.\" Copyright (c) 2017, 2019 Tim Kuijsten
.\" Copyright (c) 2020, Stephen Gregoratto
.\"
.\" Permission to use, copy, modify, and/or distribute this software for any
.\" purpose with or without fee is hereby granted, provided that the above
.\" copyright notice and this permission notice appear in all copies.
.\"
.\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
.\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
.\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
.\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
.\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
.\"
.Dd February 11, 2020
.Dt RPASS 1
.Os
.Sh NAME
.Nm rpass
.Nd strong password generator for humans
.Sh SYNOPSIS
.Nm
.Op Ar bitlen
.Sh DESCRIPTION
The
.Nm
utility generates strong passwords for human beings.
The generated passwords are shorter than Diceware, making them suitable for
environments where one has to frequently input them.
The passwords are case-insensitive so that there is no alternation between
keyboards on insert.
Blanks are inserted at arbitrary places to enhance visual representation.
Furthermore, the passwords are both visually and phonetically unambiguous.
.Pp
The
.Ar bitlen
argument determines the password's keyspace,
defaulting to 40 if unspecified.
In order to determine the right
.Ar bitlen ,
three factors should be considered:
.Bl -enum -offset Ds
.It
The hashing mechanism used to store the password.
.It
The time for which this password has to be secure.
.It
The processing power of the adversary.
.El
.Pp
The 40 bit default relies on the following requirements:
the password is stored using
.Xr bcrypt 3
with
.EQ
2 sup 10
.EN
rounds, it should only be secure for one year and the adversary has no more than
$25,000.00 to spend on brute forcing the password (as of 2019).
.Sh EXIT STATUS
.Ex -std
.Sh EXAMPLES
Random password from the default key space:
.Bd -literal -offset 4n
$ rpass
jikmus xuzjex
.Ed
.Pp
Random password from an 80 bit key space:
.Bd -literal -offset 4n
$ rpass 80
jultar ramlap rinwun bemvuh
.Ed
.Pp
In order to calculate the required
.Ar bitlen ,
consider a scenario with the following requirements: the generated
password will be used for at most half a year and is stored using
PBKDF2-HMAC-SHA256 with a million iterations.
The adversary can compute 15 thousand hashes per second with a million
iterations.
Thus the required key space is
.EQ
log sub 2 (15000 times 3600 times 24 times 183 times 2) approx 38.8
.EN
.Sh SEE ALSO
.Xr bcrypt 3
.Rs
.%B PKCS #5: Password-Based Cryptography Specification
.%I Internet Engineering Task Force
.%D January 2017
.%R RFC 8018
.Re
.Sh AUTHORS
.An -nosplit
The
.Nm
utility was written by
.An Tim Kuijsten Aq Mt info@netsend.nl
and is maintained by
.An Stephen Gregoratto Aq Mt dev@sgregoratto.me .
.Sh CAVEATS
The phonetic ambiguity of the current set of mnemonics depends on the spoken
language and is currently optimized for the Dutch language.