[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 11 Sep 2012 14:55:38 -0400
From: Matt Weir <cweir@...edu>
To: john-users@...ts.openwall.com
Subject: Re: Passphrase Creation
> You are aware that there are 7776 diceware words. I don't know what c/s rate you are imagining,
> but diceware with words has an entropy of 51 bits.
That's why I said "3/4 letter combinations" though I should have said
'word' combinations. 51 bits is tough, but for a fast hash it's
conceivable. Otherwise DES would still be safe ;p
>> Name: Mad Libs
>> Description: Remember those Mad Libs books where you had to fill in
>> blanks, such as "Proper-noun verbs a noun",
>
> [big snip]
>> Name: Context Free Grammars
>> Description: It doesn't have to be a CFG, but a PCFG would be the type
>> of grammar I'd try starting out.
>
> You can use a CFG for both the Mad Libs and the CFG generation. Just block recursion in the first case.
> Really the regular language you get with the Mad Libs scheme is a simple proper subset of the CFG stuff.
>
> But maybe it does make more sense to implement these separately.
You are absolutely correct that the Mad Libs approach is a CFG. I
guess the main reason I keep them separate is because when I mention
CFG's most people's eyes glaze over, but they understand Mad Libs.
> The big problem we face is that that pass phrases are extremely rare (at least leaked ones). So we have very little data of what people actually do to go on.
Fully agree.
> But remember, diceware-like schemes are designed to withstand attacks even when the attacker knows precisely what password creation scheme was used.
Yup, random passwords are random ;p
Matt
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
