I was just thinking: LLMs can generate coherent sentences, and coherent sentences are easier to remember.
Would it be possible to ‘seed’ some kind of language model with randomness from a CSPRNG or true randomness source, and generate a pass-sentence, or pass-paragraph, that is above or equal to a target entropy?
It might be easier if a language designed for computers as well as humans was used, such as Lojban or Toaq.
An easier solution is to just use a resource like strongphrase.net which already has a passphrase generator
I would say no: whatever comes out of a LLM is not random.
You could argue it’s most likely to be statistical average.
It’s the opposite of what you want. They generate the most likely string of words based on the input, so you would be much more likely to get the same output given the same input.
Why would you do this?
We have good ways of making random passwords s, this seems very counter intuitive
Looks interesting. Thanks for sharing. Good to know I’m on the right track.
I’m tempted to mark it as the solution already, but I should probably read it first.
I said in the OP: it would result in passphrases that are easier to remember.
Maybe it’s not that useful, but it’s still a fun thought.
If that’s what you want, then just use StrongPhrase, as previously mentioned.
Interesting. So it does not look like the researchers even attempt to generate true randomness but instead raise entropy “through in-context examples and generation through a new top-q truncation method”
Yeah but like how hard is it to remember six random words.
In my experience, the hard part is typing the damn thing.
Yeah it’s useful to have biometrics as a quicker authentication method after you type the password in once. GOS lets you set a separate, shorter PIN to use with biometrics which is really nice.
Doesn’t help if you do your important stuff on a computer like me. I had to shorten my computer’s password from five words to two.
LLMs have statistically low entropy. Today security standards are way more high than just “it looks random so we’ll take it”. Some junior programmers still believe to this day that time (Unix timestamp) is a good randomizer, e.g. as a salt. It is not. You can predict or guess that.
Same with LLM, even today, when they are still a pretty new thing, there are papers on how you can predict what an LLM is going to give you based on the prompt.
@satchlj The issue with this paper is that LLMs are not deterministic. Even if the authors believe it’s going to produce high-quality, secure passwords, will it happen in every case? No.
Yeah, at this point I would rather spend time on creating secure passwords before quantum computers hit the market.
If that’s the only upside, why even bother?
One more thing coming up to my mind is that a model like that would have to be local. We can’t allow for LLMs to produce our passwords, that’s counter-intuitive given that LLMs log and digest everything they do.
I am aware of that. I was talking about seeding a model with the right kind of randomness, because they are random already. I definitely wasn’t talking about just asking ChatGPT for a password lol.
Of course.
LLMs are in a way the opposite of random. If you take something already random and apply rules to it it’s not random anymore.
Then again, that might become difficult to type and/or remember again. Imagine having to reproduce an entire paragraph phrased in a specific way each time. Almost as bad as remembering a password with random letters and numbers and symbols. Then again, I guess it depends on the person.
How many people responding to this idea have fully read the paper @satchlj posted?