From c5fa76d2072a7753cfc90309e99c345a6da0227a Mon Sep 17 00:00:00 2001 From: Dan Wheeler Date: Sat, 24 Sep 2016 16:43:44 -0700 Subject: [PATCH] latest build --- dist/zxcvbn.js | 2 +- dist/zxcvbn.js.map | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/dist/zxcvbn.js b/dist/zxcvbn.js index c8313b8c..b64c929e 100644 --- a/dist/zxcvbn.js +++ b/dist/zxcvbn.js @@ -18,7 +18,7 @@ var feedback,matching,scoring,time,time_estimates,zxcvbn;matching=require("./mat var DATE_MAX_YEAR,DATE_MIN_YEAR,DATE_SPLITS,GRAPHS,L33T_TABLE,RANKED_DICTIONARIES,REGEXEN,adjacency_graphs,build_ranked_dict,frequency_lists,lst,matching,name,scoring;frequency_lists=require("./frequency_lists"),adjacency_graphs=require("./adjacency_graphs"),scoring=require("./scoring"),build_ranked_dict=function(e){var t,n,r,i,a;for(i={},t=1,r=0,n=e.length;r_;r=0<=_?++o:--o)for(i=h=f=r,d=a;f<=d?hd;i=f<=d?++h:--h)u.slice(r,+i+1||9e9)in l&&(p=u.slice(r,+i+1||9e9),c=l[p],s.push({pattern:"dictionary",i:r,j:i,token:e.slice(r,+i+1||9e9),matched_word:p,rank:c,dictionary_name:n,reversed:!1,l33t:!1}));return this.sorted(s)},reverse_dictionary_match:function(e,t){var n,r,i,a,s,o;for(null==t&&(t=RANKED_DICTIONARIES),o=e.split("").reverse().join(""),i=this.dictionary_match(o,t),a=0,n=i.length;a0&&(l[i]=h);return l},enumerate_l33t_subs:function(e){var t,n,r,i,a,s,o,h,u,c,l,_,f,d,p;a=function(){var t;t=[];for(i in e)t.push(i);return t}(),p=[[]],n=function(e){var t,n,r,a,s,o,h,u;for(n=[],s={},o=0,a=e.length;og;s=0<=g?++f:--f)if(A[s][0]===o){i=s;break}i===-1?(y=A.concat([[o,a]]),c.push(y)):(E=A.slice(0),E.splice(i,1),E.push([o,a]),c.push(A),c.push(E))}return p=n(c),r(m)}},r(a),d=[];for(u=0,o=p.length;u "+A);return e}().join(", "),u.push(o)}return this.sorted(u.filter(function(e){return e.token.length>1}))},spatial_match:function(e,t){var n,r,i;null==t&&(t=GRAPHS),i=[];for(r in t)n=t[r],this.extend(i,this.spatial_match_helper(e,n,r));return this.sorted(i)},SHIFTED_RX:/[~!@#$%^&*()_+QWERTYUIOP{}|ASDFGHJKL:"ZXCVBNM<>?]/,spatial_match_helper:function(e,t,n){var r,i,a,s,o,h,u,c,l,_,f,d,p,g,m;for(f=[],u=0;u2&&f.push({pattern:"spatial",i:u,j:c-1,token:e.slice(u,c),graph:n,turns:m,shifted_count:g}),u=c;break}c+=1}return f},repeat_match:function(e){var t,n,r,i,a,s,o,h,u,c,l,_,f,d,p;for(d=[],a=/(.+)\1+/g,c=/(.+?)\1+/g,l=/^(.+?)\1+$/,u=0;u_[0].length?(f=s,i=l.exec(f[0])[1]):(f=_,i=f[1]),p=[f.index,f.index+f[0].length-1],o=p[0],h=p[1],t=scoring.most_guessable_match_sequence(i,this.omnimatch(i)),r=t.match_sequence,n=t.guesses,d.push({pattern:"repeat",i:o,j:h,token:f[0],base_token:i,base_guesses:n,base_matches:r,repeat_count:f[0].length/i.length}),u=h+1;return d},MAX_DELTA:5,sequence_match:function(e){var t,n,r,i,a,s,o,h,u;if(1===e.length)return[];for(u=function(t){return function(n,r,i){var a,s,o,u;if((r-n>1||1===Math.abs(i))&&0<(a=Math.abs(i))&&a<=t.MAX_DELTA)return u=e.slice(n,+r+1||9e9),/^[a-z]+$/.test(u)?(s="lower",o=26):/^[A-Z]+$/.test(u)?(s="upper",o=26):/^\d+$/.test(u)?(s="digits",o=10):(s="unicode",o=26),h.push({pattern:"sequence",i:n,j:r,token:e.slice(n,+r+1||9e9),sequence_name:s,sequence_space:o,ascending:i>0})}}(this),h=[],n=0,a=null,i=s=1,o=e.length;1<=o?so;i=1<=o?++s:--s)t=e.charCodeAt(i)-e.charCodeAt(i-1),null==a&&(a=t),t!==a&&(r=i-1,u(n,r,a),n=r,a=t);return u(n,e.length-1,a),h},regex_match:function(e,t){var n,r,i,a;null==t&&(t=REGEXEN),n=[];for(name in t)for(r=t[name],r.lastIndex=0;i=r.exec(e);)a=i[0],n.push({pattern:"regex",token:a,i:i.index,j:i.index+i[0].length-1,regex_name:name,regex_match:i});return this.sorted(n)},date_match:function(e){var t,n,r,i,a,s,o,h,u,c,l,_,f,d,p,g,m,A,E,y,v,I,R,T,D,k,x,j,b,N,S,q,L,M;for(_=[],f=/^\d{4,8}$/,d=/^(\d{1,4})([\s\/\\_.-])(\d{1,2})\2(\d{1,4})$/,s=m=0,v=e.length-4;0<=v?m<=v:m>=v;s=0<=v?++m:--m)for(o=A=I=s+3,R=s+7;(I<=R?A<=R:A>=R)&&!(o>=e.length);o=I<=R?++A:--A)if(M=e.slice(s,+o+1||9e9),f.exec(M)){for(r=[],T=DATE_SPLITS[M.length],E=0,c=T.length;E0){for(t=r[0],p=function(e){return Math.abs(e.year-scoring.REFERENCE_YEAR)},g=p(r[0]),k=r.slice(1),y=0,l=k.length;y=j;s=0<=j?++q:--q)for(o=L=b=s+5,N=s+9;(b<=N?L<=N:L>=N)&&!(o>=e.length);o=b<=N?++L:--L)M=e.slice(s,+o+1||9e9),S=d.exec(M),null!=S&&(a=this.map_ints_to_dmy([parseInt(S[1]),parseInt(S[3]),parseInt(S[4])]),null!=a&&_.push({pattern:"date",token:M,i:s,j:o,separator:S[2],year:a.year,month:a.month,day:a.day}));return this.sorted(_.filter(function(e){var t,n,r,i;for(t=!1,i=0,n=_.length;i=e.j){t=!0;break}return!t}))},map_ints_to_dmy:function(e){var t,n,r,i,a,s,o,h,u,c,l,_,f,d,p,g;if(!(e[1]>31||e[1]<=0)){for(o=0,h=0,p=0,s=0,r=e.length;sDATE_MAX_YEAR)return;n>31&&(h+=1),n>12&&(o+=1),n<=0&&(p+=1)}if(!(h>=2||3===o||p>=2)){for(c=[[e[2],e.slice(0,2)],[e[0],e.slice(1,3)]],u=0,i=c.length;u99?e:e>50?e+1900:e+2e3}},module.exports=matching; },{"./adjacency_graphs":1,"./frequency_lists":3,"./scoring":6}],6:[function(require,module,exports){ -var BRUTEFORCE_CARDINALITY,MIN_GUESSES_BEFORE_GROWING_SEQUENCE,MIN_SUBMATCH_GUESSES_MULTI_CHAR,MIN_SUBMATCH_GUESSES_SINGLE_CHAR,adjacency_graphs,calc_average_degree,k,scoring,v;adjacency_graphs=require("./adjacency_graphs"),calc_average_degree=function(e){var t,r,n,s,a,u;t=0;for(n in e)a=e[n],t+=function(){var e,t,r;for(r=[],t=0,e=a.length;te)return 0;if(0===t)return 1;for(s=1,r=n=1,a=t;1<=a?n<=a:n>=a;r=1<=a?++n:--n)s*=e,s/=r,e-=1;return s},log10:function(e){return Math.log(e)/Math.log(10)},log2:function(e){return Math.log(e)/Math.log(2)},factorial:function(e){var t,r,n,s;if(e<2)return 1;for(t=1,r=n=2,s=e;2<=s?n<=s:n>=s;r=2<=s?++n:--n)t*=r;return t},most_guessable_match_sequence:function(e,t,r){var n,s,a,u,i,_,o,h,E,c,g,f,l,p,A,S,R,v,I,M;for(null==r&&(r=!1),g=e.length,c=function(){var e,t,r;for(r=[],n=e=0,t=g;0<=t?et;n=0<=t?++e:--e)r.push([]);return r}(),f=0,_=t.length;f<_;f++)h=t[f],c[h.j].push(h);for(l={m:function(){var e,t,r;for(r=[],n=e=0,t=g;0<=t?et;n=0<=t?++e:--e)r.push({});return r}(),pi:function(){var e,t,r;for(r=[],n=e=0,t=g;0<=t?et;n=0<=t?++e:--e)r.push({});return r}(),g:function(){var e,t,r;for(r=[],n=e=0,t=g;0<=t?et;n=0<=t?++e:--e)r.push(1/0);return r}(),l:function(){var e,t,r;for(r=[],n=e=0,t=g;0<=t?et;n=0<=t?++e:--e)r.push(0);return r}()},M=function(t){return function(n,s){var a,u,i;if(u=n.j,i=t.estimate_guesses(n,e),s>1&&(i*=l.pi[n.i-1][s-1]),a=t.factorial(s)*i,r||(a+=Math.pow(MIN_GUESSES_BEFORE_GROWING_SEQUENCE,s-1)),a=0;)h=l.m[t][r],n.unshift(h),t=h.i-1,r--;return n}}(this),u=A=0,S=g;0<=S?AS;u=0<=S?++A:--A){for(R=c[u],v=0,o=R.length;v0)for(i in l.m[h.i-1])i=parseInt(i),M(h,i+1);else M(h,1);s(u)}return p=I(g),a=0===e.length?1:l.g[g-1],{password:e,guesses:a,guesses_log10:this.log10(a),sequence:p}},estimate_guesses:function(e,t){var r,n,s;return null!=e.guesses?e.guesses:(s=1,e.token.length=c;u=2<=c?++_:--_)for(o=Math.min(A,u-1),i=h=1,g=o;1<=g?h<=g:h>=g;i=1<=g?++h:--h)a+=this.nCk(u-1,i-1)*l*Math.pow(s,i);if(e.shifted_count)if(r=e.shifted_count,n=e.token.length-e.shifted_count,0===r||0===n)a*=2;else{for(p=0,u=S=1,f=Math.min(r,n);1<=f?S<=f:S>=f;u=1<=f?++S:--S)p+=this.nCk(r+n,u);a*=p}return a},dictionary_guesses:function(e){var t;return e.base_guesses=e.rank,e.uppercase_variations=this.uppercase_variations(e),e.l33t_variations=this.l33t_variations(e),t=e.reversed&&2||1,e.base_guesses*e.uppercase_variations*e.l33t_variations*t},START_UPPER:/^[A-Z][^A-Z]+$/,END_UPPER:/^[^A-Z]+[A-Z]$/,ALL_UPPER:/^[^a-z]+$/,ALL_LOWER:/^[^A-Z]+$/,uppercase_variations:function(e){var t,r,n,s,a,u,i,_,o,h,E,c;if(c=e.token,c.match(this.ALL_LOWER)||c.toLowerCase()===c)return 1;for(_=[this.START_UPPER,this.END_UPPER,this.ALL_UPPER],u=0,a=_.length;u=o;s=1<=o?