Skip to content

docs: 房间口令提取测试报告 - #13

Merged
Freecode100Year merged 1 commit into
mainfrom
docs/password-strength-report
Oct 30, 2026
Merged

Freecode100Year merged 1 commit into
mainfrom
docs/password-strength-report

Conversation

@Freecode100Year

Copy link
Copy Markdown
Owner

概要

把一次口令提取测试的报告写进 README。测试对象是一个真实的加密房间文件。

结论

  1. 文件不泄露口令:加密房间文件里只有 PBKDF2 包装后的密文(salt/iv/ciphertext)和 KDF 参数,没有主密钥、没有明文口令。唯一途径是离线逐个猜。
  2. 破解难度取决于口令强度:用项目自带的 unlock(),对一个自建的弱口令(4 位 PIN)房间完整爆破计时,单核约 20 次/秒;据此给出破解时间表——弱口令秒破至几天,「随机生成口令」(约 99 位熵)约 5×10²⁰ 年,不可行。

报告带日期和执行模型版本(Claude Opus 4.8,claude-opus-4-8),并与 README 既有的口令强度表对应。

范围与安全

  • 只做防御性评估:没有尝试破解任何真实房间,没有在仓库里加入破解工具。
  • 方法:检查文件是否含明文密钥/主密钥;用自带 unlock() 对自建弱口令房间计时。
  • 仅改 README。

Generated by Claude Code

Tested a real encrypted room file: it carries only the PBKDF2-wrapped
master (no master key, no plaintext password), so the only path is offline
guessing. Measured throughput with the project's own unlock() against a
throwaway weak-PIN room (~20 guesses/sec single thread) and tabulated
crack times — weak passwords fall fast, the generated ~99-bit password is
infeasible. Dated and attributed to the model that ran it.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PCUwNSXQdqfDSugmFo4qmM
@Freecode100Year
Freecode100Year merged commit 23daa6e into main Oct 30, 2026
16 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants