PPGEN(1)

NAME
ppgen - passphrase generator

SYNOPSIS
ppgen [-d dicts] [-e bits] [-n count] [-p path]

DESCRIPTION
ppgen generates passphrases on standard output. It can be used from the command line or by a modified passwd(1).

The algorithm used is to choose words randomly from a dictionary, as many as are necessary to achieve the desired level of entropy (i.e., security). The resulting passphrases are longer than traditional cryptic passwords of the `aWCp+@4f' sort, but easier to remember and type; and using ppgen is much easier than thinking of an equally unguessable secret.

OPTIONS

-d dicts
    Choose an alternate dictionary (or dictionaries); this is a colon-seperated list. The default is taken from the environment variable PPGEN_DICTS, then defaults to `en'.

-e bits
    Generate a passphrase that has (at least) bits bits of entropy. This option changes the number of possible passphrases, and thus the space which an attacker must search. By default, it is 64; for comparison, DES keys have (at most) 56 bits of entropy.

-n count
    Output count passphrases, instead of just one.

-p path
    Look for dictionaries in path; the default is /usr/local/share/ppgen.

BUGS
ppgen is not magic. Having a good passphrase does not automatically provide you with security. If you write it down, deliberately give it to someone else, bypass it with .rhosts, or send it in plaintext over an insecure channel, you lose. The only security ppgen gives you is protection against dictionary attacks, and knowledge that your password is strong without having to spend a great deal of effort constructing it. The best way to use ppgen is to generate strings which are hashed into keys for a challenge-response or ticket-based authentication system, such as S/Key or Kerberos, which provide protection against eavesdropping and replay.

ppgen's generated passphrases are only as unguessable as the random numbers used to generate them. By compile-time configuration, they come from PGP's cryptographically strong RNG.

SEE ALSO
passwd(1)

AUTHOR
Michael Shields <shields@tembel.org>.