RiptideTempora

First attempt at entropy estimator

Jan 1st, 2013
254
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
PHP 3.57 KB | None | 0 0
  1. <?
  2. /* So I wrote a password entropy guessing algorithm today.
  3.  * It looks for common patterns and weaknesses in the keyspace of the password (repeat characters, repeats
  4.  * of the same character type, etc.) by analyzing different chunks of the password.
  5.  *
  6.  * This is probably not the most efficient way to do this...
  7.  */
  8. function getEntropy($p) {
  9.   # Estimates the average entropy per segment of the password :)
  10.  $l = strlen($p);
  11.   $estimates = array();
  12.   for($i = 0; $i <= $l/2; $i++) {
  13.     $chnk = str_split($p, $i+1);
  14.     $estimates[$i] = 0;
  15.     $prevchunk = '';
  16.     foreach($chnk as $c) {
  17.       # Look for really weak patterns in different segments of the string!
  18.      if($prevchunk == $c) continue;
  19.       if(preg_match("/(.)\\1{".($i-1)."}/", $c, $m)) {
  20.         # No entropy gain for repeated characters.
  21.        if(preg_match('/^[0-9]+$/', $m[1])) {
  22.           $estimates[$i] += 3.3219281;
  23.         } elseif(preg_match('/^[0-9]$/', $m[1])) {
  24.           $estimates[$i] += 3.3219281;
  25.         } elseif(preg_match('/^[a-z]$/', $m[1]) || preg_match('/^[A-Z]$/', $m[1])) {
  26.           $estimates[$i] += 4.7004397;
  27.         } elseif(preg_match('/^[^a-zA-Z0-9]$/', $m[1])) {
  28.           $estimates[$i] += 5.4262648;
  29.         } else {
  30.           # Best case
  31.          $estimates[$i] += 6.5698556;
  32.         }
  33.       } elseif(preg_match('/^[0-9]+$/', $c)) {
  34.         $estimates[$i] += ($i+1)*3.3219281;
  35.       } elseif(preg_match('/^[a-z]+$/', $c) || preg_match('/^[A-Z]+$/', $c)) {
  36.         $estimates[$i] += ($i+1)*4.7004397;
  37.       } elseif(preg_match('/^[A-Za-z]+$/', $c)) {
  38.         $estimates[$i] += ($i+1)*5.7004397;
  39.       } elseif(preg_match('/^[^a-zA-Z0-9]+$/', $c)) {
  40.         $estimates[$i] += ($i+1)*5.4262648;
  41.       } elseif(preg_match('/^([A-Z]+)([a-z]+)([0-9]*)$/', $c, $m)) {
  42.         $estimates[$i] += strlen($m[1])*4.7004397;
  43.         $estimates[$i] += strlen($m[2])*4.7004397;
  44.         $estimates[$i] += strlen($m[3])*3.3219281;
  45.       } else {
  46.         # Best case
  47.        $estimates[$i] += ($i+1)*6.5698556;
  48.       }
  49.       $prevchunk = $c;
  50.     }
  51.     if($estimates[$i] == 0) unset($estimates[$i]);
  52.   }
  53.   if(empty($estimates)) return 0;
  54.   return min($estimates); // Yes!
  55. }
  56. ?>
  57. <h1>Entropy Estimate</h1>
  58. <form>Enter Password:<input type="text" style="width: 1000px;" name="password" value="<?=empty($_GET['password'])?'':stripXSS($_GET['password']); ?>" /> <input type="submit" value="Go" /></form>
  59. <hr />
  60. <?
  61. if(!empty($_GET['password'])) {
  62.   $p = $_GET['password'];
  63.   $l = strlen($p);
  64.   if($l < 4) {
  65.     echo "Password too short!";
  66.     exit;
  67.   }
  68.   $E = getEntropy($p);
  69.   echo "Maximum entropy: ".number_format($E, 2)." bits of entropy.<br />\n";
  70.   $N = bcpow('2', $E);
  71.   echo "There are approximately ".number_format($N)." passwords in this keyspace.<br />\n";
  72.   echo "At 900 Quadrillion passwords per second, it would take approximately ";
  73.   $T = bcdiv($N, '900000000000000000');
  74.   if($T < 60) {
  75.     echo $T." seconds";
  76.   } elseif($T < 3600) {
  77.     echo bcdiv($T, 60)." minutes, ".bcmod($T, 60)." seconds";
  78.   } elseif($T < 86400) {
  79.     echo bcdiv($T, 3600)." hours, ".floor(bcdiv(bcmod($T, 3600), 60))." minutes, ".bcmod($T, 60)." seconds";
  80.   } elseif($T < 31556736) {
  81.     echo bcdiv(bcmod($T, 86400), 3600)." hours, ".bcdiv(bcmod($T, 3600), 60)." minutes, ".floor(bcmod($T, 60))." seconds";
  82.   } else {
  83.     echo number_format(bcdiv($T, 31556736))." years, ".floor(bcdiv(bcmod($T, 31556736), 86400))." days, ".floor(bcdiv(bcmod($T, 86400), 3600)." hours, ".bcdiv(bcmod($T, 3600), 60))." minutes, ".floor(bcmod($T, 60))." seconds";
  84.   }
  85.   echo " to guess your password.";
  86. }
  87. ?>
Advertisement
Add Comment
Please, Sign In to add comment