A Comparative Study of Three Random Password Generators

Michael D. Leonhard
Department of Computer Science
University of Illinois at Chicago
tamale.net/

V.N. Venkatakrishnan
Department of Computer Science
University of Illinois at Chicago
www.cs.uic.edu/~venkat
Member, IEEE

Abstract — This paper compares three random password generation schemes, describing and analyzing each. It also reports the results of a small study testing the quality of the passwords generated by the schemes. Qualities discussed include security, memorability, and user affinity. Improvements to the schemes and experiment are suggested.

This paper was presented at the IEEE Electro/Information Technology Conference, EIT 2007.

Download

pwdgen.eit2007.proceedings.pdf (384 KB)
pwdgen.eit2007.slides.pdf (454 KB)

BibTex:

@inproceedings{
  pwdgen2007,
  author = {Michael D. Leonhard and V. N. Venkatakrishnan},
  title = {A Comparative Study of Three Random Password Generators},
  booktitle = {EIT'07: Proc. 2007 IEEE International Conference
                on Electro/Information Technology},
  year = {2007},
  isbn = {1-4244-0931-1}
  pages = {271--276}
  location = {Chicago, Illinois}
  month = may,
  url = "http://tamale.net/pub/2007/pwdgen/"
}

Source Code

alphanum.py
diceware.py
pronounce3.py (Original version used in study)
pronounce3.1.py (Uses OS's random data source for better security)
pronounce3.2.py (Capitalizes first letter and appends digit. Example: Hunmaoko4)
pronounce4.0.py (Updated for Python 3)
readme.txt

Download all: pwdgen.src.tar.gz (24 KB)

Questionnaires

We performed the study using two questionnaires. The paper had space for only two of the four pages, so we provide them all here: questionnaires.pdf or questionnaires.ps.gz.

We also provide the raw data obtained from the questionnaires: rawdata.csv

WordPress Plugin

Download version 0.1: pwdgen.php.gz

Version 0.1 Status: The plugin is currently under development. The user interface works well. The password generators are not yet implemented in PHP, so the plugin always assigns the same password. We are making minor improvements to the generators in preparation for our next experiment.

This plugin was developed for WordPress version 2.0.4, but it should work with more recent versions. The plugin is a single source code file, pwdgen.php. It does not require any modifications to WordPress. For installation instructions, please read WordPress: Managing Plugins.

Page updated 2007-12-29

Online articles have much greater impact.

Home