++i:--i)E+=this.nCk(r+t,s);return E},l33t_variations:function(e){var t,r,n,s,a,u,i,_,o,h,E,c,g;if(!e.l33t)return 1;g=1,o=e.sub;for(E in o)if(c=o[E],s=e.token.toLowerCase().split(""),t=function(){var e,t,r;for(r=[],t=0,e=s.length;t=h;a=1<=h?++u:--u)_+=this.nCk(r+t,a);g*=_}return g}},module.exports=scoring; +var BRUTEFORCE_CARDINALITY,MIN_GUESSES_BEFORE_GROWING_SEQUENCE,MIN_SUBMATCH_GUESSES_MULTI_CHAR,MIN_SUBMATCH_GUESSES_SINGLE_CHAR,adjacency_graphs,calc_average_degree,k,scoring,v;adjacency_graphs=require("./adjacency_graphs"),calc_average_degree=function(e){var t,r,n,s,a,i;t=0;for(n in e)a=e[n],t+=function(){var e,t,r;for(r=[],t=0,e=a.length;te)return 0;if(0===t)return 1;for(s=1,r=n=1,a=t;1<=a?n<=a:n>=a;r=1<=a?++n:--n)s*=e,s/=r,e-=1;return s},log10:function(e){return Math.log(e)/Math.log(10)},log2:function(e){return Math.log(e)/Math.log(2)},factorial:function(e){var t,r,n,s;if(e<2)return 1;for(t=1,r=n=2,s=e;2<=s?n<=s:n>=s;r=2<=s?++n:--n)t*=r;return t},most_guessable_match_sequence:function(e,t,r){var n,s,a,i,u,_,o,h,E,c,g,f,l,p,A,S,R,v,I,M,N;for(null==r&&(r=!1),g=e.length,c=function(){var e,t,r;for(r=[],n=e=0,t=g;0<=t?et;n=0<=t?++e:--e)r.push([]);return r}(),f=0,_=t.length;f<_;f++)h=t[f],c[h.j].push(h);for(l={m:function(){var e,t,r;for(r=[],n=e=0,t=g;0<=t?et;n=0<=t?++e:--e)r.push({});return r}(),pi:function(){var e,t,r;for(r=[],n=e=0,t=g;0<=t?et;n=0<=t?++e:--e)r.push({});return r}(),g:function(){var e,t,r;for(r=[],n=e=0,t=g;0<=t?et;n=0<=t?++e:--e)r.push({});return r}()},N=function(t){return function(n,s){var a,i,u,_,o,h;_=n.j,o=t.estimate_guesses(n,e),s>1&&(o*=l.pi[n.i-1][s-1]),u=t.factorial(s)*o,r||(u+=Math.pow(MIN_GUESSES_BEFORE_GROWING_SEQUENCE,s-1)),h=l.g[_];for(i in h)if(a=h[i],!(i>s)&&a<=u)return;return l.g[_][s]=u,l.m[_][s]=n,l.pi[_][s]=o}}(this),s=function(e){return function(e){var t,r,n,s;if(h=E(0,e),N(h,1),0!==e){n=l.m[e-1],s=[];for(t in n)r=n[t],t=parseInt(t),"bruteforce"===r.pattern?(h=E(r.i,e),s.push(N(h,t))):(h=E(e,e),s.push(N(h,t+1)));return s}}}(this),E=function(t){return function(t,r){return{pattern:"bruteforce",token:e.slice(t,+r+1||9e9),i:t,j:r}}}(this),M=function(e){return function(e){var t,r,n,s,a,i,u;i=[],s=e-1,a=void 0,n=1/0,u=l.g[s];for(r in u)t=u[r],t=0;)h=l.m[s][a],i.unshift(h),s=h.i-1,a--;return i}}(this),i=S=0,R=g;0<=R?SR;i=0<=R?++S:--S){for(v=c[i],I=0,o=v.length;I0)for(u in l.m[h.i-1])u=parseInt(u),N(h,u+1);else N(h,1);s(i)}return A=M(g),p=A.length,a=0===e.length?1:l.g[g-1][p],{password:e,guesses:a,guesses_log10:this.log10(a),sequence:A}},estimate_guesses:function(e,t){var r,n,s;return null!=e.guesses?e.guesses:(s=1,e.token.length=c;i=2<=c?++_:--_)for(o=Math.min(A,i-1),u=h=1,g=o;1<=g?h<=g:h>=g;u=1<=g?++h:--h)a+=this.nCk(i-1,u-1)*l*Math.pow(s,u);if(e.shifted_count)if(r=e.shifted_count,n=e.token.length-e.shifted_count,0===r||0===n)a*=2;else{for(p=0,i=S=1,f=Math.min(r,n);1<=f?S<=f:S>=f;i=1<=f?++S:--S)p+=this.nCk(r+n,i);a*=p}return a},dictionary_guesses:function(e){var t;return e.base_guesses=e.rank,e.uppercase_variations=this.uppercase_variations(e),e.l33t_variations=this.l33t_variations(e),t=e.reversed&&2||1,e.base_guesses*e.uppercase_variations*e.l33t_variations*t},START_UPPER:/^[A-Z][^A-Z]+$/,END_UPPER:/^[^A-Z]+[A-Z]$/,ALL_UPPER:/^[^a-z]+$/,ALL_LOWER:/^[^A-Z]+$/,uppercase_variations:function(e){var t,r,n,s,a,i,u,_,o,h,E,c;if(c=e.token,c.match(this.ALL_LOWER)||c.toLowerCase()===c)return 1;for(_=[this.START_UPPER,this.END_UPPER,this.ALL_UPPER],i=0,a=_.length;i=o;s=1<=o?++u:--u)E+=this.nCk(r+t,s);return E},l33t_variations:function(e){var t,r,n,s,a,i,u,_,o,h,E,c,g;if(!e.l33t)return 1;g=1,o=e.sub;for(E in o)if(c=o[E],s=e.token.toLowerCase().split(""),t=function(){var e,t,r;for(r=[],t=0,e=s.length;t=h;a=1<=h?++i:--i)_+=this.nCk(r+t,a);g*=_}return g}},module.exports=scoring; },{"./adjacency_graphs":1}],7:[function(require,module,exports){ var time_estimates;time_estimates={estimate_attack_times:function(e){var t,n,s,o;n={online_throttling_100_per_hour:e/(100/3600),online_no_throttling_10_per_second:e/10,offline_slow_hashing_1e4_per_second:e/1e4,offline_fast_hashing_1e10_per_second:e/1e10},t={};for(s in n)o=n[s],t[s]=this.display_time(o);return{crack_times_seconds:n,crack_times_display:t,score:this.guesses_to_score(e)}},guesses_to_score:function(e){var t;return t=5,e<1e3+t?0:e<1e6+t?1:e<1e8+t?2:e<1e10+t?3:4},display_time:function(e){var t,n,s,o,_,r,i,a,u,c;return i=60,r=60*i,s=24*r,a=31*s,c=12*a,n=100*c,u=e<1?[null,"less than a second"]:e (new Date()).getTime()\n\nzxcvbn = (password, user_inputs = []) ->\n start = time()\n # reset the user inputs matcher on a per-request basis to keep things stateless\n sanitized_inputs = []\n for arg in user_inputs\n if typeof arg in [\"string\", \"number\", \"boolean\"]\n sanitized_inputs.push arg.toString().toLowerCase()\n matching.set_user_input_dictionary sanitized_inputs\n matches = matching.omnimatch password\n result = scoring.most_guessable_match_sequence password, matches\n result.calc_time = time() - start\n attack_times = time_estimates.estimate_attack_times result.guesses\n for prop, val of attack_times\n result[prop] = val\n result.feedback = feedback.get_feedback result.score, result.sequence\n result\n\nmodule.exports = zxcvbn\n", "frequency_lists = require('./frequency_lists')\nadjacency_graphs = require('./adjacency_graphs')\nscoring = require('./scoring')\n\nbuild_ranked_dict = (ordered_list) ->\n result = {}\n i = 1 # rank starts at 1, not 0\n for word in ordered_list\n result[word] = i\n i += 1\n result\n\nRANKED_DICTIONARIES = {}\nfor name, lst of frequency_lists\n RANKED_DICTIONARIES[name] = build_ranked_dict lst\n\nGRAPHS =\n qwerty: adjacency_graphs.qwerty\n dvorak: adjacency_graphs.dvorak\n keypad: adjacency_graphs.keypad\n mac_keypad: adjacency_graphs.mac_keypad\n\nL33T_TABLE =\n a: ['4', '@']\n b: ['8']\n c: ['(', '{', '[', '<']\n e: ['3']\n g: ['6', '9']\n i: ['1', '!', '|']\n l: ['1', '|', '7']\n o: ['0']\n s: ['$', '5']\n t: ['+', '7']\n x: ['%']\n z: ['2']\n\nREGEXEN =\n recent_year: /19\\d\\d|200\\d|201\\d/g\n\nDATE_MAX_YEAR = 2050\nDATE_MIN_YEAR = 1000\nDATE_SPLITS =\n 4:[ # for length-4 strings, eg 1191 or 9111, two ways to split:\n [1, 2] # 1 1 91 (2nd split starts at index 1, 3rd at index 2)\n [2, 3] # 91 1 1\n ]\n 5:[\n [1, 3] # 1 11 91\n [2, 3] # 11 1 91\n ]\n 6:[\n [1, 2] # 1 1 1991\n [2, 4] # 11 11 91\n [4, 5] # 1991 1 1\n ]\n 7:[\n [1, 3] # 1 11 1991\n [2, 3] # 11 1 1991\n [4, 5] # 1991 1 11\n [4, 6] # 1991 11 1\n ]\n 8:[\n [2, 4] # 11 11 1991\n [4, 6] # 1991 11 11\n ]\n\nmatching =\n empty: (obj) -> (k for k of obj).length == 0\n extend: (lst, lst2) -> lst.push.apply lst, lst2\n translate: (string, chr_map) -> (chr_map[chr] or chr for chr in string.split('')).join('')\n mod: (n, m) -> ((n % m) + m) % m # mod impl that works for negative numbers\n sorted: (matches) ->\n # sort on i primary, j secondary\n matches.sort (m1, m2) ->\n (m1.i - m2.i) or (m1.j - m2.j)\n\n # ------------------------------------------------------------------------------\n # omnimatch -- combine everything ----------------------------------------------\n # ------------------------------------------------------------------------------\n\n omnimatch: (password) ->\n matches = []\n matchers = [\n @dictionary_match\n @reverse_dictionary_match\n @l33t_match\n @spatial_match\n @repeat_match\n @sequence_match\n @regex_match\n @date_match\n ]\n for matcher in matchers\n @extend matches, matcher.call(this, password)\n @sorted matches\n\n #-------------------------------------------------------------------------------\n # dictionary match (common passwords, english, last names, etc) ----------------\n #-------------------------------------------------------------------------------\n\n dictionary_match: (password, _ranked_dictionaries = RANKED_DICTIONARIES) ->\n # _ranked_dictionaries variable is for unit testing purposes\n matches = []\n len = password.length\n password_lower = password.toLowerCase()\n for dictionary_name, ranked_dict of _ranked_dictionaries\n for i in [0...len]\n for j in [i...len]\n if password_lower[i..j] of ranked_dict\n word = password_lower[i..j]\n rank = ranked_dict[word]\n matches.push\n pattern: 'dictionary'\n i: i\n j: j\n token: password[i..j]\n matched_word: word\n rank: rank\n dictionary_name: dictionary_name\n reversed: false\n l33t: false\n @sorted matches\n\n reverse_dictionary_match: (password, _ranked_dictionaries = RANKED_DICTIONARIES) ->\n reversed_password = password.split('').reverse().join('')\n matches = @dictionary_match reversed_password, _ranked_dictionaries\n for match in matches\n match.token = match.token.split('').reverse().join('') # reverse back\n match.reversed = true\n # map coordinates back to original string\n [match.i, match.j] = [\n password.length - 1 - match.j\n password.length - 1 - match.i\n ]\n @sorted matches\n\n set_user_input_dictionary: (ordered_list) ->\n RANKED_DICTIONARIES['user_inputs'] = build_ranked_dict ordered_list.slice()\n\n #-------------------------------------------------------------------------------\n # dictionary match with common l33t substitutions ------------------------------\n #-------------------------------------------------------------------------------\n\n # makes a pruned copy of l33t_table that only includes password's possible substitutions\n relevant_l33t_subtable: (password, table) ->\n password_chars = {}\n for chr in password.split('')\n password_chars[chr] = true\n subtable = {}\n for letter, subs of table\n relevant_subs = (sub for sub in subs when sub of password_chars)\n if relevant_subs.length > 0\n subtable[letter] = relevant_subs\n subtable\n\n # returns the list of possible 1337 replacement dictionaries for a given password\n enumerate_l33t_subs: (table) ->\n keys = (k for k of table)\n subs = [[]]\n\n dedup = (subs) ->\n deduped = []\n members = {}\n for sub in subs\n assoc = ([k,v] for k,v in sub)\n assoc.sort()\n label = (k+','+v for k,v in assoc).join('-')\n unless label of members\n members[label] = true\n deduped.push sub\n deduped\n\n helper = (keys) ->\n return if not keys.length\n first_key = keys[0]\n rest_keys = keys[1..]\n next_subs = []\n for l33t_chr in table[first_key]\n for sub in subs\n dup_l33t_index = -1\n for i in [0...sub.length]\n if sub[i][0] == l33t_chr\n dup_l33t_index = i\n break\n if dup_l33t_index == -1\n sub_extension = sub.concat [[l33t_chr, first_key]]\n next_subs.push sub_extension\n else\n sub_alternative = sub.slice(0)\n sub_alternative.splice(dup_l33t_index, 1)\n sub_alternative.push [l33t_chr, first_key]\n next_subs.push sub\n next_subs.push sub_alternative\n subs = dedup next_subs\n helper(rest_keys)\n\n helper(keys)\n sub_dicts = [] # convert from assoc lists to dicts\n for sub in subs\n sub_dict = {}\n for [l33t_chr, chr] in sub\n sub_dict[l33t_chr] = chr\n sub_dicts.push sub_dict\n sub_dicts\n\n l33t_match: (password, _ranked_dictionaries = RANKED_DICTIONARIES, _l33t_table = L33T_TABLE) ->\n matches = []\n for sub in @enumerate_l33t_subs @relevant_l33t_subtable(password, _l33t_table)\n break if @empty sub # corner case: password has no relevant subs.\n subbed_password = @translate password, sub\n for match in @dictionary_match(subbed_password, _ranked_dictionaries)\n token = password[match.i..match.j]\n if token.toLowerCase() == match.matched_word\n continue # only return the matches that contain an actual substitution\n match_sub = {} # subset of mappings in sub that are in use for this match\n for subbed_chr, chr of sub when token.indexOf(subbed_chr) != -1\n match_sub[subbed_chr] = chr\n match.l33t = true\n match.token = token\n match.sub = match_sub\n match.sub_display = (\"#{k} -> #{v}\" for k,v of match_sub).join(', ')\n matches.push match\n @sorted matches.filter (match) ->\n # filter single-character l33t matches to reduce noise.\n # otherwise '1' matches 'i', '4' matches 'a', both very common English words\n # with low dictionary rank.\n match.token.length > 1\n\n # ------------------------------------------------------------------------------\n # spatial match (qwerty/dvorak/keypad) -----------------------------------------\n # ------------------------------------------------------------------------------\n\n spatial_match: (password, _graphs = GRAPHS) ->\n matches = []\n for graph_name, graph of _graphs\n @extend matches, @spatial_match_helper(password, graph, graph_name)\n @sorted matches\n\n SHIFTED_RX: /[~!@#$%^&*()_+QWERTYUIOP{}|ASDFGHJKL:\"ZXCVBNM<>?]/\n spatial_match_helper: (password, graph, graph_name) ->\n matches = []\n i = 0\n while i < password.length - 1\n j = i + 1\n last_direction = null\n turns = 0\n if graph_name in ['qwerty', 'dvorak'] and @SHIFTED_RX.exec(password.charAt(i))\n # initial character is shifted\n shifted_count = 1\n else\n shifted_count = 0\n loop\n prev_char = password.charAt(j-1)\n found = false\n found_direction = -1\n cur_direction = -1\n adjacents = graph[prev_char] or []\n # consider growing pattern by one character if j hasn't gone over the edge.\n if j < password.length\n cur_char = password.charAt(j)\n for adj in adjacents\n cur_direction += 1\n if adj and adj.indexOf(cur_char) != -1\n found = true\n found_direction = cur_direction\n if adj.indexOf(cur_char) == 1\n # index 1 in the adjacency means the key is shifted,\n # 0 means unshifted: A vs a, % vs 5, etc.\n # for example, 'q' is adjacent to the entry '2@'.\n # @ is shifted w/ index 1, 2 is unshifted.\n shifted_count += 1\n if last_direction != found_direction\n # adding a turn is correct even in the initial case when last_direction is null:\n # every spatial pattern starts with a turn.\n turns += 1\n last_direction = found_direction\n break\n # if the current pattern continued, extend j and try to grow again\n if found\n j += 1\n # otherwise push the pattern discovered so far, if any...\n else\n if j - i > 2 # don't consider length 1 or 2 chains.\n matches.push\n pattern: 'spatial'\n i: i\n j: j-1\n token: password[i...j]\n graph: graph_name\n turns: turns\n shifted_count: shifted_count\n # ...and then start a new search for the rest of the password.\n i = j\n break\n matches\n\n #-------------------------------------------------------------------------------\n # repeats (aaa, abcabcabc) and sequences (abcdef) ------------------------------\n #-------------------------------------------------------------------------------\n\n repeat_match: (password) ->\n matches = []\n greedy = /(.+)\\1+/g\n lazy = /(.+?)\\1+/g\n lazy_anchored = /^(.+?)\\1+$/\n lastIndex = 0\n while lastIndex < password.length\n greedy.lastIndex = lazy.lastIndex = lastIndex\n greedy_match = greedy.exec password\n lazy_match = lazy.exec password\n break unless greedy_match?\n if greedy_match[0].length > lazy_match[0].length\n # greedy beats lazy for 'aabaab'\n # greedy: [aabaab, aab]\n # lazy: [aa, a]\n match = greedy_match\n # greedy's repeated string might itself be repeated, eg.\n # aabaab in aabaabaabaab.