
> Note that these are only some rough calculations based on a set of strong assumptions I made at 1am. The same is not going to hold for techniques other than brute force.

I was recently having a discussion about password inputs! Most password fields out there mask their characters, i.e. they display "********" instead of "password". However, in some project I was involved there was a requirement to mask the input such that it would always display a static number of masked characters. I thought that would be quite unintuitive and questioned the benefit of it. But apparently, there are also some well-known applications that are doing this. This made me wonder how much easier it would be to guess a password if you already knew its length.

Let's assume a very basic brute force approach. Let $r(n,m)$ be the ratio of possible passwords you can eliminate from your search, with $n$ being the password length and $m$ being the number of possible characters.

$$
\begin{align*}
r(n, m) & = \frac{\sum_{i=1}^{n-1} m^i}{m^n}\\
& = \frac{\frac{m^n - 1}{m - 1} - 1}{m^n}\\
& = \frac{m^n - m}{m^n(m - 1)}\\
& = \frac{1 - m^{1-n}}{m - 1}
\end{align*}
$$

Now, if we assume that $m, n \geq 2$ (notice that $m^{1-n}$ is strictly decreasing in $[2, \infty) \times [2, \infty)$):

$$
\frac{1}{2(m - 1)} \leq \frac{1 - m^{1-n}}{m - 1} \leq \frac{1}{m - 1}
$$

One interesting observation here is the following: even if your password was infinitely long, an attacker would still get *some* benefit from knowing the length of your password, the benefit of which at this point only depends on the number of characters that are allowed.

In practice, we can almost always assume that $m \geq 62$ (26 lower-case, 26 upper-case, 10 digit characters), which gives us the following bounds:

$$
\left[ \frac{1}{122}, \frac{1}{61} \right] \approx \left[ 0.008197, 0.016393 \right]
$$

i.e. even in the worst-case scenario, an attacker would only have approx. 1.63% fewer options to try.


Keeping password length secret


> This is an old unfinished blog migrated from my old blog, I cannot guarantee the correctness of this. I have switched to a Pixel now.

I have been using OnePlus phones for about five years now. One of the neat things OnePlus allows you to do is relocking the bootloader with a custom AVB key. However, most custom ROMs do not seem to be signing their builds.

