persistent-setup: estimate strength with zxcvbn

bails/.local/bin/persistent-setup

@@ -48,6 +48,29 @@ prompt_passphrase() {
     printf '%s' "${passphrase//%25/%}"
 }
 
+# Print a passphrase's estimated strength in bits. Read it from stdin so it
+# never appears in a process list. Uses zxcvbn as Tails ships it for its
+# Secrets password manager: the Rust port in Tails 7.14, or the Python one.
+passphrase_bits() {
+    python3 -c '
+import math
+import sys
+
+passphrase = sys.stdin.read()
+try:
+    from zxcvbn_rs_py import zxcvbn
+    guesses_log10 = zxcvbn(passphrase).guesses_log10
+except ImportError:
+    from zxcvbn import zxcvbn
+    try:
+        result = zxcvbn(passphrase, max_length=len(passphrase))
+    except TypeError:  # zxcvbn before 4.5 has no max_length and no length limit
+        result = zxcvbn(passphrase)
+    guesses_log10 = result["guesses_log10"]
+print(int(guesses_log10 * math.log2(10)))
+'
+}
+
 # Check if user password is already set
 passwd_unset=$(passwd -S "$USER" | grep -c NP)
 
@@ -64,11 +87,15 @@ pgrep -f spaced-repetition || if /usr/local/lib/tpscli is-unlocked; then
         if [ -z "$existing_passphrase" ]; then
             zenity --error --title="Error" --text="Existing Persistent Storage passphrase is required. Please provide the passphrase." "$ICON"
         else
-            # Estimate passphrase entropy to see if we can proceed; word separators add no entropy
-            entropy=$(keepassxc-cli estimate "${existing_passphrase// /}" | cut -f2 | tr -C -d '[:digit:]')
-            if ((entropy >= 65000)); then
+            # Estimate passphrase strength to see if we can proceed; word separators add no entropy
+            if ! bits=$(printf '%s' "${existing_passphrase// /}" | passphrase_bits) || \
+                [[ ! "$bits" =~ ^[0-9]+$ ]]; then
+                zenity --warning --title='Passphrase strength not checked' "$ICON" \
+                  --text='CipherStick could not check the strength of your passphrase because the zxcvbn estimator is unavailable. Tails recommends a passphrase of 5 to 7 random words.'
+                break
+            elif ((bits >= 64)); then # The most Tails' zxcvbn can report
                 break
-            elif ((entropy > 50000)); then
+            elif ((bits > 50)); then
                 zenity --question --icon-name=dialog-warning --title='Warning: Weak Passphrase Detected' \
                   --text="<b>Your passphrase is too weak to protect against a state-sponsored attacker with physical access to your USB stick.</b>\n\nTails recommends choosing a long passphrase made of 5 to 7 random words.\n<a href='https://theintercept.com/2015/03/26/passphrases-can-memorize-attackers-cant-guess/'>Learn about the maths behind memorizable and secure passphrases</a>.\n\nIf a state-sponsored attacker with physical access to your device is part of your <a href='https://ssd.eff.org/module/your-security-plan'>threat model</a>, you MUST restart, delete this Persistent Storage and use a recommended passphrase.\n\nFor more information, please read the Tails security advisory on passphrase security: <a href='https://tails.net/security/argon2id/#understanding'>Understanding weak passphrases</a>\n\nBe sure to save your work before clicking 'Restart Now'." "$ICON" --ok-label='Continue' --default-cancel --cancel-label='Restart Now' && break
             else
@@ -78,7 +105,7 @@ pgrep -f spaced-repetition || if /usr/local/lib/tpscli is-unlocked; then
             systemctl reboot
         fi
     done
-    unset entropy
+    unset bits
     [ -f $SET_UP ] || if ((passwd_unset)); then
         # Change user account password to Persistent Storage passphrase for spaced repetition practice.
         printf '%s\n%s' "$existing_passphrase" "$existing_passphrase" | passwd || echo "FAILURE to change passphrase"