvwxyz0123456789"
"ABCDEFGHIJKLMNOPQRSTUVWXYZ!@#$%^&*( )"
"-=_+;[ ]{ }\\|,./?;";
Generating Random Passwords and Passphrases | 387
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.