Based on the following [guide](https://forum.xda-developers.com/t/guide-re-locking-the-bootloader-on-the-oneplus-8t-with-a-self-signed-build-of-los-18-1.4259409/
), I've had to do the following to sign a [Pixel Experience](https://pixelexperience.org/) build. Here's the diff:

```diff
project build/make/
diff --git a/core/Makefile b/core/Makefile
index ebd8cf206..95235e9cc 100644
--- a/core/Makefile
+++ b/core/Makefile
@@ -4113,7 +4113,7 @@ $(if $(BOARD_AVB_ALGORITHM),,$(error BOARD_AVB_ALGORITHM is not defined))
 else
 # If key path isn't specified, use the 4096-bit test key.
 BOARD_AVB_ALGORITHM := SHA256_RSA4096
-BOARD_AVB_KEY_PATH := external/avb/test/data/testkey_rsa4096.pem
+# BOARD_AVB_KEY_PATH := external/avb/test/data/testkey_rsa4096.pem
 endif
 
 # AVB signing for system_other.img.
@@ -4356,16 +4356,19 @@ endef
 # $(1): Partition name, e.g. boot or system.
 define check-and-set-avb-args
 $(eval _in_chained_vbmeta := $(filter $(1),$(INTERNAL_AVB_PARTITIONS_IN_CHAINED_VBMETA_IMAGES)))
-$(if $(BOARD_AVB_$(call to-upper,$(1))_KEY_PATH),\
-    $(if $(_in_chained_vbmeta),\
-        $(error Chaining partition "$(1)" in chained VBMeta image is not supported)) \
-    $(call _check-and-set-avb-chain-args,$(1)),\
-    $(if $(_in_chained_vbmeta),,\
-        $(if $(filter boot,$(1)),\
-            $(eval INTERNAL_AVB_MAKE_VBMETA_IMAGE_ARGS += \
-                --include_descriptors_from_image $(firstword $(call images-for-partitions,$(1)))),\
-            $(eval INTERNAL_AVB_MAKE_VBMETA_IMAGE_ARGS += \
-                --include_descriptors_from_image $(call images-for-partitions,$(1))))))
+$(eval _partition_path := $(call images-for-partitions,$(1)))
+$(if $(_partition_path),\
+    $(if $(BOARD_AVB_$(call to-upper,$(1))_KEY_PATH),\
+        $(if $(_in_chained_vbmeta),\
+            $(error Chaining partition "$(1)" in chained VBMeta image is not supported)) \
+        $(call _check-and-set-avb-chain-args,$(1)),\
+        $(if $(_in_chained_vbmeta),,\
+            $(if $(filter boot,$(1)),\
+                $(eval INTERNAL_AVB_MAKE_VBMETA_IMAGE_ARGS += \
+                    --include_descriptors_from_image $(firstword $(_partition_path))),\
+                $(eval INTERNAL_AVB_MAKE_VBMETA_IMAGE_ARGS += \
+                    --include_descriptors_from_image $(_partition_path))))),\
+    $(info Partition path for "$(1)" not yet defined, not adding it to vbmeta))
 endef
 
 # Checks and sets build variables for a custom chained partition to include it into vbmeta.img.
@@ -4472,7 +4475,7 @@ BOARD_AVB_MAKE_VBMETA_VENDOR_IMAGE_ARGS += --padding_size 4096
 
 ifeq (eng,$(filter eng, $(TARGET_BUILD_VARIANT)))
 # We only need the flag in top-level vbmeta.img.
-BOARD_AVB_MAKE_VBMETA_IMAGE_ARGS += --set_hashtree_disabled_flag
+# BOARD_AVB_MAKE_VBMETA_IMAGE_ARGS += --set_hashtree_disabled_flag
 endif
 
 ifdef BOARD_AVB_ROLLBACK_INDEX
diff --git a/tools/releasetools/apex_utils.py b/tools/releasetools/apex_utils.py
index 4b6052488..9d345480d 100644
--- a/tools/releasetools/apex_utils.py
+++ b/tools/releasetools/apex_utils.py
@@ -21,7 +21,7 @@ import shlex
 import shutil
 import zipfile
 
-import apex_manifest
+# import apex_manifest
 import common
 from common import UnzipTemp, RunAndCheckOutput, MakeTempFile, OPTIONS
 
@@ -572,9 +572,9 @@ def GetApexInfoFromTargetFiles(input_file, partition, compressed_only=True):
       continue
     apex_info = ota_metadata_pb2.ApexInfo()
     # Open the apex file to retrieve information
-    manifest = apex_manifest.fromApex(apex_filepath)
-    apex_info.package_name = manifest.name
-    apex_info.version = manifest.version
+    # manifest = apex_manifest.fromApex(apex_filepath)
+    # apex_info.package_name = manifest.name
+    # apex_info.version = manifest.version
     # Check if the file is compressed or not
     apex_type = RunAndCheckOutput([
         deapexer, "--debugfs_path", debugfs_path,

project device/google/bonito/
diff --git a/BoardConfig-common.mk b/BoardConfig-common.mk
index 8a7b1141..cc7fd0da 100644
--- a/BoardConfig-common.mk
+++ b/BoardConfig-common.mk
@@ -86,7 +86,7 @@ BOARD_USES_RECOVERY_AS_BOOT := true
 BOARD_USES_METADATA_PARTITION := true
 
 # Verified Boot
-BOARD_AVB_MAKE_VBMETA_IMAGE_ARGS += --flags 3
+# BOARD_AVB_MAKE_VBMETA_IMAGE_ARGS += --flags 3
 
 # System Image
 BOARD_SYSTEMIMAGE_FILE_SYSTEM_TYPE := erofs
diff --git a/sargo/BoardConfig.mk b/sargo/BoardConfig.mk
index bb7e9ea9..b3331ff4 100644
--- a/sargo/BoardConfig.mk
+++ b/sargo/BoardConfig.mk
@@ -25,3 +25,6 @@ else
   -include vendor/google_devices/bonito/proprietary/BoardConfigVendor.mk
   include vendor/google/sargo/BoardConfigVendor.mk
 endif
+
+BOARD_AVB_ALGORITHM := SHA256_RSA2048
+BOARD_AVB_KEY_PATH := /home/thomas/.android-certs/releasekey.pk8

project device/google/cuttlefish/
diff --git a/shared/BoardConfig.mk b/shared/BoardConfig.mk
index b59b39ca1..808367d1c 100644
--- a/shared/BoardConfig.mk
+++ b/shared/BoardConfig.mk
@@ -79,11 +79,11 @@ TARGET_COPY_OUT_SYSTEM_DLKM := system_dlkm
 # Enable AVB
 BOARD_AVB_ENABLE := true
 BOARD_AVB_ALGORITHM := SHA256_RSA4096
-BOARD_AVB_KEY_PATH := external/avb/test/data/testkey_rsa4096.pem
+# BOARD_AVB_KEY_PATH := external/avb/test/data/testkey_rsa4096.pem
 
 # Enable chained vbmeta for system image mixing
 BOARD_AVB_VBMETA_SYSTEM := product system system_ext
-BOARD_AVB_VBMETA_SYSTEM_KEY_PATH := external/avb/test/data/testkey_rsa4096.pem
+BOARD_AVB_KEY_PATH := /home/thomas/.android-certs/releasekey.pk8
 BOARD_AVB_VBMETA_SYSTEM_ALGORITHM := SHA256_RSA4096
 BOARD_AVB_VBMETA_SYSTEM_ROLLBACK_INDEX := $(PLATFORM_SECURITY_PATCH_TIMESTAMP)
 BOARD_AVB_VBMETA_SYSTEM_ROLLBACK_INDEX_LOCATION := 1
```

To build an OTA:

```bash
source build/envsetup.sh
lunch aosp_sargo-userdebug
croot
mka bacon -j8
mka target-files-package otatools
./build/tools/releasetools/sign_target_files_apks -o -d ~/.android-certs $OUT/obj/PACKAGING/target_files_intermediates/*-target_files-*.zip signed-target_files.zip
./build/tools/releasetools/ota_from_target_files -k ~/.android-certs/releasekey --block signed-target_files.zip pe-UNOFFICIAL-kebab-signed.zip
```

And to flash the new AVB key and relock the bootloader:

```bash
fastboot flash avb_custom_key ~/android/kebab/pkmd/pkmd.bin
fastboot reboot bootloader
fastboot oem lock
```


security