\n # run an anchored lazy match on greedy's repeated string\n # to find the shortest repeated string\n base_token = lazy_anchored.exec(match[0])[1]\n else\n # lazy beats greedy for 'aaaaa'\n # greedy: [aaaa, aa]\n # lazy: [aaaaa, a]\n match = lazy_match\n base_token = match[1]\n [i, j] = [match.index, match.index + match[0].length - 1]\n # recursively match and score the base string\n base_analysis = scoring.most_guessable_match_sequence(\n base_token\n @omnimatch base_token\n )\n base_matches = base_analysis.match_sequence\n base_guesses = base_analysis.guesses\n matches.push\n pattern: 'repeat'\n i: i\n j: j\n token: match[0]\n base_token: base_token\n base_guesses: base_guesses\n base_matches: base_matches\n repeat_count: match[0].length / base_token.length\n lastIndex = j + 1\n matches\n\n MAX_DELTA: 5\n sequence_match: (password) ->\n # Identifies sequences by looking for repeated differences in unicode codepoint.\n # this allows skipping, such as 9753, and also matches some extended unicode sequences\n # such as Greek and Cyrillic alphabets.\n #\n # for example, consider the input 'abcdb975zy'\n #\n # password: a b c d b 9 7 5 z y\n # index: 0 1 2 3 4 5 6 7 8 9\n # delta: 1 1 1 -2 -41 -2 -2 69 1\n #\n # expected result:\n # [(i, j, delta), ...] = [(0, 3, 1), (5, 7, -2), (8, 9, 1)]\n\n return [] if password.length == 1\n\n update = (i, j, delta) =>\n if j - i > 1 or Math.abs(delta) == 1\n if 0 < Math.abs(delta) <= @MAX_DELTA\n token = password[i..j]\n if /^[a-z]+$/.test(token)\n sequence_name = 'lower'\n sequence_space = 26\n else if /^[A-Z]+$/.test(token)\n sequence_name = 'upper'\n sequence_space = 26\n else if /^\\d+$/.test(token)\n sequence_name = 'digits'\n sequence_space = 10\n else\n # conservatively stick with roman alphabet size.\n # (this could be improved)\n sequence_name = 'unicode'\n sequence_space = 26\n result.push\n pattern: 'sequence'\n i: i\n j: j\n token: password[i..j]\n sequence_name: sequence_name\n sequence_space: sequence_space\n ascending: delta > 0\n\n result = []\n i = 0\n last_delta = null\n\n for k in [1...password.length]\n delta = password.charCodeAt(k) - password.charCodeAt(k - 1)\n unless last_delta?\n last_delta = delta\n continue if delta == last_delta\n j = k - 1\n update(i, j, last_delta)\n i = j\n last_delta = delta\n update(i, password.length - 1, last_delta)\n result\n\n #-------------------------------------------------------------------------------\n # regex matching ---------------------------------------------------------------\n #-------------------------------------------------------------------------------\n\n regex_match: (password, _regexen = REGEXEN) ->\n matches = []\n for name, regex of _regexen\n regex.lastIndex = 0 # keeps regex_match stateless\n while rx_match = regex.exec password\n token = rx_match[0]\n matches.push\n pattern: 'regex'\n token: token\n i: rx_match.index\n j: rx_match.index + rx_match[0].length - 1\n regex_name: name\n regex_match: rx_match\n @sorted matches\n\n #-------------------------------------------------------------------------------\n # date matching ----------------------------------------------------------------\n #-------------------------------------------------------------------------------\n\n date_match: (password) ->\n # a \"date\" is recognized as:\n # any 3-tuple that starts or ends with a 2- or 4-digit year,\n # with 2 or 0 separator chars (1.1.91 or 1191),\n # maybe zero-padded (01-01-91 vs 1-1-91),\n # a month between 1 and 12,\n # a day between 1 and 31.\n #\n # note: this isn't true date parsing in that \"feb 31st\" is allowed,\n # this doesn't check for leap years, etc.\n #\n # recipe:\n # start with regex to find maybe-dates, then attempt to map the integers\n # onto month-day-year to filter the maybe-dates into dates.\n # finally, remove matches that are substrings of other matches to reduce noise.\n #\n # note: instead of using a lazy or greedy regex to find many dates over the full string,\n # this uses a ^...$ regex against every substring of the password -- less performant but leads\n # to every possible date match.\n matches = []\n maybe_date_no_separator = /^\\d{4,8}$/\n maybe_date_with_separator = ///\n ^\n ( \\d{1,4} ) # day, month, year\n ( [\\s/\\\\_.-] ) # separator\n ( \\d{1,2} ) # day, month\n \\2 # same separator\n ( \\d{1,4} ) # day, month, year\n $\n ///\n\n # dates without separators are between length 4 '1191' and 8 '11111991'\n for i in [0..password.length - 4]\n for j in [i + 3..i + 7]\n break if j >= password.length\n token = password[i..j]\n continue unless maybe_date_no_separator.exec token\n candidates = []\n for [k,l] in DATE_SPLITS[token.length]\n dmy = @map_ints_to_dmy [\n parseInt token[0...k]\n parseInt token[k...l]\n parseInt token[l...]\n ]\n candidates.push dmy if dmy?\n continue unless candidates.length > 0\n # at this point: different possible dmy mappings for the same i,j substring.\n # match the candidate date that likely takes the fewest guesses: a year closest to 2000.\n # (scoring.REFERENCE_YEAR).\n #\n # ie, considering '111504', prefer 11-15-04 to 1-1-1504\n # (interpreting '04' as 2004)\n best_candidate = candidates[0]\n metric = (candidate) -> Math.abs candidate.year - scoring.REFERENCE_YEAR\n min_distance = metric candidates[0]\n for candidate in candidates[1..]\n distance = metric candidate\n if distance < min_distance\n [best_candidate, min_distance] = [candidate, distance]\n matches.push\n pattern: 'date'\n token: token\n i: i\n j: j\n separator: ''\n year: best_candidate.year\n month: best_candidate.month\n day: best_candidate.day\n\n # dates with separators are between length 6 '1/1/91' and 10 '11/11/1991'\n for i in [0..password.length - 6]\n for j in [i + 5..i + 9]\n break if j >= password.length\n token = password[i..j]\n rx_match = maybe_date_with_separator.exec token\n continue unless rx_match?\n dmy = @map_ints_to_dmy [\n parseInt rx_match[1]\n parseInt rx_match[3]\n parseInt rx_match[4]\n ]\n continue unless dmy?\n matches.push\n pattern: 'date'\n token: token\n i: i\n j: j\n separator: rx_match[2]\n year: dmy.year\n month: dmy.month\n day: dmy.day\n\n # matches now contains all valid date strings in a way that is tricky to capture\n # with regexes only. while thorough, it will contain some unintuitive noise:\n #\n # '2015_06_04', in addition to matching 2015_06_04, will also contain\n # 5(!) other date matches: 15_06_04, 5_06_04, ..., even 2015 (matched as 5/1/2020)\n #\n # to reduce noise, remove date matches that are strict substrings of others\n @sorted matches.filter (match) ->\n is_submatch = false\n for other_match in matches\n continue if match is other_match\n if other_match.i <= match.i and other_match.j >= match.j\n is_submatch = true\n break\n not is_submatch\n\n map_ints_to_dmy: (ints) ->\n # given a 3-tuple, discard if:\n # middle int is over 31 (for all dmy formats, years are never allowed in the middle)\n # middle int is zero\n # any int is over the max allowable year\n # any int is over two digits but under the min allowable year\n # 2 ints are over 31, the max allowable day\n # 2 ints are zero\n # all ints are over 12, the max allowable month\n return if ints[1] > 31 or ints[1] <= 0\n over_12 = 0\n over_31 = 0\n under_1 = 0\n for int in ints\n return if 99 < int < DATE_MIN_YEAR or int > DATE_MAX_YEAR\n over_31 += 1 if int > 31\n over_12 += 1 if int > 12\n under_1 += 1 if int <= 0\n return if over_31 >= 2 or over_12 == 3 or under_1 >= 2\n\n # first look for a four digit year: yyyy + daymonth or daymonth + yyyy\n possible_year_splits = [\n [ints[2], ints[0..1]] # year last\n [ints[0], ints[1..2]] # year first\n ]\n for [y, rest] in possible_year_splits\n if DATE_MIN_YEAR <= y <= DATE_MAX_YEAR\n dm = @map_ints_to_dm rest\n if dm?