PWDGEN: Password Generator Protocol
A network service that offers pronounceable passwords for users to choose from.
Wancho, F.J., "Password Generator Protocol", RFC 972, DOI 10.17487/RFC0972, January 1986, <https://www.rfc-editor.org/info/rfc972>.
@misc{rfc972,
series = {Request for Comments},
number = 972,
howpublished = {RFC 972},
publisher = {RFC Editor},
doi = {10.17487/RFC0972},
url = {https://www.rfc-editor.org/info/rfc972},
author = {F.J. Wancho},
title = {{Password Generator Protocol}},
pagetotal = 2,
year = 1986,
month = jan,
} RFC text
Contents
Network Working Group F. Wancho
Request for Comments: 972 WSMR
January 1986
Password Generator Protocol
STATUS OF THIS MEMO
This RFC specifies a standard for the ARPA Internet community. Hosts
on the ARPA Internet that choose to implement a Password Generator
Protocol (PWDGEN) are expected to adopt and implement this standard.
Distribution of this memo is unlimited.
BACKGROUND
Many security-conscious host administrators are becoming increasingly
aware that user-selected login passwords are too easy to guess for
even casual penetration attempts. Some sites have implemented
dictionary lookup techniques in their password programs to prevent
ordinary words from being used. Others have implemented some variant
of a randomly generated password with mixed success. The problem
arises from the fact that such passwords are difficult to remember
because they cannot be pronounced or are based on a relatively short
cycle pseudo-random number generator.
A version of the PWDGEN algorithm briefly described below has been in
use for several years at a small number of sites in the Internet.
Interest has recently been expressed at porting this algorithm to
other sites. However, the relatively short cycle and the resulting
randomness of the pseudo-random number generator available on these
sites tends to interfere with the intended result of minimizing the
potential duplication of passwords both within a site and across
sites when a user has access to more than one site.
The PWDGEN Service described herein provides a means for sites to
offer a list of possible passwords for the user to choose one from
the first set, or optionally select from another set. With more than
one site offering this service, it is then possible to randomly
select which site to use and have multiple fallback sites should that
site be unavailable.
Description
The PWDGEN Service provides a set of six randomly generated
eight-character CRLF-delimited "words" with a reasonable level of
pronounceability, using a multi-level algorithm. An
implementation of the algorithm is available in FORTRAN-77 for
examination and possible implementation by system administrators
only.
Password Generator Protocol
The uniqueness of the generated words is highly dependent on the
randomness of the initial seed value used. The availability of a
single system-wide seed, updated after each access is highly
desireable. Seeds based on a time-of-day clock are unacceptable.
Seed values should be stored as values in excess of 32 bits for
best performance.
TCP Based PWDGEN Service
One PWDGEN service is defined as a connection based application on
TCP. A server listens for TCP connections on TCP port 129. Once
a connection is established, the six CRLF-delimited words are
generated and sent to the caller, and the connection is closed by
the server. No dialog is used or required.
UDP Based PWDGEN Service
Another possible PWDGEN service is defined as a datagram based
application on UDP. A server listens for UDP datagrams on UDP
port 129. When a datagram is received, the six CRLF-delimited
words are sent back in an answering datagram.
ISO Plain Language
On this page
§1Passwords That Are Easier to Remember
The RFC says ordinary user-selected passwords may be easy to guess. Random passwords can be difficult to remember when they cannot be pronounced, and a short-cycle pseudo-random generator can reduce uniqueness.
PWDGEN offers a set of candidate words for a user to choose from, with an option to request another set. The RFC says that the uniqueness of the words depends strongly on the randomness of the initial seed.
The service generates a list so users can choose a password instead of making one up. Its results depend on how well the system chooses its starting seed.
§1The PWDGEN Response
The service returns six random words, each eight characters long, separated by carriage-return and line-feed sequences. The RFC describes the words as having a reasonable level of pronounceability and refers system administrators to a FORTRAN-77 algorithm implementation.
It recommends a shared system-wide seed that is updated after each access. Seeds based on a time-of-day clock are described as unacceptable, and seed values larger than 32 bits are recommended for best performance.
A request produces six candidate words, separated onto lines. A strong, changing seed helps reduce repeated or predictable results.
§1TCP and UDP Service Options
For TCP, a server listens on port 129. After a client connects, the server sends the six words and closes the connection; the RFC defines no dialogue.
For UDP, a server listens for datagrams on port 129 and sends the six words in a reply datagram. Both forms return the same candidate list.
A client can request passwords through either TCP or UDP. In both cases the server returns the list and does not conduct a back-and-forth conversation.