RFC 972

Password Generator Protocol ✨

okay bestie, so this is RFC 972 🎀 It's by F. Wancho from WSMR, dated January 1986, and it's a standard for the ARPA Internet community. The title block doesn't list anything it obsoletes or updates, so it's a clean start 🧚

STATUS OF THIS MEMO 💅

ok so this one's a standard for the ARPA Internet crowd 🌈 Any host that chooses to build a Password Generator Protocol (PWDGEN) is expected to adopt and implement this spec. And distribution is unlimited, so share it with everyone 🫶

BACKGROUND 🌸

Okay so security-minded host admins have been noticing that the passwords users pick themselves are way too easy to guess, even for casual penetration attempts 💀 Some sites tried dictionary lookups to block plain ordinary words, and others tried randomly generated passwords, but those had mixed results. The problem is those random ones are hard to remember because they can't be pronounced, or because the pseudo-random number generator behind them has a relatively short cycle 🙈

A version of the PWDGEN algorithm (described below) has been running for several years at a small number of Internet sites 🦋 People have been asking about porting it to more sites, but the short cycle and the resulting randomness of the available generators get in the way of the main goal, which is keeping passwords from being duplicated within a site and across sites, especially when a user has access to more than one site 😭

So the PWDGEN Service gives sites a way to offer a list of possible passwords. The user picks one from the first set, or optionally picks from another set 🍓 If more than one site offers the service, you can randomly choose which site to use, with fallback sites in case one is down 👑

Description

The PWDGEN Service hands out six randomly generated, eight-character, CRLF-delimited "words" that are reasonably pronounceable, made with a multi-level algorithm 🎀 There's an implementation in FORTRAN-77, but it's only meant for system administrators to look at and maybe implement 🧚

The uniqueness of these words depends heavily on how random the initial seed value is. A single system-wide seed, updated after each access, is highly desirable 😍 Seeds based on a time-of-day clock are unacceptable 🙅‍♀️ For best performance, seed values should be stored as values in excess of 32 bits ⭐

TCP Based PWDGEN Service

This version is a connection-based application on TCP 🦋 The server listens for TCP connections on TCP port 129. Once a connection is set up, it generates the six CRLF-delimited words, sends them to the caller, and then the server closes the connection. No dialog is used or required, so it's super simple, no cap 💅

UDP Based PWDGEN Service

This one is the datagram-based version on UDP ✨ The server listens for UDP datagrams on UDP port 129. When a datagram comes in, it sends back the six CRLF-delimited words in an answering datagram 🌈 Iconic and efficient, periodt 💖