\n return {\n year: y\n month: dm.month\n day: dm.day\n }\n else\n # for a candidate that includes a four-digit year,\n # when the remaining ints don't match to a day and month,\n # it is not a date.\n return\n\n # given no four-digit year, two digit years are the most flexible int to match, so\n # try to parse a day-month out of ints[0..1] or ints[1..0]\n for [y, rest] in possible_year_splits\n dm = @map_ints_to_dm rest\n if dm?\n y = @two_to_four_digit_year y\n return {\n year: y\n month: dm.month\n day: dm.day\n }\n\n map_ints_to_dm: (ints) ->\n for [d, m] in [ints, ints.slice().reverse()]\n if 1 <= d <= 31 and 1 <= m <= 12\n return {\n day: d\n month: m\n }\n\n two_to_four_digit_year: (year) ->\n if year > 99\n year\n else if year > 50\n # 87 -> 1987\n year + 1900\n else\n # 15 -> 2015\n year + 2000\n\nmodule.exports = matching\n", - "adjacency_graphs = require('./adjacency_graphs')\n\n# on qwerty, 'g' has degree 6, being adjacent to 'ftyhbv'. '\\' has degree 1.\n# this calculates the average over all keys.\ncalc_average_degree = (graph) ->\n average = 0\n for key, neighbors of graph\n average += (n for n in neighbors when n).length\n average /= (k for k,v of graph).length\n average\n\nBRUTEFORCE_CARDINALITY = 10\nMIN_GUESSES_BEFORE_GROWING_SEQUENCE = 10000\nMIN_SUBMATCH_GUESSES_SINGLE_CHAR = 10\nMIN_SUBMATCH_GUESSES_MULTI_CHAR = 50\n\nscoring =\n nCk: (n, k) ->\n # http://blog.plover.com/math/choose.html\n return 0 if k > n\n return 1 if k == 0\n r = 1\n for d in [1..k]\n r *= n\n r /= d\n n -= 1\n r\n\n log10: (n) -> Math.log(n) / Math.log(10) # IE doesn't support Math.log10 :(\n log2: (n) -> Math.log(n) / Math.log(2)\n\n factorial: (n) ->\n # unoptimized, called only on small n\n return 1 if n < 2\n f = 1\n f *= i for i in [2..n]\n f\n\n # ------------------------------------------------------------------------------\n # search --- most guessable match sequence -------------------------------------\n # ------------------------------------------------------------------------------\n #\n # takes a sequence of overlapping matches, returns the non-overlapping sequence with\n # minimum guesses. the following is a O(l_max * (n + m)) dynamic programming algorithm\n # for a length-n password with m candidate matches. l_max is the maximum optimal\n # sequence length spanning each prefix of the password. In practice it rarely exceeds 5 and the\n # search terminates rapidly.\n #\n # the optimal \"minimum guesses\" sequence is here defined to be the sequence that\n # minimizes the following function:\n #\n # l! * Product(m.guesses for m in sequence) + D^(l - 1)\n #\n # where l is the length of the sequence.\n #\n # the factorial term is the number of ways to order l patterns.\n #\n # the D^(l-1) term is another length penalty, roughly capturing the idea that an\n # attacker will try lower-length sequences first before trying length-l sequences.\n #\n # for example, consider a sequence that is date-repeat-dictionary.\n # - an attacker would need to try other date-repeat-dictionary combinations,\n # hence the product term.\n # - an attacker would need to try repeat-date-dictionary, dictionary-repeat-date,\n # ..., hence the factorial term.\n # - an attacker would also likely try length-1 (dictionary) and length-2 (dictionary-date)\n # sequences before length-3. assuming at minimum D guesses per pattern type,\n # D^(l-1) approximates Sum(D^i for i in [1..l-1]\n #\n # ------------------------------------------------------------------------------\n\n most_guessable_match_sequence: (password, matches, _exclude_additive=false) ->\n\n n = password.length\n\n # partition matches into sublists according to ending index j\n matches_by_j = ([] for _ in [0...n])\n for m in matches\n matches_by_j[m.j].push m\n\n optimal =\n # optimal.m[k][l] holds final match in the best length-l match sequence covering the\n # password prefix up to k, inclusive.\n # if there is no length-l sequence that scores better (fewer guesses) than\n # a shorter match sequence spanning the same prefix, optimal.m[k][l] is undefined.\n m: ({} for _ in [0...n])\n\n # same structure as optimal.m, except holds the product term Prod(m.guesses for m in sequence).\n # optimal.pi allows for fast (non-looping) updates to the minimization function.\n pi: ({} for _ in [0...n])\n\n # optimal.g[k] holds the lowest guesses up to k according to the minimization function.\n g: (Infinity for _ in [0...n])\n\n # optimal.l[k] holds the length, l, of the optimal sequence covering up to k.\n # (this is also the largest key in optimal.m[k] and optimal.pi[k] objects)\n l: (0 for _ in [0...n])\n\n # helper: considers whether a length-l sequence ending at match m is better (fewer guesses)\n # than previously encountered sequences, updating state if so.\n update = (m, l) =>\n k = m.j\n pi = @estimate_guesses m, password\n if l > 1\n # we're considering a length-l sequence ending with match m:\n # obtain the product term in the minimization function by multiplying m's guesses\n # by the product of the length-(l-1) sequence ending just before m, at m.i - 1.\n pi *= optimal.pi[m.i - 1][l - 1]\n # calculate the minimization func\n g = @factorial(l) * pi\n unless _exclude_additive\n g += Math.pow(MIN_GUESSES_BEFORE_GROWING_SEQUENCE, l - 1)\n # update state if new best\n if g < optimal.g[k]\n optimal.g[k] = g\n optimal.l[k] = l\n optimal.m[k][l] = m\n optimal.pi[k][l] = pi\n\n # helper: considers whether bruteforce matches ending at position k are optimal.\n # three cases to consider...\n bruteforce_update = (k) =>\n # case 1: a bruteforce match spanning the full prefix.\n m = make_bruteforce_match(0, k)\n update(m, 1)\n return if k == 0\n for l, last_m of optimal.m[k - 1]\n l = parseInt(l) # note: js stores object keys as strings\n if last_m.pattern == 'bruteforce'\n # case 2: if the optimal length-l sequence up to k - 1 ended in a bruteforce match,\n # consider whether extending it by one character is optimal up to k.\n # this preserves the sequence length l.\n m = make_bruteforce_match(last_m.i, k)\n update(m, l)\n else\n # case 3: if the optimal length-l sequence up to k - 1 ends in a non-bruteforce match,\n # consider whether starting a new single-character bruteforce match is optimal.\n # this adds a new match, adding 1 to the prior sequence length l.\n m = make_bruteforce_match(k, k)\n update(m, l + 1)\n\n # helper: make bruteforce match objects spanning i to j, inclusive.\n make_bruteforce_match = (i, j) =>\n pattern: 'bruteforce'\n token: password[i..j]\n i: i\n j: j\n\n # helper: step backwards through optimal.m starting at the end,\n # constructing the final optimal match sequence.\n unwind = (n) =>\n optimal_match_sequence = []\n k = n - 1\n l = optimal.l[k]\n while k >= 0\n m = optimal.m[k][l]\n optimal_match_sequence.unshift m\n k = m.i - 1\n l--\n optimal_match_sequence\n\n for k in [0...n]\n for m in matches_by_j[k]\n if m.i > 0\n for l of optimal.m[m.i - 1]\n l = parseInt(l)\n update(m, l + 1)\n else\n update(m, 1)\n bruteforce_update(k)\n optimal_match_sequence = unwind(n)\n\n # corner: empty password\n if password.length == 0\n guesses = 1\n else\n guesses = optimal.g[n - 1]\n\n # final result object\n password: password\n guesses: guesses\n guesses_log10: @log10 guesses\n sequence: optimal_match_sequence\n\n # ------------------------------------------------------------------------------\n # guess estimation -- one function per match pattern ---------------------------\n # ------------------------------------------------------------------------------\n\n estimate_guesses: (match, password) ->\n return match.guesses if match.guesses? # a match's guess estimate doesn't change. cache it.