dhui / diceware Goto Github PK

Use sys.version_info or platform.python_version_tuple() to determine Python runtime version:
https://docs.python.org/3/library/sys.html#sys.version_info
https://docs.python.org/3/library/sys.html#sys.version_info

Use time.monotonic() if Python runtime version is >= 3.3 https://docs.python.org/3/library/time.html#time.monotonic
Use time.monotonic_ns() if Python runtime version is >= 3.7 https://docs.python.org/3/library/time.html#time.monotonic_ns

Using the % operator in roll_dice() is not secure since not all of the buckets have the same probability of being hit.
Instead we should convert the number to a fraction in the range 0-1 and then multiply.

List: https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt

References:
https://www.eff.org/dice
https://www.eff.org/deeplinks/2016/07/new-wordlists-random-passphrases

Reference: http://www.pcg-random.org/posts/bounded-rands.html

Currently using FP Multiply (Biased) method to "convert" a random number to a dice roll.

Based on the benchmarks and conclusion, we should use one of the following unbiased methods instead:

• Bitmask
• Lemire
  • With threshold-based discarding
  • With threshold-based discarding and extra tweak