atoponce/webpassgen

Fix bug counting whitespace passwords

Closed this issue · 0 comments

There are 22 characters of different byte sizes:

  • " ": U+0020 (1 byte)
  • "᠎": U+180E (3 bytes)
  • " ": U+2000 (3 bytes)
  • " ": U+2001 (3 bytes)
  • " ": U+2002 (3 bytes)
  • " ": U+2003 (3 bytes)
  • " ": U+2004 (3 bytes)
  • " ": U+2005 (3 bytes)
  • " ": U+2006 (3 bytes)
  • " ": U+2007 (3 bytes)
  • " ": U+2008 (3 bytes)
  • " ": U+2009 (3 bytes)
  • " ": U+200A (3 bytes)
  • "​": U+200B (3 bytes)
  • "‌": U+200C (3 bytes)
  • "‍": U+200D (3 bytes)
  • " ": U+202F (3 bytes)
  • "⁠": U+2060 (3 bytes)
  • " ": U+3000 (3 bytes)
  • "": U+FEFF (3 bytes)
  • "󠀠": U+E0020 (4 bytes)

At 22 unique whitespace characters, that's log2(22) ~= 4.459 bits per character. That means we should expect these character counts for the following minimum security levels:

  • 56 bits: 13 characters
  • 64 bits: 15 characters
  • 72 bits: 17 characters
  • 80 bits: 18 characters
  • 88 bits: 20 characters
  • 96 bits: 22 characters
  • 104 bits: 24 characters
  • 112 bits: 26 characters
  • 120 bits: 27 characters
  • 128 bits: 29 characters