\n min_guesses = 1\n if match.token.length < password.length\n min_guesses = if match.token.length == 1\n MIN_SUBMATCH_GUESSES_SINGLE_CHAR\n else\n MIN_SUBMATCH_GUESSES_MULTI_CHAR\n estimation_functions =\n bruteforce: @bruteforce_guesses\n dictionary: @dictionary_guesses\n spatial: @spatial_guesses\n repeat: @repeat_guesses\n sequence: @sequence_guesses\n regex: @regex_guesses\n date: @date_guesses\n guesses = estimation_functions[match.pattern].call this, match\n match.guesses = Math.max guesses, min_guesses\n match.guesses_log10 = @log10 match.guesses\n match.guesses\n\n bruteforce_guesses: (match) ->\n guesses = Math.pow BRUTEFORCE_CARDINALITY, match.token.length\n # small detail: make bruteforce matches at minimum one guess bigger than smallest allowed\n # submatch guesses, such that non-bruteforce submatches over the same [i..j] take precidence.\n min_guesses = if match.token.length == 1\n MIN_SUBMATCH_GUESSES_SINGLE_CHAR + 1\n else\n MIN_SUBMATCH_GUESSES_MULTI_CHAR + 1\n Math.max guesses, min_guesses\n\n repeat_guesses: (match) ->\n match.base_guesses * match.repeat_count\n\n sequence_guesses: (match) ->\n first_chr = match.token.charAt(0)\n # lower guesses for obvious starting points\n if first_chr in ['a', 'A', 'z', 'Z', '0', '1', '9']\n base_guesses = 4\n else\n if first_chr.match /\\d/\n base_guesses = 10 # digits\n else\n # could give a higher base for uppercase,\n # assigning 26 to both upper and lower sequences is more conservative.\n base_guesses = 26\n if not match.ascending\n # need to try a descending sequence in addition to every ascending sequence ->\n # 2x guesses\n base_guesses *= 2\n base_guesses * match.token.length\n\n MIN_YEAR_SPACE: 20\n REFERENCE_YEAR: 2016\n\n regex_guesses: (match) ->\n char_class_bases =\n alpha_lower: 26\n alpha_upper: 26\n alpha: 52\n alphanumeric: 62\n digits: 10\n symbols: 33\n if match.regex_name of char_class_bases\n Math.pow(char_class_bases[match.regex_name], match.token.length)\n else switch match.regex_name\n when 'recent_year'\n # conservative estimate of year space: num years from REFERENCE_YEAR.\n # if year is close to REFERENCE_YEAR, estimate a year space of MIN_YEAR_SPACE.\n year_space = Math.abs parseInt(match.regex_match[0]) - @REFERENCE_YEAR\n year_space = Math.max year_space, @MIN_YEAR_SPACE\n year_space\n\n date_guesses: (match) ->\n # base guesses: (year distance from REFERENCE_YEAR) * num_days * num_years\n year_space = Math.max(Math.abs(match.year - @REFERENCE_YEAR), @MIN_YEAR_SPACE)\n guesses = year_space * 365\n # double for four-digit years\n guesses *= 2 if match.has_full_year\n # add factor of 4 for separator selection (one of ~4 choices)\n guesses *= 4 if match.separator\n guesses\n\n KEYBOARD_AVERAGE_DEGREE: calc_average_degree(adjacency_graphs.qwerty)\n # slightly different for keypad/mac keypad, but close enough\n KEYPAD_AVERAGE_DEGREE: calc_average_degree(adjacency_graphs.keypad)\n\n KEYBOARD_STARTING_POSITIONS: (k for k,v of adjacency_graphs.qwerty).length\n KEYPAD_STARTING_POSITIONS: (k for k,v of adjacency_graphs.keypad).length\n\n spatial_guesses: (match) ->\n if match.graph in ['qwerty', 'dvorak']\n s = @KEYBOARD_STARTING_POSITIONS\n d = @KEYBOARD_AVERAGE_DEGREE\n else\n s = @KEYPAD_STARTING_POSITIONS\n d = @KEYPAD_AVERAGE_DEGREE\n guesses = 0\n L = match.token.length\n t = match.turns\n # estimate the number of possible patterns w/ length L or less with t turns or less.\n for i in [2..L]\n possible_turns = Math.min(t, i - 1)\n for j in [1..possible_turns]\n guesses += @nCk(i - 1, j - 1) * s * Math.pow(d, j)\n # add extra guesses for shifted keys. (% instead of 5, A instead of a.)\n # math is similar to extra guesses of l33t substitutions in dictionary matches.\n if match.shifted_count\n S = match.shifted_count\n U = match.token.length - match.shifted_count # unshifted count\n if S == 0 or U == 0\n guesses *= 2\n else\n shifted_variations = 0\n shifted_variations += @nCk(S + U, i) for i in [1..Math.min(S, U)]\n guesses *= shifted_variations\n guesses\n\n dictionary_guesses: (match) ->\n match.base_guesses = match.rank # keep these as properties for display purposes\n match.uppercase_variations = @uppercase_variations match\n match.l33t_variations = @l33t_variations match\n reversed_variations = match.reversed and 2 or 1\n match.base_guesses * match.uppercase_variations * match.l33t_variations * reversed_variations\n\n START_UPPER: /^[A-Z][^A-Z]+$/\n END_UPPER: /^[^A-Z]+[A-Z]$/\n ALL_UPPER: /^[^a-z]+$/\n ALL_LOWER: /^[^A-Z]+$/\n\n uppercase_variations: (match) ->\n word = match.token\n return 1 if word.match(@ALL_LOWER) or word.toLowerCase() == word\n # a capitalized word is the most common capitalization scheme,\n # so it only doubles the search space (uncapitalized + capitalized).\n # allcaps and end-capitalized are common enough too, underestimate as 2x factor to be safe.\n for regex in [@START_UPPER, @END_UPPER, @ALL_UPPER]\n return 2 if word.match regex\n # otherwise calculate the number of ways to capitalize U+L uppercase+lowercase letters\n # with U uppercase letters or less. or, if there's more uppercase than lower (for eg. PASSwORD),\n # the number of ways to lowercase U+L letters with L lowercase letters or less.\n U = (chr for chr in word.split('') when chr.match /[A-Z]/).length\n L = (chr for chr in word.split('') when chr.match /[a-z]/).length\n variations = 0\n variations += @nCk(U + L, i) for i in [1..Math.min(U, L)]\n variations\n\n l33t_variations: (match) ->\n return 1 if not match.l33t\n variations = 1\n for subbed, unsubbed of match.sub\n # lower-case match.token before calculating: capitalization shouldn't affect l33t calc.\n chrs = match.token.toLowerCase().split('')\n S = (chr for chr in chrs when chr == subbed).length # num of subbed chars\n U = (chr for chr in chrs when chr == unsubbed).length # num of unsubbed chars\n if S == 0 or U == 0\n # for this sub, password is either fully subbed (444) or fully unsubbed (aaa)\n # treat that as doubling the space (attacker needs to try fully subbed chars in addition to\n # unsubbed.)\n variations *= 2\n else\n # this case is similar to capitalization:\n # with aa44a, U = 3, S = 2, attacker needs to try unsubbed + one sub + two subs\n p = Math.min(U, S)\n possibilities = 0\n possibilities += @nCk(U + S, i) for i in [1..p]\n variations *= possibilities\n variations\n\n # utilities --------------------------------------------------------------------\n\nmodule.exports = scoring\n", + "adjacency_graphs = require('./adjacency_graphs')\n\n# on qwerty, 'g' has degree 6, being adjacent to 'ftyhbv'. '\\' has degree 1.\n# this calculates the average over all keys.