secret-entropy

Source: crates/lvcs/src/secrets/entropy.rs.

/// The rule a hit of the heuristic names in `SecretHit::rule`.
const ENTROPY_RULE: &str = "entropy";

/// Fewest code points of a candidate: a maximal run of ASCII letters,
/// digits, `+`, `/`, `_`, and `-` that holds an uppercase letter, a
/// lowercase letter, and a digit.
const ENTROPY_MIN_LEN: usize = 24;

/// Least share of adjacent pairs of the candidate's letters and digits
/// (its other code points skipped) that switch between uppercase,
/// lowercase, and digit.
const ENTROPY_MIN_SWITCHES: f64 = 0.35;

/// Least Shannon entropy of a candidate of [`ENTROPY_MIN_LEN`] code
/// points, in bits per code point. The floor rises with the candidate's
/// length, since a longer random string reaches a higher entropy.
const ENTROPY_FLOOR_MIN: f64 = 3.9;

/// How much the entropy floor rises per code point past
/// [`ENTROPY_MIN_LEN`].
const ENTROPY_FLOOR_STEP: f64 = 0.0375;

/// The highest the entropy floor rises, reached at 40 code points.
const ENTROPY_FLOOR_MAX: f64 = 4.5;

/// Fewest lowercase letters in a row that make a word, together with the
/// uppercase letter right before them (`Address` in `Ipv4AddressToString`).
const WORD_MIN_LOWER: usize = 3;

/// Most share of a candidate's letters that may sit in words: an
/// identifier (`NewSessionTicketPayloadTls13`) or a path is mostly words,
/// and a random string seldom is.
const ENTROPY_MAX_WORD_SHARE: f64 = 0.6;

/// Labels a digest starts with, so a candidate starting with one is not a
/// secret: `sha512-` in npm lockfiles and HTML `integrity` attributes.
const DIGEST_PREFIXES: &[&str] = &["sha1-", "sha256-", "sha384-", "sha512-"];

/// Labels public data comes right after, so a candidate following one is
/// not a secret: `h1:` in Go's `go.sum`, a data URI's `;base64,`, and the
/// key types of SSH public keys.
const PUBLIC_LEADS: &[&str] = &[
    "h1:",
    ";base64,",
    "ssh-rsa ",
    "ssh-dss ",
    "ssh-ed25519 ",
    "ecdsa-sha2-nistp256 ",
    "ecdsa-sha2-nistp384 ",
    "ecdsa-sha2-nistp521 ",
    "sk-ssh-ed25519@openssh.com ",
    "sk-ecdsa-sha2-nistp256@openssh.com ",
];