Problem - Kevin Tafuro

char *spc_generate_password(char *buf, size_t bufsz) {
size_t choices, i;
choices = strlen(spc_password_characters) - 1;
for (i = 0; i < bufsz - 1; i++) /* leave room for NULL terminator */
buf[i] = spc_password_characters[spc_rand_range(0, choices)];
buf[bufsz - 1] = 0;
return buf;
}
Although there is no conceptual difference between a password and a passphrase,
each has different connotations to users:
Password
Typically one word, short or medium in length (usually under 10 characters, and
rarely longer than 15).
Passphrases
Usually short sentences, or a number of unrelated words grouped together with
no coherent meaning.
While a passphrase can be a long string of random characters and a password can be
multiple words, the typical passphrase is a sentence that the user picks, usually
because it is related to something that is easily remembered. Even though their
length and freeform nature make passphrases much harder to run something such as
the Crack program on, they are still subject to guessing.
For example, if you are trying to guess someone’s passphrase, and you know that
person’s favorite song, trying some lyrics from that song may prove to be a very good
strategy for discovering what the passphrase is. It is important to choose a passphrase
carefully. It should be something easy to remember, but it should not be
something that someone who knows a little bit about you will be able to guess
quickly.
As with passwords, there are times when a randomly generated passphrase is needed.
The strategy for randomly generating a passphrase is not altogether different from
randomly generating a password. Instead of using single characters, whole words are
used, separated by spaces.
The function spc_generate_passphrase( ) uses a data file to obtain the list of words
from which to choose. The words in the file should be ordered one per line, and they
should not be related in any way. In addition, the selection of words should be sufficiently
large that a brute-force attack on generated passphrases is not feasible. Most
Unix systems have a file, /usr/share/dict/words, that contains a large number of words
from the English dictionary.
This implementation of spc_generate_passphrase( ) keeps the word data file open
and builds an in-memory list of the offsets into the file for the beginning of each
word. The function keeps offsets instead of the whole words as a memory-saving
measure, although with a large enough list of words, the amount of memory required
388 | Chapter 8: Authentication and Key Exchange
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.