10.10. 凭据猜测攻击(10.10. Credentials-Guessing Attacks)

10.10. 凭据猜测攻击

授权服务器必须防止攻击者猜测访问令牌、授权码、刷新令牌、资源所有者密码和客户端凭据。

攻击者猜测已生成令牌（和其它不打算被最终用户掌握的凭据）的概率必须小于或等于2 ^（-128），并且应该小于或等于2 ^（-160）。

授权服务器必须采用其他手段来保护打算给最终用户使用的凭据。

10.10. Credentials-Guessing Attacks

   The authorization server MUST prevent attackers from guessing access
   tokens, authorization codes, refresh tokens, resource owner
   passwords, and client credentials.

   The probability of an attacker guessing generated tokens (and other
   credentials not intended for handling by end-users) MUST be less than
   or equal to 2^(-128) and SHOULD be less than or equal to 2^(-160).

   The authorization server MUST utilize other means to protect
   credentials intended for end-user usage.