\ncalc_average_degree = (graph) ->\n average = 0\n for key, neighbors of graph\n average += (n for n in neighbors when n).length\n average /= (k for k,v of graph).length\n average\n\nBRUTEFORCE_CARDINALITY = 10\nMIN_GUESSES_BEFORE_GROWING_SEQUENCE = 10000\nMIN_SUBMATCH_GUESSES_SINGLE_CHAR = 10\nMIN_SUBMATCH_GUESSES_MULTI_CHAR = 50\n\nscoring =\n nCk: (n, k) ->\n # http://blog.plover.com/math/choose.html\n return 0 if k > n\n return 1 if k == 0\n r = 1\n for d in [1..k]\n r *= n\n r /= d\n n -= 1\n r\n\n log10: (n) -> Math.log(n) / Math.log(10) # IE doesn't support Math.log10 :(\n log2: (n) -> Math.log(n) / Math.log(2)\n\n factorial: (n) ->\n # unoptimized, called only on small n\n return 1 if n < 2\n f = 1\n f *= i for i in [2..n]\n f\n\n # ------------------------------------------------------------------------------\n # search --- most guessable match sequence -------------------------------------\n # ------------------------------------------------------------------------------\n #\n # takes a sequence of overlapping matches, returns the non-overlapping sequence with\n # minimum guesses. the following is a O(l_max * (n + m)) dynamic programming algorithm\n # for a length-n password with m candidate matches. l_max is the maximum optimal\n # sequence length spanning each prefix of the password. In practice it rarely exceeds 5 and the\n # search terminates rapidly.\n #\n # the optimal \"minimum guesses\" sequence is here defined to be the sequence that\n # minimizes the following function:\n #\n # g = l! * Product(m.guesses for m in sequence) + D^(l - 1)\n #\n # where l is the length of the sequence.\n #\n # the factorial term is the number of ways to order l patterns.\n #\n # the D^(l-1) term is another length penalty, roughly capturing the idea that an\n # attacker will try lower-length sequences first before trying length-l sequences.\n #\n # for example, consider a sequence that is date-repeat-dictionary.\n # - an attacker would need to try other date-repeat-dictionary combinations,\n # hence the product term.\n # - an attacker would need to try repeat-date-dictionary, dictionary-repeat-date,\n # ..., hence the factorial term.\n # - an attacker would also likely try length-1 (dictionary) and length-2 (dictionary-date)\n # sequences before length-3. assuming at minimum D guesses per pattern type,\n # D^(l-1) approximates Sum(D^i for i in [1..l-1]\n #\n # ------------------------------------------------------------------------------\n\n most_guessable_match_sequence: (password, matches, _exclude_additive=false) ->\n\n n = password.length\n\n # partition matches into sublists according to ending index j\n matches_by_j = ([] for _ in [0...n])\n for m in matches\n matches_by_j[m.j].push m\n # small detail: for deterministic output, sort each subarray by i.\n #for sub in matches_by_j\n # sub.sort (m1, m2) -> m1.i - m2.i\n\n optimal =\n # optimal.m[k][l] holds final match in the best length-l match sequence covering the\n # password prefix up to k, inclusive.\n # if there is no length-l sequence that scores better (fewer guesses) than\n # a shorter match sequence spanning the same prefix, optimal.m[k][l] is undefined.\n m: ({} for _ in [0...n])\n\n # same structure as optimal.m -- holds the product term Prod(m.guesses for m in sequence).\n # optimal.pi allows for fast (non-looping) updates to the minimization function.\n pi: ({} for _ in [0...n])\n\n # same structure as optimal.m -- holds the overall metric.\n g: ({} for _ in [0...n])\n\n # helper: considers whether a length-l sequence ending at match m is better (fewer guesses)\n # than previously encountered sequences, updating state if so.\n update = (m, l) =>\n k = m.j\n pi = @estimate_guesses m, password\n if l > 1\n # we're considering a length-l sequence ending with match m:\n # obtain the product term in the minimization function by multiplying m's guesses\n # by the product of the length-(l-1) sequence ending just before m, at m.i - 1.\n pi *= optimal.pi[m.i - 1][l - 1]\n # calculate the minimization func\n g = @factorial(l) * pi\n unless _exclude_additive\n g += Math.pow(MIN_GUESSES_BEFORE_GROWING_SEQUENCE, l - 1)\n # update state if new best.\n # first see if any competing sequences covering this prefix, with l or fewer matches,\n # fare better than this sequence. if so, skip it and return.\n for competing_l, competing_g of optimal.g[k]\n continue if competing_l > l\n return if competing_g <= g\n # this sequence might be part of the final optimal sequence.\n optimal.g[k][l] = g\n optimal.m[k][l] = m\n optimal.pi[k][l] = pi\n\n # helper: considers whether bruteforce matches ending at position k are optimal.\n # three cases to consider...\n bruteforce_update = (k) =>\n # case 1: a bruteforce match spanning the full prefix.\n m = make_bruteforce_match(0, k)\n update(m, 1)\n return if k == 0\n for l, last_m of optimal.m[k - 1]\n l = parseInt(l) # note: js stores object keys as strings\n if last_m.pattern == 'bruteforce'\n # case 2: if the optimal length-l sequence up to k - 1 ended in a bruteforce match,\n # consider whether extending it by one character is optimal up to k.\n # this preserves the sequence length l.\n m = make_bruteforce_match(last_m.i, k)\n update(m, l)\n else\n # case 3: if the optimal length-l sequence up to k - 1 ends in a non-bruteforce match,\n # consider whether starting a new single-character bruteforce match is optimal.\n # this adds a new match, adding 1 to the prior sequence length l.\n m = make_bruteforce_match(k, k)\n update(m, l + 1)\n\n # helper: make bruteforce match objects spanning i to j, inclusive.\n make_bruteforce_match = (i, j) =>\n pattern: 'bruteforce'\n token: password[i..j]\n i: i\n j: j\n\n # helper: step backwards through optimal.m starting at the end,\n # constructing the final optimal match sequence.\n unwind = (n) =>\n optimal_match_sequence = []\n k = n - 1\n # find the final best sequence length and score\n l = undefined\n g = Infinity\n for candidate_l, candidate_g of optimal.g[k]\n if candidate_g < g\n l = candidate_l\n g = candidate_g\n\n while k >= 0\n m = optimal.m[k][l]\n optimal_match_sequence.unshift m\n k = m.i - 1\n l--\n optimal_match_sequence\n\n for k in [0...n]\n for m in matches_by_j[k]\n if m.i > 0\n for l of optimal.m[m.i - 1]\n l = parseInt(l)\n update(m, l + 1)\n else\n update(m, 1)\n bruteforce_update(k)\n optimal_match_sequence = unwind(n)\n optimal_l = optimal_match_sequence.length\n\n # corner: empty password\n if password.length == 0\n guesses = 1\n else\n guesses = optimal.g[n - 1][optimal_l]\n\n # final result object\n password: password\n guesses: guesses\n guesses_log10: @log10 guesses\n sequence: optimal_match_sequence\n\n # ------------------------------------------------------------------------------\n # guess estimation -- one function per match pattern ---------------------------\n # ------------------------------------------------------------------------------\n\n estimate_guesses: (match, password) ->\n return match.guesses if match.guesses? # a match's guess estimate doesn't change. cache it.\n min_guesses = 1\n if match.token.length < password.length\n min_guesses = if match.token.length == 1\n MIN_SUBMATCH_GUESSES_SINGLE_CHAR\n else\n MIN_SUBMATCH_GUESSES_MULTI_CHAR\n estimation_functions =\n bruteforce: @bruteforce_guesses\n dictionary: @dictionary_guesses\n spatial: @spatial_guesses\n repeat: @repeat_guesses\n sequence: @sequence_guesses\n regex: @regex_guesses\n date: @date_guesses\n guesses = estimation_functions[match.pattern].call this, match\n match.guesses = Math.max guesses, min_guesses\n match.guesses_log10 = @log10 match.guesses\n match.guesses\n\n bruteforce_guesses: (match) ->\n guesses = Math.pow BRUTEFORCE_CARDINALITY, match.token.length\n # small detail: make bruteforce matches at minimum one guess bigger than smallest allowed\n # submatch guesses, such that non-bruteforce submatches over the same [i..j] take precidence.\n min_guesses = if match.token.length == 1\n MIN_SUBMATCH_GUESSES_SINGLE_CHAR + 1\n else\n MIN_SUBMATCH_GUESSES_MULTI_CHAR + 1\n Math.max guesses, min_guesses\n\n repeat_guesses: (match) ->\n match.base_guesses * match.repeat_count\n\n sequence_guesses: (match) ->\n first_chr = match.token.charAt(0)\n # lower guesses for obvious starting points\n if first_chr in ['a', 'A', 'z', 'Z', '0', '1', '9']\n base_guesses = 4\n else\n if first_chr.match /\\d/\n base_guesses = 10 # digits\n else\n # could give a higher base for uppercase,\n # assigning 26 to both upper and lower sequences is more conservative.\n base_guesses = 26\n if not match.ascending\n # need to try a descending sequence in addition to every ascending sequence ->\n # 2x guesses\n base_guesses *= 2\n base_guesses * match.token.length\n\n MIN_YEAR_SPACE: 20\n REFERENCE_YEAR: 2016\n\n regex_guesses: (match) ->\n char_class_bases =\n alpha_lower: 26\n alpha_upper: 26\n alpha: 52\n alphanumeric: 62\n digits: 10\n symbols: 33\n if match.regex_name of char_class_bases\n Math.pow(char_class_bases[match.regex_name], match.token.length)\n else switch match.regex_name\n when 'recent_year'\n # conservative estimate of year space: num years from REFERENCE_YEAR.\n # if year is close to REFERENCE_YEAR, estimate a year space of MIN_YEAR_SPACE.\n year_space = Math.abs parseInt(match.regex_match[0]) - @REFERENCE_YEAR\n year_space = Math.max year_space, @MIN_YEAR_SPACE\n year_space\n\n date_guesses: (match) ->\n # base guesses: (year distance from REFERENCE_YEAR) * num_days * num_years\n year_space = Math.max(Math.abs(match.year - @REFERENCE_YEAR), @MIN_YEAR_SPACE)\n guesses = year_space * 365\n # add factor of 4 for separator selection (one of ~4 choices)\n guesses *= 4 if match.separator\n guesses\n\n KEYBOARD_AVERAGE_DEGREE: calc_average_degree(adjacency_graphs.qwerty)\n # slightly different for keypad/mac keypad, but close enough\n KEYPAD_AVERAGE_DEGREE: calc_average_degree(adjacency_graphs.keypad)\n\n KEYBOARD_STARTING_POSITIONS: (k for k,v of adjacency_graphs.qwerty).length\n KEYPAD_STARTING_POSITIONS: (k for k,v of adjacency_graphs.keypad).length\n\n spatial_guesses: (match) ->\n if match.graph in ['qwerty', 'dvorak']\n s = @KEYBOARD_STARTING_POSITIONS\n d = @KEYBOARD_AVERAGE_DEGREE\n else\n s = @KEYPAD_STARTING_POSITIONS\n d = @KEYPAD_AVERAGE_DEGREE\n guesses = 0\n L = match.token.length\n t = match.turns\n # estimate the number of possible patterns w/ length L or less with t turns or less.\n for i in [2..L]\n possible_turns = Math.min(t, i - 1)\n for j in [1..possible_turns]\n guesses += @nCk(i - 1, j - 1) * s * Math.pow(d, j)\n # add extra guesses for shifted keys. (% instead of 5, A instead of a.)\n # math is similar to extra guesses of l33t substitutions in dictionary matches.\n if match.shifted_count\n S = match.shifted_count\n U = match.token.length - match.shifted_count # unshifted count\n if S == 0 or U == 0\n guesses *= 2\n else\n shifted_variations = 0\n shifted_variations += @nCk(S + U, i) for i in [1..Math.min(S, U)]\n guesses *= shifted_variations\n guesses\n\n dictionary_guesses: (match) ->\n match.base_guesses = match.rank # keep these as properties for display purposes\n match.uppercase_variations = @uppercase_variations match\n match.l33t_variations = @l33t_variations match\n reversed_variations = match.reversed and 2 or 1\n match.base_guesses * match.uppercase_variations * match.l33t_variations * reversed_variations\n\n START_UPPER: /^[A-Z][^A-Z]+$/\n END_UPPER: /^[^A-Z]+[A-Z]$/\n ALL_UPPER: /^[^a-z]+$/\n ALL_LOWER: /^[^A-Z]+$/\n\n uppercase_variations: (match) ->\n word = match.token\n return 1 if word.match(@ALL_LOWER) or word.toLowerCase() == word\n # a capitalized word is the most common capitalization scheme,\n # so it only doubles the search space (uncapitalized + capitalized).\n # allcaps and end-capitalized are common enough too, underestimate as 2x factor to be safe.\n for regex in [@START_UPPER, @END_UPPER, @ALL_UPPER]\n return 2 if word.match regex\n # otherwise calculate the number of ways to capitalize U+L uppercase+lowercase letters\n # with U uppercase letters or less. or, if there's more uppercase than lower (for eg. PASSwORD),\n # the number of ways to lowercase U+L letters with L lowercase letters or less.\n U = (chr for chr in word.split('') when chr.match /[A-Z]/).length\n L = (chr for chr in word.split('') when chr.match /[a-z]/).length\n variations = 0\n variations += @nCk(U + L, i) for i in [1..Math.min(U, L)]\n variations\n\n l33t_variations: (match) ->\n return 1 if not match.l33t\n variations = 1\n for subbed, unsubbed of match.sub\n # lower-case match.token before calculating: capitalization shouldn't affect l33t calc.\n chrs = match.token.toLowerCase().split('')\n S = (chr for chr in chrs when chr == subbed).length # num of subbed chars\n U = (chr for chr in chrs when chr == unsubbed).length # num of unsubbed chars\n if S == 0 or U == 0\n # for this sub, password is either fully subbed (444) or fully unsubbed (aaa)\n # treat that as doubling the space (attacker needs to try fully subbed chars in addition to\n # unsubbed.)\n variations *= 2\n else\n # this case is similar to capitalization:\n # with aa44a, U = 3, S = 2, attacker needs to try unsubbed + one sub + two subs\n p = Math.min(U, S)\n possibilities = 0\n possibilities += @nCk(U + S, i) for i in [1..p]\n variations *= possibilities\n variations\n\n # utilities --------------------------------------------------------------------\n\nmodule.exports = scoring\n", "time_estimates =\n estimate_attack_times: (guesses) ->\n crack_times_seconds =\n online_throttling_100_per_hour: guesses / (100 / 3600)\n online_no_throttling_10_per_second: guesses / 10\n offline_slow_hashing_1e4_per_second: guesses / 1e4\n offline_fast_hashing_1e10_per_second: guesses / 1e10\n\n crack_times_display = {}\n for scenario, seconds of crack_times_seconds\n crack_times_display[scenario] = @display_time seconds\n\n crack_times_seconds: crack_times_seconds\n crack_times_display: crack_times_display\n score: @guesses_to_score guesses\n\n\n guesses_to_score: (guesses) ->\n DELTA = 5\n if guesses < 1e3 + DELTA\n # risky password: \"too guessable\"\n 0\n else if guesses < 1e6 + DELTA\n # modest protection from throttled online attacks: \"very guessable\"\n 1\n else if guesses < 1e8 + DELTA\n # modest protection from unthrottled online attacks: \"somewhat guessable\"\n 2\n else if guesses < 1e10 + DELTA\n # modest protection from offline attacks: \"safely unguessable\"\n # assuming a salted, slow hash function like bcrypt, scrypt, PBKDF2, argon, etc\n 3\n else\n # strong protection from offline attacks under same scenario: \"very unguessable\"\n 4\n\n display_time: (seconds) ->\n minute = 60\n hour = minute * 60\n day = hour * 24\n month = day * 31\n year = month * 12\n century = year * 100\n [display_num, display_str] = if seconds < 1\n [null, 'less than a second']\n else if seconds < minute\n base = Math.round seconds\n [base, \"#{base} second\"]\n else if seconds < hour\n base = Math.round seconds / minute\n [base, \"#{base} minute\"]\n else if seconds < day\n base = Math.round seconds / hour\n [base, \"#{base} hour\"]\n else if seconds < month\n base = Math.round seconds / day\n [base, \"#{base} day\"]\n else if seconds < year\n base = Math.round seconds / month\n [base, \"#{base} month\"]\n else if seconds < century\n base = Math.round seconds / year\n [base, \"#{base} year\"]\n else\n [null, 'centuries']\n display_str += 's' if display_num? and display_num != 1\n display_str\n\nmodule.exports = time_estimates\n" ] } \ No newline at end of file